Privacy Policy

2.1 Information You Provide Directly

• Account Information: Name, phone number
• Communications: Messages you send to Lisa via SMS/WhatsApp
• Contacts: Contact information you share with Lisa for relationship management
• Preferences: Settings and preferences you configure

2.2 Information from Google Services

When you connect your Google account to Lisa (using thegmail.modify,calendar.readonly,calendar.events, andcontacts.readonly scopes), we access:

• Gmail: Read and summarize your inbox; mark messages read or unread; archive messages; move messages to trash; and forward existing messages to an address you specify — each on your instruction. Lisa does not compose or send new email from your Gmail mailbox, and does not permanently delete Gmail messages.
• Google Calendar: View your calendars and events, and create, reschedule, or cancel events on your behalf (with your confirmation).
• Google Contacts: Read contact information to resolve names to email addresses when scheduling or drafting.

New emails Lisa writes on your behalf are sent from your dedicated Lisa address (for example, [email protected]) through our email provider, not from your Gmail account.

How We Use Google Data: Lisa uses this information solely to provide and improve the assistant features you see in the product — reading and organizing your inbox and calendar, resolving contacts, and acting on your explicit requests. We do not use Google user data for advertising, to train generalized AI models, or for any purpose beyond providing the Service. See Sections 4.2 and 13 for our Google API Limited Use commitments.

2.3 Automatically Collected Information

• Usage Data: How you interact with Lisa, features used, frequency of use
• Device Information: Phone number, carrier information (from SMS/WhatsApp)
• Log Data: Timestamps, error logs, system events

2.4 Information from Third-Party Services

• SMS/WhatsApp Data: Message delivery status, phone number verification (via Twilio)
• Email Data: Email delivery status (via SendGrid)
• Authentication Data: Login verification data (via Firebase)
• Advertising & Analytics: Cookie-based measurement via Google Analytics and the Meta Pixel — see Section 14 for details and how to control this

4.1 Service Providers

We share data with third-party service providers who help us operate Lisa:

• OpenAI: AI processing for natural language understanding and generation. OpenAI does not use data submitted through its API to train its models.
• Twilio: SMS/WhatsApp message delivery
• SendBlue: iMessage message delivery
• SendGrid: Email sending and delivery
• Firebase: Authentication services
• MongoDB Atlas (US region): Primary secure data storage
• Qdrant: Semantic memory storage (embeddings scoped to your account)
• Render: Application hosting
• Redis: Background job queue processing
• Cloudinary: Hosting of email-signature images (Pro/Team plans only; no Google data)

These providers are contractually obligated to protect your data and use it only for providing services to us. We do not transfer Google user data to any provider except as necessary to provide or improve the features you see in Lisa.

4.2 Google API Services

Lisa's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only request access to Google data necessary for Lisa's core functionality
• We do not use Google data for advertising purposes
• We do not allow humans to read Google user data except when necessary for security, compliance, or with your explicit consent
• We do not transfer Google data to third parties except as necessary to provide Lisa's services

4.3 Legal Requirements

We may disclose your information if required by law or in response to:

• Court orders or legal processes
• Government requests
• Protection of our rights, property, or safety
• Investigation of fraud or security issues

4.4 Business Transfers

If StageKeep Inc. is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

7.1 Access and Correction

You can access and update your information through Lisa or by contacting us at [email protected].

7.2 Data Deletion

You can request deletion of your account and associated data by contacting [email protected]. When we delete your account, we remove your account record, conversation history, interaction and relationship data, reminders, and semantic memory, and delete your Google OAuth tokens, within 30 days. Globally shared, non-personal reference data and records we are required to keep for legal or audit purposes may be retained.

7.3 Google Account Disconnection

You can revoke Lisa's access to your Google account at any time through your Google Account permissions page.

7.4 Opt-Out of Communications

You can opt out of non-essential communications, though some service-related messages are necessary for Lisa to function.

7.5 California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect
• Right to request deletion of your information
• Right to opt-out of sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your rights

To exercise these rights, contact [email protected].

7.6 European Privacy Rights

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent

To exercise these rights, contact [email protected].

7.7 Cookie Preferences

You can control non-essential cookies (including the Meta Pixel) at any time using the Cookie Preferences link in our site footer, or the small “Cookie preferences” link shown in the corner of the page. See Section 14 for details.

14.1 What We Use

We and our service providers use cookies and similar technologies for the following purposes:

• Strictly Necessary: Session and security cookies required for the Service to function (for example, keeping you signed in). These do not require consent and cannot be disabled through our cookie banner.
• Analytics: Google Analytics (GA4), used on our marketing site (okaylisa.com) to understand aggregate traffic and usage patterns. These cookies are not currently gated by the cookie banner described below; contact [email protected] if you'd like to opt out.
• Marketing & Advertising: The Meta (Facebook) Pixel, used on okaylisa.com and app.okaylisa.com to measure the performance of our advertising. This is the cookie category controlled by the consent banner described below.

14.2 Your Cookie Choices

When you first visit our site, a banner asks you to Accept All or Reject Non-Essential cookies. This choice controls the Meta Pixel:

• If you Accept All, the Meta Pixel loads and records your visit and activity (for example, page views and application submissions) so we can measure and improve our advertising.
• If you Reject Non-Essential, the Meta Pixel never loads and no data about your visit is sent to Meta.

You can change your choice at any time using the Cookie Preferences link in the site footer, or the small “Cookie preferences” link shown in the corner of the page.

14.3 Meta Pixel & Automatic Advanced Matching

If you accept non-essential cookies, the Meta Pixel uses Meta's Automatic Advanced Matching feature, which may securely hash (not send in plain text) information you enter into forms on our site — such as your name, email address, or phone number — to help Meta match your visit to a Meta user account for ad measurement. This applies only to information you submit directly through our forms (for example, the membership application); we do not use your Google Gmail, Calendar, or Contacts data for this purpose. See Sections 4.2 and 13 for our Google Limited Use commitments.

14.4 Do Not Track

Some browsers offer a “Do Not Track” signal. Because no common industry standard exists for how to respond to it, we do not currently respond to this signal. Non-essential cookies remain governed by the choice you make in our cookie banner.