Privacy Policy

VivoVac Pty Ltd (ACN 652 414 376), trading as Opal Black, is the data controller for personal information collected through opalblack.ai and the Opal Black workspace. This policy explains how we handle information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Paddle separately controls payment information it collects as our Merchant of Record.

Depending on how you use Opal Black, we collect:

• your name, email address, profile image, business name and contact details;
• account, sign-in, subscription and transaction-status information;
• conversations, instructions, business facts, files, drafts, approvals and support messages;
• website details and business information you ask us to extract during setup;
• usage, device, browser, log, IP address and security-event information;
• information read from optional services that you connect and expressly authorise.

Paddle collects payment card and billing details directly. We do not receive or store your full card number.

If you choose Google sign-in, Google shares only your name, email address, profile picture and a Google account identifier. We use that information solely to create your Opal Black account, sign you in and display your details. Google sign-in itself does not give us access to Gmail, Drive, Calendar, contacts or other Google content. We do not sell sign-in information, use it for advertising or use it for model training.

You can remove Opal Black’s access at Google Account permissions. Opal Black’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

If you separately connect Gmail, Google Calendar, Google Sheets, Google Drive, Google Docs or another supported service, we access only the information needed for the permission and task shown when you connect it. Examples include reading selected mail, saving a draft, checking availability, drafting an event, reading a price list or working with a document you choose. Connections belong to your account, are not shared with other customers and can be disconnected at any time.

Connected information is used to provide the action you request, maintain workspace context, show the result and keep an activity record. Opal Black is designed to wait for your approval before sending, booking, invoicing or otherwise changing an external service.

We use information to:

• create, authenticate and secure accounts;
• provide AI responses, drafts, agents, workspace memory and connected actions you request;
• process subscriptions and provide account and payment support;
• prevent fraud, investigate misuse and maintain service reliability;
• answer support requests, improve the service and meet legal duties.

Our legal bases are performance of our contract with you, our legitimate interests in operating and securing the Services, consent where requested, and compliance with legal obligations.

Relevant parts of your instructions and workspace context are sent to AI model providers to generate the response or draft you request. We limit what is sent to what is reasonably needed for that task and use business or API services where available.

The AI model providers we currently use are Anthropic for text, and xAI for text, images and video. If you add your own key for another provider, such as OpenAI, those requests go to that provider.

Model training: On the free preview, conversation content may be used to train and improve Opal Black models. On paid plans, your workspace content is not used for training unless you turn it on in account settings, and you can turn it off at any time. Your account details, including any information received through Google sign-in, are never used for model training.

We share information only as needed with:

• hosting, authentication, AI processing (including the AI model providers named in section 6), page analytics provided by our hosting provider, and customer-support providers;
• services you choose to connect, for the task and permission you authorise;
• Paddle.com Market Limited, our Merchant of Record, for checkout, subscriptions, invoicing, tax compliance, fraud prevention and payment support under Paddle’s Privacy Policy;
• legal, accounting and other professional advisers;
• courts, regulators and authorities where law requires it.

We do not sell personal information or use it for targeted advertising.

If you link an outside service (for example Google Calendar, Google Drive or Gmail), James can read what that service allows and prepare drafts. Nothing is sent, booked or changed in that service until you approve it.

We store the access token for the link, encrypted, and any fetched content used in your drafts. We do not sell this data and we do not use it to train AI models.

You can disconnect any service in Settings → Connectors. Disconnecting removes our access straight away; you can ask us to delete stored content at any time.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Microsoft services, when offered, follow Microsoft's API terms.

Some providers process information outside Australia, including in the United States and other countries. We use appropriate contractual, access and security controls. If your organisation requires information to remain in a particular country, contact us before connecting data so we can confirm what is supported.

We keep personal information while your account is active and for as long as reasonably needed to provide the Services, maintain required records, resolve disputes, prevent fraud and meet legal obligations. When it is no longer needed, we delete or anonymise it. You can request account deletion from account settings or by contacting privacy@opalblack.ai. Payment and legal records may need to be kept after an account closes.

We use reasonable technical and organisational safeguards, including encryption in transit, access controls, restricted permissions and activity records. No system is completely secure. Please tell us promptly at privacy@opalblack.ai if you believe your account or information has been compromised.

We use cookies and similar storage needed for sign-in, security (including bot protection by our network provider), checkout and your preferences, and one analytics cookie set by our hosting provider to count page use. These are: your sign-in session, kept in your browser's storage until you sign out; a bot-protection cookie that lasts about 30 minutes; the hosting provider's page-analytics cookie; and small preference and checkout items, such as your light or dark theme, your menu setting and a saved purchase that clears after 30 minutes. We do not use advertising cookies. You can block cookies in your browser settings, but sign-in needs the essential ones.

Our hosting provider may record how public pages are used, such as clicks and page layout, with form entries masked. We do not record workspace content.

You may ask to access, correct, export or delete personal information, object to or restrict certain processing, or withdraw consent by contacting privacy@opalblack.ai. We may need to verify your identity. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

If we materially change this policy, we will update the date above and notify account holders by email or in the workspace where appropriate.

VivoVac Pty Ltd, trading as Opal Black
14/117 Old Pittwater Road, Brookvale, New South Wales, Australia
privacy@opalblack.ai

See also our Terms of Service and Refund Policy.