Privacy Policy

Your privacy matters. This policy explains exactly what we collect, why, how we use it, and the rights you have.

Last updated: June 4, 2026

This Privacy Policy ("Policy") describes how Olivly AI ("Olivly," "we," "us," or "our") collects, uses, discloses, and safeguards your information when you visit olivly.ai, join our waitlist, or use our products and services (collectively, the "Service"). By accessing or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree, please do not use the Service.

1. Who we are

Olivly is the data controller responsible for your personal information processed through the Service. If you have questions about this Policy or our data practices, contact us at support@olivly.ai.

2. Information we collect

2.1 Information you provide directly

  • Account & profile data: name, email address, job role, skills, experience, and any other profile details you enter to personalize AI-generated emails.
  • Waitlist data: the email address you submit to join our pre-launch waitlist, and the referring page.
  • Content you create: emails you draft, edit, send, schedule, or save through the Service, including subject lines, body text, and recipient details.
  • Communications: messages you send us by email or support channels.
  • Payment details: processed by Stripe. We do not store your card number; we receive a customer ID, subscription status, and the last four digits for reference.

2.2 Information from connected accounts

When you connect Gmail through Google OAuth, we request limited scopes:

  • gmail.send — to send emails you have explicitly composed and approved.
  • userinfo.email — to confirm which Gmail address is connected.

Google API Limited Use disclosure: Olivly's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail data for advertising, do not sell it, do not transfer it to third parties except as needed to provide the Service, comply with law, or with your consent, and do not allow humans to read it except with your explicit consent, for security purposes, or where required by law.

2.3 Information collected automatically

  • Usage data: pages visited, features used, search queries, buttons clicked, and timestamps.
  • Device & technical data: IP address, browser type and version, operating system, device identifiers, language, and referring URLs.
  • Email tracking: when you send an email through Olivly with tracking enabled, we embed a small pixel that records open events (date, time, and approximate location derived from IP).
  • Cookies & similar technologies: see Section 9.

2.4 Information about third parties

To provide our core function, we process business contact information of the recipients you choose to reach (e.g., a hiring manager's name, role, company, and professional email address) sourced from third-party data providers and public professional sources. You are responsible for ensuring your use of this information complies with applicable law.

3. How we use your information

We use the information we collect to:

  • Provide, operate, maintain, and improve the Service;
  • Generate personalized email drafts using our AI;
  • Find and surface business contacts you request;
  • Send emails on your behalf via your connected Gmail account;
  • Schedule and send automated follow-ups, and stop them when a reply is detected;
  • Track campaign performance (opens, replies, bounces);
  • Process payments, manage subscriptions, and prevent fraud;
  • Communicate with you about your account, security, updates, and (with your consent) marketing;
  • Notify waitlist members when the Service launches;
  • Monitor, detect, and prevent abuse, spam, and security incidents;
  • Comply with legal obligations and enforce our Terms of Service.

4. Legal bases for processing (EEA/UK users)

If you are in the European Economic Area or the United Kingdom, we process your personal data under the following legal bases:

  • Contract: to provide the Service you have signed up for.
  • Consent: for marketing communications, Gmail connection, and non-essential cookies. You may withdraw consent at any time.
  • Legitimate interests: to secure, improve, and market our Service in ways that do not override your rights.
  • Legal obligation: to comply with applicable laws, such as tax and accounting requirements.

5. What we do NOT do

  • We do not sell your personal information.
  • We do not share your data with advertisers.
  • We do not use your Gmail content or the emails you write to train AI models.
  • We do not read your inbox beyond detecting replies/bounces to manage follow-ups.
  • We do not send emails on your behalf without your explicit action and approval.

6. How we share information

We share personal information only as described below, and only to the extent necessary:

  • Service providers (sub-processors): trusted vendors who process data on our behalf under contractual confidentiality and security obligations. Our current sub-processors include:
    • Clerk — authentication and account management
    • Stripe — payment processing
    • Google LLC — Gmail sending (via your OAuth connection)
    • Our AI model provider — email generation
    • Apollo.io / Hunter.io — business contact discovery
    • Railway — database hosting
    • Vercel — application hosting and content delivery
  • Legal & safety: when required by law, subpoena, or to protect the rights, property, or safety of Olivly, our users, or the public.
  • Business transfers: in connection with a merger, acquisition, financing, or sale of assets, your information may be transferred, subject to this Policy.
  • With your consent: for any other purpose disclosed to you.

7. International data transfers

We are based in British Columbia, Canada. Because we rely on service providers located in the United States and elsewhere (such as our hosting, payment, and AI providers), your information may be transferred to, stored, and processed in the United States and other countries whose data-protection laws may differ from those in your jurisdiction. While your information is outside of Canada, it may be subject to the laws of the country in which it is held and may be accessible to the courts and law-enforcement or regulatory authorities of that country. Where required, we use appropriate safeguards (such as contractual data-protection terms, and for transfers from the EEA or UK, the European Commission's Standard Contractual Clauses) to protect cross-border transfers.

8. Data retention

We retain personal information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or anonymize your personal data within 30 days, except where retention is required for legal, tax, accounting, fraud-prevention, or dispute-resolution purposes (for example, financial records retained for up to 7 years). Waitlist emails are retained until launch and for a reasonable period thereafter, or until you ask us to remove them.

9. Cookies and tracking technologies

We use the following categories of cookies and similar technologies:

  • Strictly necessary: authentication, security, and core functionality. These cannot be disabled.
  • Preferences: to remember your settings.
  • Analytics: aggregated, privacy-respecting usage analytics to improve the Service.

We do not use third-party advertising cookies. You can control cookies through your browser settings; disabling some cookies may affect functionality. We honor Global Privacy Control (GPC) signals where legally required.

10. Your privacy rights

Depending on where you live, you may have the right to:

  • Access the personal data we hold about you;
  • Correct inaccurate or incomplete data;
  • Delete your data ("right to be forgotten");
  • Port your data to another provider in a structured, machine-readable format;
  • Restrict or object to certain processing;
  • Withdraw consent at any time;
  • Lodge a complaint with your local data protection authority.

To exercise any right, email support@olivly.ai. We will respond within the timeframe required by applicable law (generally 30 days). We will not discriminate against you for exercising your rights.

10.1 California residents (CCPA/CPRA)

California residents have the right to know what personal information we collect, the purposes for which it is used, and the categories of third parties with whom it is shared; the right to delete and correct; and the right to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under the CPRA. You may exercise your rights by contacting support@olivly.ai, and you may use an authorized agent to do so.

10.2 Canadian residents (PIPEDA & BC PIPA)

If you are in Canada, we handle your personal information in accordance with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA). We collect, use, and disclose your personal information only for purposes a reasonable person would consider appropriate, and with your consent (express or implied) except where the law permits otherwise. You have the right to access and correct your personal information and to withdraw consent, subject to legal and contractual limits. If you have an unresolved privacy concern, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca). To make a request, email support@olivly.ai.

11. Data security

We implement administrative, technical, and physical safeguards, including:

  • TLS/HTTPS encryption for all data in transit;
  • Encryption at rest for sensitive credentials such as OAuth tokens;
  • Access controls and least-privilege permissions for production data;
  • Regular dependency updates and security reviews;
  • Rate limiting and bot protection on public endpoints.

No method of transmission or storage is 100% secure. In the event of a data breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law, without undue delay.

12. Children's privacy

The Service is not directed to individuals under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it promptly.

13. Third-party links

The Service may contain links to third-party websites and services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. Review their policies before providing information.

14. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, notify you by email or in-app. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

15. Contact us