OpenbirdAI Logo
Official Legal & Privacy Documentation

Privacy Policy

How OpenbirdAI collects, secures, uses, and guarantees sovereignty over your business data, creator intelligence, and connected workspaces.

Last updated: October 2026 (Version 2.0)
01

Introduction & Operator Identity

Welcome to OpenbirdAI (accessible at https://ai.openbird.site), the AI-powered business workspace, content intelligence, and operations orchestration platform developed, operated, and maintained by OpenBird Solutions (“OpenBird”, “we”, “us”, or “our”), headquartered in Colombo, Sri Lanka.

OpenBird Solutions is committed to upholding rigorous standards of data confidentiality, user transparency, and privacy. This Privacy Policy (Version 2.0, October 2026) explains how we collect, handle, store, and safeguard information when you access our web application, complete mandatory age verification onboarding, connect your third-party business and social media accounts (such as Google Workspace, YouTube, Meta, TikTok, and WhatsApp), and interact with our OpenFeather AI decision engine.

Our Core Privacy Commitments:We never sell or broker your personal data, we enforce isolated workspace boundaries, and we license frontier AI models under commercial API terms that strictly prohibit using your private prompts, content, or financial records to train public foundation models.
02

Information We Collect

We collect only the minimum necessary information required to deliver accurate workspace intelligence, age-appropriate access, content generation, and connected platform operations:

Account, Onboarding & Eligibility
  • Full name, verified email address, and avatar image (via NextAuth or registration).
  • Country of Residence: Collected at onboarding to configure regional currencies and compliance frameworks.
  • Age declaration: A self-reported whole-number age and eligibility status are stored during onboarding. This declaration is not independent proof or identity verification. Existing users' previously collected date-of-birth records are preserved.
  • Legacy identity correction requests: Identity evidence submitted to correct previously collected birthday records is handled under the existing review and retention process.
Connected Platform & Commerce Data
  • Public channel identifiers (YouTube Channel ID, Instagram handle, Facebook page IDs).
  • Performance metrics (views, retention rates, engagement ratios, watch time).
  • Cryptographically encrypted OAuth access and refresh tokens (AES-256-GCM).
  • Gmail threads and messages (synchronized solely when Google Workspace is connected).
  • Finance Manager ledger metadata: invoices, sales orders, accounts receivable, and transaction statuses.
AI Prompts & Workspace Memory
  • Prompts, chat messages, and analytical queries submitted to Ask OpenbirdAI.
  • Generated content drafts, hooks, video scripts, and calendar event recommendations.
  • Workspace Memory Banks: Isolated brand guidelines, niche parameters, target audience profiles, and operating rules.
Security, Billing & Telemetry
  • Security credentials: Hashed passwords (Argon2id/bcrypt), encrypted TOTP seeds, single-use recovery code hashes.
  • Device registry: Opaque device tokens (openbird_device cookie), browser User-Agent, and security audit logs.
  • Billing records: PayPal Order IDs, Capture IDs, payer country codes, and 30-day pass expiration dates. Zero credit card numbers are stored on our servers.
  • Distributed rate-limiting counters to prevent abuse and denial-of-service attacks.
03

Purpose & Legal Basis of Processing

We process personal data strictly in accordance with lawful processing bases recognized under the Sri Lanka Personal Data Protection Act No. 9 of 2022 (PDPA) and the EU General Data Protection Regulation (GDPR):

  • Contractual Performance (Service Delivery): Operating the workspace, generating AI responses, synchronizing authorized social and accounting metrics, and fulfilling 30-day Flight pass entitlements.
  • Legal Compliance (Age Eligibility): Enforcing our mandatory 18+ policy through calendar date-of-birth locking to protect minors in accordance with global child safety standards.
  • Legitimate Interests (Security & Anti-Fraud): Evaluating distributed rate limits, verifying TOTP replay defense, registering trusted devices, and retaining government ID evidence for 90 days to verify birthday correction integrity.
  • Explicit Consent: Connecting optional third-party integrations (such as Gmail, Meta, TikTok, or QuickBooks) which you may revoke at any time.
04

Google API Services User Data & Limited Use Policy

Mandatory Disclosure for Google API Integration

OpenbirdAI's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, when you connect your YouTube channel or Google Workspace account (including Gmail) with OpenbirdAI:

YouTube Integration (Read-Only): For YouTube, we request read-only access (youtube.readonly) strictly to retrieve channel analytics, retention data, and video metrics. We never alter your videos or channel settings.
Gmail Integration (User-Directed Capabilities): When you connect Gmail for AI-assisted inbox workflows, we request:
  • gmail.send: To dispatch emails and replies directly approved by you.
  • gmail.readonly: To ingest incoming message context so the AI assistant can summarize threads and draft replies.
  • gmail.modify: To organize email threads, apply labels, and archive processed conversations per your settings.
No Transfer Except for Service Provision: We do not transfer, sell, or disclose your Google user data to third parties, data brokers, or advertising networks.
No Generalized AI Model Training: OpenbirdAI does not use data obtained through Google APIs (including Gmail message bodies, contacts, or YouTube metrics) to train, retrain, fine-tune, or improve generalized foundational AI models.
Human Access Restrictions: No human staff at OpenBird Solutions reads your raw Google user data unless you have given affirmative consent for technical troubleshooting, it is strictly necessary for security defense, or required by applicable law.
05

Meta (Instagram, Facebook & WhatsApp) & TikTok Disclosures

OpenbirdAI connects to Meta Platforms (Instagram Graph API, Facebook Graph API, WhatsApp Business API) and TikTok for Developers in strict compliance with their developer policies:

  • Encrypted Token Storage: Access tokens provided by Meta and TikTok are encrypted at rest using AES-256-GCM and never exposed client-side.
  • Read-Only Analytics & Supervised Messaging: We access performance metrics to evaluate content and customer inquiries. Customer messages are dispatched solely with user confirmation.
  • Automated Deletion Callback: OpenbirdAI maintains an active, cryptographically signed data deletion callback endpoint at /api/data-deletion verifying HMAC-SHA256 signatures to automatically queue tokens and cached metrics for deletion.
06

AI Processing & Foundation Model Architecture

OpenbirdAI operates the OpenFeather Unified Decision Engine, routing inquiries across commercial enterprise AI APIs (primarily DeepSeek API, with NVIDIA NIM API fallback and Google Gemini multimodal support) under verified commercial terms:

Commercial Non-Training Commitments & Workspace Isolation
  • Inference requests are transmitted via encrypted HTTPS TLS 1.3 to official API endpoints.
  • Data is processed under commercial terms guaranteeing that customer prompt inputs, attachments, and completions are never used to train, retrain, or improve public foundation models.
  • Prompts and conversation histories are stored securely in MongoDB (ask_conversations) solely to provide you with multi-turn chat continuity and workspace context recall, and are deleted when you delete the conversation or your account.
  • Workspace context is isolated: data from one business workspace is never accessible to or retrieved by another workspace.
07

Data Security, Encryption & Storage Subprocessors

We implement comprehensive technical and organizational measures to protect personal data:

AES-256-GCM Encryption

OAuth tokens and MFA secrets are encrypted with authenticated AES-256-GCM using unique initialization vectors before database storage.

TLS 1.3 & Edge Protection

Edge routing, DDoS defense, and TLS 1.3 termination are managed through Cloudflare. Database clustering is hosted on MongoDB Atlas in AWS EU (Frankfurt) / Asia (Singapore).

IDOR / BOLA Hardened

Server-side access control strictly enforces tenant boundaries across all integration, conversation, and order APIs.

08

Data Retention & Deletion Rights

We retain data only as long as necessary for operational performance or statutory compliance:

  • Active Accounts: Conversations, workspace memories, and analytics remain accessible until deleted by you.
  • Channel Disconnection: Disconnecting a platform from your Platforms hub destroys stored OAuth tokens immediately.
  • Self-Service Account Erasure: Authenticated account deletion (/dashboard/settings?tab=danger) requires password re-verification, TOTP verification where enabled, and explicit confirmation.
  • Multi-Collection Purge: Our automated deletion engine immediately erases 11 database collections (conversations, memories, tokens, sessions, personal workspaces). Active database records are purged immediately; rolling automated disaster recovery backups overwrite within 30 days.
  • Statutory Exceptions: Uploaded government ID evidence is subject to a strict 90-day anti-fraud retention lock; commercial tax payment records are retained for 5 years per Sri Lankan tax regulations.
Need to delete your data or revoke platform permissions?
Visit our automated User Data Deletion portal for step-by-step guides and request submission.
Data Deletion Instructions
09

Your Privacy Rights (PDPA, GDPR, CCPA)

Regardless of your country of residence, OpenbirdAI honors your statutory privacy rights:

Sri Lanka PDPA (Act No. 9 of 2022)Rights to access personal data, request correction of inaccurate records, withdraw processing consent, and request erasure of personal data held by data controllers.
GDPR (EU / UK Data Subjects)Right to data portability, right to object to automated processing, right to restriction of processing, and right to lodge a complaint with a supervisory authority.
CCPA / CPRA (California Residents)Right to know personal information collected, right to delete, and right to opt out of the sale or sharing of personal data (OpenbirdAI does not sell or share personal data).
Platform RevocationThe right at any time to revoke OpenbirdAI's access to your Google account via Google Security Settings, Meta via Facebook Settings, or TikTok via Security & Permissions.
10

Cookies & Session Management

OpenbirdAI uses strictly essential cookies and secure session tokens:

  • next-auth.session-token: Secure, HttpOnly JWT token for authenticating your user session.
  • openbird_device: Opaque hashed identifier used for new-device detection and security alerts.
  • openbird_active_workspace: Local UI reference preserving your active workspace selection.

We do not deploy third-party advertising cookies, cross-site tracking beacons, or commercial data broker trackers.

11

Data Protection Officer & Contact Information

If you have questions about this Privacy Policy, wish to exercise your data subject rights, or have a security inquiry, please contact our Data Protection Officer:

OpenBird Solutions — Legal & Privacy Office
Entity: OpenBird Solutions (ai.openbird.site)
Jurisdiction: Colombo, Western Province, Sri Lanka
Privacy & DPO Email: privacy@openbird.site
General Legal Inquiries: legal@openbird.site

We respond to all verified privacy and data deletion inquiries within thirty (30) calendar days in accordance with statutory requirements.