Privacy Policy

• Most of what we hold is business data your organization brings us — an inventory of AI systems, what they cost, what they returned, and an audit trail of who changed what.
• We run one analytics tool, Google Analytics. It does not load until you accept it. Decline, and no analytics cookie is set.
• We do not sell personal data, do not share it for advertising, and run no advertising tags.
• Oabo does not use workspace data to train AI models. Core product workflows do not need a model. AI support drafting is disabled. We do not send support conversations to a model provider; a person writes and sends each reply.
• Oabo is work software for adults. It is not built to hold health, payment-card, or government-ID data, and our Terms prohibit submitting it.
• You can ask for a copy of your data, a correction, or deletion at hello@oaboscorecard.com. We answer within 30 days.

• Account & identity data — the work email, display name, role assignment, and business-unit scope of each authorized user, plus a password hash. Sign-in is by email and password over standard OAuth2 token auth, and we check that the sign-up address works by emailing you a verification link. Oabo does not offer Sign in with Google or enterprise SSO; if we add them, we will describe here what the provider tells us about you before the feature is available.
• Organization & configuration data — your organization profile, role and segregation-of-duties configuration, tenant preferences, connected-provider settings, and the attribution rules that decide which team a measured agent belongs to.
• Subscription & billing records — the plan selected by an organization administrator; subscription and invoice status; renewal, paid-through, and cancellation dates; and Stripe identifiers that map one Oabo organization to its Stripe customer, checkout, subscription, and events. Stripe’s hosted pages collect the billing-contact and payment details entered there. Oabo receives status and identifiers needed to run the subscription, but does not receive or store a full payment-card number.
• Connected-provider credentials — if an administrator connects a source, Oabo receives the key, token, OAuth grant, or connection configuration submitted by the administrator or issued by that provider. Oabo encrypts the stored credential before storage and never returns it to the browser. The codebase contains a QuickBooks Online connection that, when enabled, uses Intuit OAuth and a rotating refresh token; transient access tokens are not stored. QuickBooks is not enabled in this deployment. See “Connected providers” below.
• Usage telemetry — per-day counts of what your AI tools consumed: token counts, model and provider names, the tool or harness reporting them, session counts, and a project fingerprint. This arrives from the sources described under “How usage is measured”, and from vendor accounts you connect. It contains no prompt or response text.
• Connected accounting data — QuickBooks is not enabled in this deployment. If Oabo enables it later and an administrator connects it, Oabo reads Bills and Purchases in the configured lookback window, including transaction dates, amounts, currency, vendor or payee, account name, and line description, to identify known AI vendors. Oabo computes provider-and-month billed totals and variance for the authorized response, but retains only reconciliation status and line counts by provider and month plus sync diagnostics. It does not persist billed totals, variance amounts, raw bill lines, vendor or payee names, account names, or descriptions.
• Per-seat identifiers, stored as pseudonyms — some feeds identify the person who used a tool (a work email or a vendor account id) so that spend can be shown per seat. Oabo replaces that identifier with a one-way hash unique to your organization before storing it, and does not retain the original. The hash still relates to a person, so we treat it as personal data.
• AI inventory & value data — the agents, models, owners, cost and capacity records, value claims, baselines, rate cards, evaluation results, risk findings, and attestations you and your team record in the service.
• Audit & evidence data — an application-maintained, per-organization hash chain of mutating actions: who did what, and when. The production chain is unsigned and is not an immutable database ledger; a database owner could recompute it, and deleting entries from the end is not independently detectable from the chain alone. For an action handled in a web request, middleware carries the resolved source IP to service-layer audit writers. A background job, command-line action, or other write with no request records unknown rather than inventing an address. Treat a populated address as an operational signal rather than proof because its reliability still depends on the network path. Where a workspace was created through a free-trial signup, we also keep the email address and IP address it was created from, to investigate abuse of the free trial.
• Operational logs — security, performance, and diagnostic logs, including records of the calls Oabo makes to vendor APIs on your behalf when you connect an account.
• Training records — where your organization uses Oabo Practice, the training environment, we record each person’s progress through it: attempts, rank and progress, preferences, and any certificate issued to them. Practice runs against a separate database from your live workspace, and its records stay there. Practice also loads no analytics tag at all.
• People your team asks for cost information — an administrator can run a cost campaign, which emails colleagues they name and asks which AI tools their team pays for. We store the address, whether the message was sent, and the tools and seat counts each person reports back. The recipient needs no Oabo account. Your organization chooses those addresses; we send on its behalf, within sending limits we enforce.
• Enquiries from our public forms — the name, email, company, phone number, message, and IP address of anyone who writes to us. When you request access, we store the email address and IP address plus one coarse path naming the first public page opened in that browser tab; the path carries no query string, fragment, referrer, cookie, or cross-session identifier. We keep these to answer you and to run our business. Oabo is the controller for this business-relationship data rather than a processor for a customer.
• Direct business outreach — a business contact’s name, role, employer, work email or telephone number, the public business event that made the organization relevant, the source or provenance of the contact detail, draft message content, delivery status, and any opt-out. We obtain this from public business sources or information supplied to Oabo, use it only for relevant business-to-business outreach and suppression, and do not sell it. The working list currently has copies in a private GitHub repository and in Microsoft 365 Outlook drafts; those systems are not customer workspaces.
• Support conversations — the message, any email address you choose to give us, the source IP address used for abuse controls, our reply, and a secret conversation key stored in your browser. We send a private Telegram notification containing the sender address, organization name, subject, thread number, and up to 500 characters of the new message so the founder can answer. That notification is an ordinary Telegram cloud-chat copy outside Oabo’s deletion workflow; deleting the Oabo thread does not automatically delete the Telegram copy. Do not put PHI, patient information, credentials, payment-card data, or other sensitive personal data in a support message. AI support drafting is disabled. We do not send support messages or attachments to a model provider. A person writes and sends our replies.
• Website analytics — how people use oaboscorecard.com, but only if you accept it. See “Cookies and similar storage”.

An earlier version of this page said Oabo set no cookies. That was wrong, and we are stating it plainly rather than quietly editing it: the site loads Google Analytics through Google Tag Manager, and Google Analytics sets cookies that last about two years. The notice and the behaviour are both fixed in this release — analytics now loads only if you accept it.

This table lists what the site sets today. If that set changes, this table changes with it. Oabo Practice (practice.oaboscorecard.com) carries no analytics tag at all — the tag is absent from that build, not merely switched off.

Nothing runs until you say yes. Nothing that is not essential runs before you choose. On your first visit we ask, with Accept and Decline offered as equal choices. Until you accept, no analytics script loads and no analytics cookie is written. If you decline, we do not ask again on that browser, and we do not treat declining as a reason to give you a worse site — everything works the same. If you close the question without answering, that counts as a decline for that visit.

This is the complete source-declared list of outside services this website can load, and each loads only after you accept. The site’s Content-Security-Policy is checked against the same declaration. Google Tag Manager is also separately configured in Google’s console, so Oabo must review its exported container whenever that configuration changes; source alone cannot enumerate a remotely changed tag:

• Google Tag Manager — Loads the analytics tag once you have said yes. Reached at www.googletagmanager.com.
• Google Analytics — Counts page visits so we can see which pages people find useful. Reached at www.google-analytics.com, analytics.google.com.

If your browser or an extension sends a Global Privacy Control signal, we treat it as a decline and never load analytics, without asking you anything. You can still turn analytics on yourself afterwards if you want to.

You can change your mind at any time using Privacy choices at the bottom of any page. Withdrawing consent stops the analytics script from loading again and clears the analytics cookies from your browser. Two honest limits: cookies saved in a different browser or on a different device have to be cleared there, and measurements already recorded stay in Google’s reports for the retention period set on the property. You can also delete the cookies yourself in your browser at any time.

What analytics collects if you accept: the pages you view and how you got here, your approximate location derived from your IP address, and your device and browser type. Google LLC processes this for us as our analytics provider and handles the data under its own terms. We use it to understand which pages are useful and where people get stuck. We have not turned on Google’s advertising features, we do not use analytics data to target advertising, and we do not combine it with data from your Oabo workspace. The signed-in product itself is not the point of this: analytics exists for the public marketing site.

An administrator or governance lead can connect a source so value and cost reporting traces to real usage, billing, or accounting data rather than figures typed into a spreadsheet. The enabled connection methods currently include Anthropic Enterprise Analytics, OpenAI Enterprise Cost, OpenRouter, LiteLLM, and Azure OpenAI Cost Management. The codebase also contains a QuickBooks Online connection, but it is not enabled in this deployment and the Connections page does not offer it unless Oabo configures its Intuit application credentials. You can also upload a provider’s cost export as a file, and disconnect a source at any time. The Connections page names the exact source and access method before an administrator connects it.

These connections are read-only with respect to source business data: Oabo does not create, modify, or delete vendor usage records, cloud resources, or QuickBooks books. Authentication can issue or rotate a credential; Intuit rotates the QuickBooks refresh token when Oabo refreshes access. Oabo never asks an AI vendor for compliance or conversation-export APIs, because those return the content of your people’s conversations and Oabo does not want it.

A connector credential is encrypted before storage using AES-256-GCM with a key held in our hosting provider’s secret manager. The encryption is bound to your organization, so a copied row cannot be decrypted for anyone else. A stored credential is never returned to the browser or written to a log. QuickBooks reads Bills and Purchases to identify known AI vendors and computes reconciliation amounts on demand. Oabo retains only provider-and-month status, line counts, and sync diagnostics rather than the amounts or raw accounting lines.

Counting what your AI tools cost means reading something on the machines where they run. Oabo does this in the narrowest way we could design, and it is worth being precise about it.

• The Oabo collector — an optional agent you install on a workstation or server where AI coding tools are used. It opens the local session records those tools keep and extracts only the numbers: how many tokens were used, by which model, on which day, and how many sessions there were. Prompt and response text is never extracted, never stored, and never leaves the machine — the record the collector sends has no field that could carry it.
• A project fingerprint — so usage can be grouped by project, the collector sends a short label derived from the project’s directory: usually just its name, but where the tool did not record one, the whole directory path. Either can contain the operating-system username. You can set the fingerprint explicitly if you would rather it did not.
• An inline AI gateway or managed policy — where your organization routes AI traffic through a gateway, or applies a managed telemetry policy to a coding tool, those systems can send Oabo metrics. The policy Oabo generates explicitly turns prompt logging, response logging, and tool-detail logging off.
• What Oabo refuses — the endpoint that receives managed-policy telemetry accepts metrics only, and rejects log and trace data outright, because those signals can carry prompt and response text. The gateway endpoint does accept traces, because that is the only shape a gateway sends; where such a trace carries the text of a request or a response, Oabo does not read those fields and has nowhere to put them — the records these feeds write have no field capable of holding free text.

Managed-machine usage can include the sanitized machine name and signed-in operating-system account. Oabo stores those reported identifiers with the usage so your authorized administrators can identify the source. Oabo does not retain prompt or response content from the collector.

• To provide the service — recording AI inventory, computing the value ledger, running governance and performance views, and generating the audit pack.
• To authenticate users and enforce role-based access, segregation of duties, and business-unit scoping.
• To maintain an application-level history of mutations and the evidence your reviewers use.
• To secure, monitor, debug, and improve the service, and to keep our email sending from being abused.
• To communicate with authorized users about the service, including security and operational notices.
• To create and administer subscriptions, reconcile payment status, prevent duplicate subscriptions, provide the billing portal, and apply the plan and access state authorized by verified Stripe events.
• To answer support messages through human-written replies and notify the founder through Telegram. AI support drafting is disabled.
• To identify and contact relevant organizations about Oabo, validate business-contact details, keep the campaign to its approved cohort, and honor suppression requests.
• To understand how the public website is used — only with your consent, and only in aggregate.

We do not sell customer data, and we do not use the business data you bring to Oabo to train AI models. Core workspace processing does not require a language model. AI support drafting is disabled; support conversations are not sent to a model provider.

Oabo sends a small, fixed set of messages related to an account or a task someone started: a trial welcome, two account-status notices before trial access changes, notifications from our contact form, and cost-campaign invitations an administrator sends to colleagues. The automatic trial notices state the relevant date and the read-only or access change. They do not invite a purchase or paid continuation. Every message says who it is from. We do not add anyone to a mailing list.

Oabo also researches and may send individual business-to-business outreach about Oabo where a public business event makes the message relevant. This is separate from account mail and is not a newsletter. Before any such message is sent, it must use accurate sender and subject information, identify its commercial purpose, include a valid physical postal address and a clear opt-out, and pass the suppression register. Reply “unsubscribe” or write to hello@oaboscorecard.com and we will stop future marketing email.

Before Oabo adds any trial-conversion email whose primary purpose is promotional, it must complete a primary-purpose review. A commercial message must have accurate sender and subject information, clear commercial identification, a valid physical postal address, a clear opt-out, and a working suppression process before approval. No promotional trial-conversion email is approved today. If you would rather not receive an operational message, reply or write to hello@oaboscorecard.com and we will stop. We also apply sending limits — per recipient, per organization, and per day — so that a free-trial workspace cannot be used to send mail to strangers.

Oabo is multi-tenant and org-scoped. Every customer record is bound to a single organization, and access is filtered by organization on every request — a user who attempts to reach another organization’s data is treated as if it does not exist. Within an organization, the nine roles, segregation-of-duties rules, and business-unit scoping determine which slice of data each user can see and which actions they can take.

We use a small number of providers to run the service. Each one is used for the purpose named here and nothing else, under the terms it publishes for business customers.

Telegram stores each support notification and founder reply in ordinary cloud-chat history. Oabo has not verified a separate retention period for that history. Oabo’s deletion workflow does not remove it automatically; deletion must happen separately in Telegram, so Oabo cannot promise that both copies disappear at the same time.

Stripe processes payment data under its own privacy notice and may act as a processor for Oabo or as a controller for functions such as fraud prevention, financial compliance, and operation of its payment network. Payment details entered on Stripe’s hosted pages are handled by Stripe and its financial partners, not stored as full card numbers in Oabo’s application.

We will keep this list current, and tell customers through the service or by email when it changes. If your organization needs a signed data-protection agreement with us or with one of these providers, ask and we will tell you where that stands.

• AI support drafting is disabled. A person writes and sends support replies. Support conversations and workspace records are not sent to a model provider. Where you connect a vendor account, traffic goes the other way: Oabo reads your usage and cost data out of that vendor.
• Your connected providers — we read usage, cost, or accounting data from the sources you connect; we do not send your Oabo workspace records back to them. Current enabled sources are Anthropic Enterprise Analytics, OpenAI Enterprise Cost, OpenRouter, LiteLLM, and Azure OpenAI Cost Management. Intuit QuickBooks Online is described above but is not enabled in this deployment.
• Legal & safety — where required by law, or to protect the rights, safety, and security of Oabo, our customers, or the public.
• Corporate transactions — in connection with a merger, acquisition, or sale of assets, subject to this policy.

We do not sell personal data, and we do not share it for targeted or cross-context behavioural advertising. There are no advertising trackers on this site. We do not use your data to profile people or make automated decisions about them.

Oabo runs in the United States. The application runs on Google Cloud Run in Google’s us-east1 region, and the database is managed by Neon. Normal requests to oaboscorecard.com pass through Cloudflare’s network, so a request from outside the United States reaches a Cloudflare location near you before it reaches us. The native Cloud Run origin is also internet-reachable, and a request sent directly there does not pass through Cloudflare. If we begin processing customer data outside the United States, we will say so here first.

Data is encrypted in transit with TLS. Connected-provider keys get a second layer: Oabo encrypts them with AES-256-GCM before storage, bound to your organization, with a key held in our hosting provider’s secret manager and never stored in the database — so a copy of the database on its own is inert. Those keys are never returned to the browser and never written to a log. Our hosting providers encrypt stored data at rest.

Access is governed by authentication, role-based authorization, segregation of duties, and tenant isolation. Application mutations are recorded in a per-organization hash chain. The production chain is unsigned and is not a database-enforced immutable ledger.

Three limits worth stating plainly. The backend has authenticated self-service endpoints for multi-factor enrollment, confirmation, recovery codes, disabling, and an organization policy, but Oabo does not yet expose a customer-facing enrollment screen. A customer would need direct API use; our own administrative account can also enroll through operator tooling. Treat MFA as an incomplete product rollout, not a generally available customer-facing control. The audit trail’s IP field is only as good as its source: middleware carries the resolved address through web-request handlers and services, while work with no request recordsunknown. And we hold no security certification. Oabo has not completed a SOC 2 audit or any equivalent, and we will not describe our practices as certified or compliant until one is done.

Your access token, account summary, and workspace identifier are held in your browser’s local storage for the Oabo origin only. Workspace records remain on Oabo’s servers. The one first-party cookie we write carries only an HttpOnly session refresh token. Beyond it,Oabo’s own product code introduces no cookie of any kind, and an automated test fails the build if a third writer appears. Every other cookie described on this page belongs to website analytics and exists only where you asked for it — see “Cookies and similar storage” above.

No method of transmission or storage is perfectly secure, but we maintain administrative, technical, and organizational safeguards appropriate to the data we hold.

We retain customer data for as long as the organization’s account is active, and thereafter as needed to meet legal, audit, and contractual obligations. Historical audit and evidence records are intentionally retained for the duration governed by the customer agreement; this is a retention practice, not a claim of database-enforced immutability.

Oabo keeps a narrow application record of subscription identifiers, status, billing dates, and processed webhook event identifiers while the workspace exists. If Oabo runs the guarded organization-data deletion, that application billing record is deleted with the workspace data. An active legal hold blocks the deletion. Oabo refuses that deletion while a Stripe subscription can still be charged or resumed, or while Checkout is pending or processing; the subscription must first reach a reconciled, terminal state. Stripe separately retains the payment, invoice, and billing data it processes under its own retention and legal obligations; deleting an Oabo workspace does not itself delete Stripe’s records.

Being straight about where the product is today: a free-trial workspace becomes read-only when the trial ends, and about a week later access to it is switched off entirely — signing in no longer reaches the workspace, reading included. The data itself is not erased on a schedule. Oabo has an administrator-only, machine-readable tenant-data export and a guarded organization-data deletion operation. The export covers organization-owned database records, marks credential redactions and omitted binary content, and does not collect Practice, controller-side, or provider copies. Deletion is a dry run by default; destruction requires the exact organization confirmation, a deployment switch that is currently off in production, and no active legal hold. There is no self-service deletion button or per-user erasure. The founder therefore still assembles and redacts personal responses, propagates requests to other providers, and handles every production deletion request by hand.

Public-form enquiries and website analytics follow the same rule: we keep them until they are no longer useful for the purpose we collected them for, or until you ask us to delete them.

Business-outreach research and drafts are kept only while relevant to the approved campaign and any follow-up. An opt-out leaves the minimum suppression record needed to prevent another marketing send. No automated retention sweep currently removes these off-platform records, so the founder must apply that rule in both the private repository and Microsoft 365.

A minimum outbound-email abuse ledger stores the lowercased recipient address, message purpose, and send time across organizations so a new workspace cannot reset the limit for the same recipient. It survives workspace deletion for that security purpose. Its target retention is 13 months, but no automatic expiry runs today; older entries therefore require manual review and removal, and a deletion response will identify any retained entry and why it remains necessary.

Wherever you live, you can ask us for any of the following. We do not charge for it, and we will not treat you differently for asking.

• A copy of your data — what personal data we hold about you, why we have it, and who we share it with.
• A portable copy — in a common machine-readable format, where we hold it that way.
• A correction — if something we hold about you is wrong.
• Deletion — of your personal data, subject to records required or reasonably necessary for security, abuse prevention, suppression, disputes, tax, audit, or other legal duties.
• To opt out of analytics — use Privacy choices at the bottom of any page. You do not need to write to us for that one.

We do not sell personal data or share it for cross-context behavioural advertising, so there is nothing to opt out of there. We do not use personal data for profiling that produces legal or similarly significant effects.

How to ask. Email hello@oaboscorecard.com with “Privacy request” in the subject and tell us what you want. We may need to ask you for enough information to be confident of who you are, and we use anything you send for that check and nothing else. Someone authorized to act for you can make a request on your behalf if they can show you asked them to.

When you will hear back. Within 30 days. If applicable law permits more time and the request is genuinely complicated, we will tell you before the original deadline that we need an extension, why, and the new response date.

If we say no. We will tell you why. You can ask us to reconsider by replying with “appeal” in the subject. The founder, Oabo’s only privacy decision-maker today, reviews the recorded reason and the request again and answers in writing within 30 days. This is a reconsideration, not an independent review. Where applicable law gives you a regulator complaint path, we will identify it in the answer.

If you work for an Oabo customer. Your employer controls the data in its workspace, so send your request to them first — they can access, correct, and export within the product. If you write to us instead, we will pass the request to them, help them answer it, and tell you we have done so.

Oabo is business software, sold to organizations and used at work. You must be 18 or older to use it. It is not directed at children, we do not knowingly collect personal data from anyone under 18, and if we learn that we have, we delete it. If you believe a child’s data has reached us, write to hello@oaboscorecard.com and we will remove it.

Each version of this policy carries a version number and an effective date at the top. A change in substance moves the first number (2.0 to 3.0); a correction or a wording change moves the second (2.0 to 2.1). Material changes are communicated to customers through the service or by email before they take effect where we can. Earlier versions are available on request.

Version 6.0 — 2026-10-05. What changed:

• Disabled AI support drafting and removed OpenAI as an active support model processor. A person writes and sends each reply; support conversations are not sent to any model provider.
• Kept human support, Telegram notifications and the existing cloud-chat deletion limitations unchanged.
• Kept connected provider usage and cost reporting, Stripe-hosted payments, outreach and workspace processing unchanged.

Privacy questions and requests go to hello@oaboscorecard.com, and we are the right people to ask: Oabo Scorecard is a product of AgentX, LLC. Existing customers may also use the contact channel provided in their Oabo account or customer agreement. Our Terms of Service cover the rest of the relationship, including what must not be put into the service.