Privacy Policy

Last updated: October 21, 2026

1. Introduction

Oxsome ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard information in connection with the digital marketing and advertising services we provide to our clients.

2. Information We Collect

We collect the following types of information:

• Business contact information: name, email address, phone number, company name, and mailing address provided by clients or leads.
• Advertising account data: access to ad platforms (Google, Meta, etc.) provided by clients via authorized API access and OAuth permissions.
• Website usage data: standard analytics data such as IP address, browser type, and pages visited when you interact with our website.
• Communication records: emails, messages, and other correspondence related to service delivery.

3. How We Use Your Information

We use collected information solely to:

• Manage and optimize advertising campaigns on behalf of clients
• Communicate regarding service delivery, reporting, and billing
• Improve our internal processes and service quality
• Comply with legal obligations

4. Data Sharing

We do not sell, rent, or trade your data to third parties. We may share limited information with trusted service providers (such as cloud infrastructure, analytics tools, the provider that holds connected-app sign-ins for us, and the AI model provider that powers our assistant) strictly as needed to operate our business. All such providers are bound by confidentiality obligations.

5. Data Retention

We retain client data only for the duration of the active service engagement. Upon termination of services, data is deleted or anonymized within 90 days unless a longer retention period is required by law or mutually agreed upon in writing.

6. Security

We implement industry-standard security practices including encrypted data storage, access controls, and secure transmission protocols to protect your information from unauthorized access or disclosure.

7. Your Rights

You may request access to, correction of, or deletion of your personal data at any time. To submit a request, see our Data Deletion page or contact us directly.

8. Connected Business Apps (Jobber)

What we access. When you connect a business app such as Jobber to Oxsome, you authorize us, through that app's own sign-in, to:

• Read and update clients and their properties, requests, quotes, jobs and scheduled visits: the records your assistant works with
• Read only everything else in the account the app makes available: invoices, payments, expenses, timesheets, team members, vehicles and equipment, marketing records, custom fields, and products and services

We never create or change invoices, payments, expenses, timesheets or team members.

How we use it. Only to run your assistant for your business: answering your questions about your schedule, customers, quotes and invoices; booking requests and visits your customers choose; rescheduling visits; adding notes; and preparing draft quotes from the prices you give us. Every change we make in your account is confirmed first, by you or by the customer booking a time.

What we store. Your account's id and name, so we know which business a connection belongs to; a log of each change we make in your account (what was asked, by whom, and what the app returned, which may include a customer's name, phone, email and address); and the text conversations your assistant has. For your assistant, we don't keep a separate copy of your records; we read them from the app when they're needed.

Franchise and multi-location reporting. If your business is a location of a franchise or multi-location organization that uses Oxsome for reporting, and you connect your account for that purpose, we keep a copy of your account's records (the read-only list above, including jobs, quotes, invoices, payments, expenses and timesheets) so your organization's reports can be built and kept up to date. Your organization's authorized users, such as its corporate office, can see reports that include your location's data. We only do this when you connect for it, and the app's sign-in screen shows which app and which permissions you're approving. Your data isn't shown to other locations or to anyone outside your organization, and we don't use it for any other purpose.

Access tokens. Your sign-in tokens are held on our behalf by our authorization provider, refreshed automatically, and never stored in our own systems or shown to anyone.

Retention and deletion. When you disconnect, the change log we keep for your account is deleted automatically, right away, and any reporting copies are deleted within 30 days, unless you've asked us to keep them. Conversation records are kept while you're a client and deleted or anonymized within 90 days after service ends, unless the law requires us to keep them longer. You can ask us to delete anything sooner by emailing privacy@oxsome.com; we'll do so within 30 days.

Disconnecting. You can disconnect at any time, from Oxsome (Command Center → Comms Agent → Connect your CRM → Disconnect) or from inside the app by removing Oxsome. Either way we stop all access immediately and delete the connection and its tokens, and the data we hold from the app is deleted as described above. Your data stays in your app.

9. Google Calendar

A business can connect its Google Calendar to Oxsome so our assistant only offers appointment times the business is actually free, and so the appointments it books show up on that calendar.

What we access. Through Google's own sign-in, you allow us to:

• See your list of calendars, so you can choose the one you book appointments from
• Read the events on the calendar you choose, to find when you're busy. We only use each event's start and end time and whether it marks you as busy; we don't read or keep its title, description, location or guests
• Create, update and delete events for appointments booked through Oxsome, and only those

How we use it. Only to check your availability and keep the appointments we book on your calendar. We don't use your Google data for advertising, we don't sell it, and we don't use it to train AI models.

AI providers. We don't send your Google Calendar data to any AI provider. Our assistant is only given the open appointment times we work out from your busy times, never your events.

What we store. Which calendar you chose (its id and name), the state of your connection, and the ids of the events we created, so we can update or remove them when an appointment moves or is cancelled. Your busy times are read when they're needed and are not stored. Your sign-in tokens are held by our authorization provider and never stored in our own systems.

Who can see it. No one at Oxsome reads your calendar data, except when you ask us for help with your account, when it's needed for security, or when the law requires it.

Disconnecting and deletion. You can disconnect at any time in the Command Center where you connected your calendar, or from your Google Account at myaccount.google.com/permissions. We stop all access right away and delete the connection, the calendar you chose and our event ids. Appointments we already added stay on your calendar, since they're yours. To ask us to delete anything else, email privacy@oxsome.com and we'll do it within 30 days.

Google API Services User Data Policy. Oxsome's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10. Contact

For privacy-related inquiries, contact us at: privacy@oxsome.com