Privacy Policy

Who this policy covers

OperTico is operated by Guy Idan Bachar as an Australian sole trader. We handle account, support, security and service administration information to operate OperTico.

Businesses use OperTico to manage their customers, jobs, workers and documents. When a business supplies information about you, it determines why that information is collected and who in its team may access it. We process it to provide the requested service. Contact that business about its own activities, notices and records; contact us about OperTico's handling of information. A worker may belong to several businesses through one personal account, with access determined separately for each business.

Information we collect

• Accounts and enquiries: names, email addresses, sign-in and verification information, profile details, support requests and website enquiries. If you choose Google or Microsoft sign-in, we receive the identity information and credentials needed for that sign-in.
• Business records: business and location details, team roles, customer contacts and addresses, job notes, schedules, quotes, invoices, payment records, uploaded files and communications. Payment or phone verification features may also require identity, address, ownership and representative information.
• Optional phone and location features: calls, messages, delivery records and, where recording or transcription is enabled, recordings and transcripts. Location sharing or trip tracking uses device location when enabled and permitted. The relevant business is responsible for obtaining any necessary customer or worker consent.
• Connected services: information and access credentials for the Google, Xero, advertising, payment, email and phone services you choose to connect. The permissions requested and features enabled determine the data available.
• Technical information: session cookies, browser or device information, IP addresses, request logs and audit events needed for authentication, preferences, troubleshooting and abuse prevention. Blocking necessary cookies may prevent sign-in and other features.

You provide information directly, your business or an authorised team member supplies it, or an enabled provider sends it to us. Do not upload information you are not authorised to share.

How we use information

We use information to create and secure accounts; provide business and team workspaces; manage jobs, documents, communications and connected services; process payments and usage charges; answer support requests; investigate errors and abuse; and meet applicable legal obligations. We use information relevant to the feature you or your business chooses to use. We do not sell personal information.

Google connections and data

Signing in with Google and connecting a business service are separate choices. Google sign-in does not by itself connect a Google Business Profile. An authorised business manager separately grants Google Business Profile permissions and selects which accessible profiles to link to OperTico businesses or locations. A manager can connect multiple Google accounts, and a profile can be linked to more than one authorised business or location. Availability depends on Google approval, account permissions and configuration.

For Google Business Profile, we access the account groups and profiles available to the connected account, their names and identifiers, and the information needed for the features you use. This may include business names, categories, addresses, contact details, descriptions, opening and holiday hours, service areas, services, attributes and action links; ratings, review text, reviewer display information, review links and existing replies; posts, photos, video and publication status; and profile performance metrics and search terms. Where Google makes them available for your business type, optional tools can access food menus or lodging information. Account management tools can access invitations and manager information when you choose to use those tools.

We use this information to display and manage your selected profiles, prepare and publish review replies and posts, upload media, update business information, and show performance reports. If enabled, Google notifications identify changes such as new reviews, customer media, profile updates or verification status. Changes and publications follow the action you select or automation rules you explicitly enable. Merely connecting an account does not enable automatic publication.

We store encrypted access and refresh tokens, the connected Google account identity, accessible profile choices, selected profile and business or location links, workflow settings, and operation or audit records needed to provide these features. Only the member who connected an account can discover and link additional profiles from its grant; authorised business managers can manage profiles already linked to that business. When review workflows are used, review content and draft replies may be stored encrypted for up to 30 days, then erased. Review identifiers, internal job links and publication audit records may remain. Suggested job and worker matches use available reviewer names, review content, dates and business records; they are suggestions, not confirmed identities. Google does not provide our job number or a customer email. AI drafting is handled as described below. Google Ads connections, if enabled, use the advertising data needed for their displayed reporting and lead features.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising targeting or credit decisions, or use it to train general-purpose AI models. Human access is restricted to what is permitted by that policy, such as your consent, necessary security investigations or legal requirements.

In Apps → Google Business Profile → Connections, you can disconnect a selected Google account to remove its saved credentials and associated profile links from OperTico. You can also explicitly choose to revoke Google access. Revocation can affect other businesses or Google services authorised by the same Google account to the same OperTico Google project, requiring them to reconnect. You can independently review or remove access in your Google Account connections. Disconnecting does not delete your Google profile, reviews, posts or media already published on Google. You can request deletion of other OperTico records as described below.

Gmail business inbox

An authorised team member may separately connect a Gmail or Google Workspace mailbox after explicitly authorising its use in the business workspace. We request permission to read, send and organise messages on that account. Google sign-in alone does not grant Gmail access.

We import the connected mailbox's full message history, including archived messages and messages in Spam and Trash, but excluding Gmail drafts. We then synchronise new incoming and sent messages and mailbox changes. This includes sender and recipient addresses, subjects, message text, thread identifiers, labels and attachment metadata. Received attachments are retrieved from Gmail on request. OperTico drafts and files attached to outgoing messages are stored separately. We use this information to display the inbox, deliver approved messages, organise mail and link conversations to customer and job records in that business. Access to mailboxes and conversations depends on their business, location or employee scope and the permissions granted to each team member. Gmail message content is not sent to AI features in this integration.

Gmail credentials are stored encrypted. Disconnecting removes the saved credentials and stops subsequent synchronisation and sending; messages already handed to Google may finish sending. Saved conversations remain until an authorised mailbox manager or assigned employee removes the mailbox and saved email in Mailboxes & access → Mailbox data, or asks us to delete it. Removal deletes that business's active mailbox copy, including messages, notes, labels, drafts, stored email files and access grants. Independent customer, job and document records, minimal delivery and security audit records, backups and third-party copies have separate retention. Connecting the same address again imports Gmail history again.

Disconnecting or removing a saved OperTico mailbox does not delete original messages or accounts at Google. You can separately revoke OperTico permission in your Google Account connections; revocation may affect other connections from that Google account to the same OperTico Google project. See Email connections and data for access, disconnection and deletion steps, or contact contact@opertico.com. Our Google API Limited Use commitments above apply to Gmail data.

Optional Google Workspace account creation requires separate consent from an authorised administrator of the customer?s Workspace organization. We use verified domain information and user-administration permissions to create the work accounts you explicitly request. We store encrypted administration credentials, the connected administrator?s email, verified domains, creation status and provider user identifiers. Initial passwords are shown only in the creation result and are not stored by OperTico. Google requires a password change at first sign-in. Creating an account does not itself connect its Gmail messages; a separate Gmail authorization is required. Disconnecting Workspace administration stops new administration requests and removes the stored administration connection; it does not delete Google accounts or disconnect separately connected mailboxes.

External images in opened formatted messages load directly from their hosts by default. Those hosts can receive your IP address and image request, which may tell a sender that a message was opened. You can turn off Automatic images in Email's three-dot menu for your user and business in this browser, then choose Show images for individual messages.

Xero accounting connections

Connecting Xero is optional. OperTico uses the permission you grant to retrieve available accounting organisation names and identifiers, let you select an organisation for a business, and verify that connection. The current feature reads organisation details and does not synchronise invoices or payments or write financial transactions.

We store encrypted access and refresh tokens, organisation choices, the selected organisation and connection audit records. Available organisation choices are shown to the member who connected that Xero account; authorised business managers can see the organisation selected for their business. Disconnecting removes the saved credentials and organisation selection from OperTico. You can separately manage the app permission in Xero. Other business records and audit retention follow this policy.

AI features

Optional AI features send the information needed for the selected task to an AI provider, currently OpenAI where configured. This can include approved business knowledge, enquiry text, relevant job or catalogue details, a public review's text and rating for an authorised review-reply draft, or a photo explicitly released for marketing and its approved public description for an authorised work-post draft. The relevant interface explains this sharing before you request a draft or enable automation. Internal job notes and customer contact fields are excluded from these Google review and work-post AI requests. Do not include unnecessary personal or sensitive information.

Lead and review draft requests use the provider's no-response-storage setting. This setting is not a promise of zero provider retention: processing and any security retention remain subject to the provider's applicable terms and controls. AI can make mistakes. Review output before using it; requesting a review draft does not publish it. Separate phone and other enabled workflows have their own controls.

Sharing and overseas processing

Information is available to authorised users of the relevant business according to their role. We use providers for hosting, storage, authentication, payments, email, phone, maps, advertising connections and optional AI. Depending on enabled features, these include Google, Microsoft, Stripe, Resend, Twilio, Xero and OpenAI. They receive information needed to deliver their services; services you connect also have their own terms and privacy policies.

Providers and their infrastructure may process information outside Australia, including in the United States and other countries where they operate. The destination depends on the service and its configuration. Contact contact@opertico.com for information about providers relevant to your use. This policy does not promise that all information stays in Australia.

We may disclose information where necessary to comply with law, protect users and the service, or handle a business transfer subject to applicable law and Google's restrictions, including prior consent where required. We do not provide a general right to sell or transfer Google user data.

Security and retention

We use access controls, encrypted transport, encryption for supported credentials and communications, and audit records to help protect information. No service can guarantee absolute security. Keep your account secure, use available security controls, and report suspected unauthorised access promptly.

We retain information while needed to provide the service and for applicable recordkeeping, security, dispute and legal purposes. Retention varies by record type. Archiving a customer or deleting a business does not necessarily erase issued financial documents, payment records or audit history. Backups and third-party records can have separate retention periods. We do not promise that every record is erased immediately or on a single fixed schedule. Contact us about a particular deletion or retention request.

Access, correction and deletion

You can update supported personal details and security settings in My account. Business managers control access to their business records; leaving a team does not erase that business's legitimate records. Optional location sharing can be stopped through its controls, and device permissions can be changed in your browser or operating system.

To request access, correction, an export or deletion of personal information, contact contact@opertico.com. We may verify your identity and authority before acting. If the request concerns a customer business's records, we may direct it to or coordinate with that business. We will explain any applicable limits, such as another person's rights or required financial record retention. Disconnecting a provider is separate from requesting deletion of other OperTico records.

Questions, complaints and updates

For a privacy question or complaint, email contact@opertico.com with sufficient details for us to investigate. Avoid emailing passwords or access tokens. We will acknowledge the complaint, investigate and respond. If unresolved, you may contact the Office of the Australian Information Commissioner where it has jurisdiction, or another relevant authority.

OperTico is intended for business use by adults, not for children to create accounts. We may update this policy as the service or its practices change. We will publish the revised policy here, update its date and provide additional notice where required.