Privacy Policy
Effective date:
This policy covers Overtime Labs (“we,” “us”), our website, AI agents, and related services. For data processed on a business customer’s behalf, its instructions and our agreement govern. We handle account operations and permitted shared-model training for our own purposes.
What we collect
Depending on your use, we collect contact, account, and billing details; prompts, files, messages, outputs, and agent activity; data and credentials from authorized connections; and technical information such as IP addresses, device details, usage, and security logs. Sources include you, your organization, connected services, and service activity. The homepage message box only drafts an email; we receive it when you send it.
How we use and share it
We use information to operate agents, follow instructions, provide support, manage billing, improve services, prevent abuse, and meet legal obligations. Hosting, AI, communications, payment, and support providers may process it for these purposes. Your organization’s administrators and recipients of agent actions may receive relevant data. We may disclose information for legal requirements, protection of rights and safety, or a business transfer. Independently connected services have their own policies.
SMS messaging
When you text Overtime, we collect your mobile number, messages, and opt-in and opt-out records to provide conversational replies and updates you request. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Mobile numbers and SMS consent data are not shared with affiliates for marketing or promotional purposes. SMS consent records are used only to operate the messaging service and comply with messaging requirements; communications providers process them as needed to deliver messages and honor your choices. Reply STOP to unsubscribe or HELP for help.
AI model training
Where customer agreements and applicable law allow, we may use customer content, including prompts and outputs, to develop, evaluate, and train models used by other customers. AI providers may also receive and use that content for these purposes under their terms. We obtain additional consent where required. This policy does not override earlier confidentiality commitments or authorize new uses of previously collected data without required notice or consent.
Gmail data and content derived from it are excluded from these training permissions: neither we nor our providers may use them to train or improve shared or general-purpose AI models. Vault content and all content derived from it are also excluded from shared-model training and training or evaluation exports, including extracted text, knowledge, summaries, browser sessions, and approved business details.
Business vault
Where enabled, the Vault stores supported business files, approved business details, and browser account information. Items belong to your business and start private to the uploader. Sharing and agent use require explicit grants. Designated business vault administrators may recover or reassign items through an authenticated, audited process. Reading a file does not itself authorize sending it to an external service. You may need to revoke sessions separately at connected websites.
Vault encryption is service-controlled: authorized services can decrypt data to provide the features you enable. It is not zero-knowledge storage. Google Cloud provides hosting, encrypted storage, and key management; any additional processing providers and applicable restrictions must be identified in your customer data-processing terms before those features are enabled. Vault entry and reveal screens exclude third-party analytics and session replay.
Vault items are retained until deletion or an applicable business retention rule. Deleting an item immediately blocks new authorized access and starts deletion of originals and dependent data. Backup expiry and any legal-hold exceptions follow your customer data-processing terms. Previously displayed or downloaded copies cannot be recalled. Content-free security audit records may be retained separately. The cancellation window for Settings deletion requests does not apply to individual Vault deletion.
Google Ads data
When you connect Google Ads, we access the accounts available to your Google account, including through a manager, and retrieve account identifiers, names, currency, time zone, campaign details and performance metrics for requested reports. We store encrypted authorization credentials and your account selection. Reports displayed in Integrations are fetched live rather than stored as report snapshots.
If you separately enable campaign management, your agent can access the selected account's reports and campaign details, and our hosting and AI providers process that information to answer requests and prepare changes. Information included in conversations follows our conversation retention practices. Each campaign pause/resume or supported daily budget change requires your approval of the exact proposal in Overtime before it is sent to Google. Resuming campaigns or increasing budgets can increase spending. We retain encrypted proposals and approval outcomes with your connection until you delete its saved data or complete applicable personal-data deletion. Content-free security records and backups can remain longer under our retention practices.
Disabling management blocks new agent access and approvals. Disconnecting removes credentials and stops new access; deleting saved integration data also removes saved account details and change history. These actions do not undo changes already sent to Google or remove campaigns from your Google Ads account. You may also revoke access through your Google Account.
Gmail data
When you connect Gmail, we collect and store email content, message details and attachment metadata so you can search correspondence, ask questions, summarize or translate messages, and use email-based automations. Sync does not download attachment files. When you ask to save an attachment, we also copy its content into your private files. Saved attachments remain in your private files after Gmail is disconnected; imported mailbox data follows its separate deletion schedule. Gmail access is read-only: this connection cannot send, modify or delete messages in your Google account. Hosting and AI providers process Gmail data as needed to deliver these features. These uses and transfers are subject to the Google API Services User Data Policy, including its Limited Use requirements, which we comply with.
You can disconnect Gmail in Integrations or revoke access through your Google Account. To request deletion of your private data in the current organization, go to Settings → Your data, or email info@overtimelabs.com for help. Settings requests have a 29-day cancellation window before processing. Disconnecting stops future syncing but does not delete all stored data; backup and historical copies may remain temporarily under our retention practices.
Cookies and tracking
The website uses Cloudflare and Google Tag Manager; Google receives technical request data. As of the effective date, the container has no analytics or advertising tags. Essential cookies may support security. The website does not respond to Do Not Track or track visitors across sites for advertising. You can control cookies in your browser.
Retention and security
We retain information as needed for these purposes, our agreements, and legal obligations, then delete or de-identify it. Backups and required records may remain longer. Deleting source content may not undo completed model training, subject to legal obligations. We use reasonable safeguards, but no system is completely secure. Processing may occur in the United States and other countries.
Your choices and contact
Email info@overtimelabs.com for access, correction, deletion, a copy of your data, or objections to its use, including training and applicable sale/sharing opt-outs. Rights depend on your location and our role; we may verify identity and will honor applicable rights without discrimination. Where available, you may withdraw consent, appeal, or complain to a regulator. For customer-controlled data, contact that business; we help it respond under our agreement.
Services are for adults, not children under 13; contact us about a child’s data. We post updates here and provide notice or obtain consent for material changes when required.