Privacy Policy

This Privacy Policy describes how DIGITAL WARRIORS LLC ("Operator Base," "we," "us," or "our") collects, uses, and shares information when you use the Operator Base operator app and our hosted AI agent platform, Delta Agents (including the Delta Agents web dashboard and the Delta Agents iOS and Android apps), together with our related services (collectively, the "Service").

It sits alongside our Terms of Service, our Data Processing Addendum, our Sub-processor list, and our Security page. Where this policy refers to the providers we use or to a security control, those pages are the current source of truth. We link to them rather than restate them here, so there is one place that stays up to date.

By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Two roles, and which one covers your data

Operator Base holds two different roles depending on whose data is involved. The distinction decides which document governs.

• Data about you, our customer. We are the controller for three categories: your account data, your billing data, and the User Content you and your team create inside the operator app, which is what the Terms of Service defines as User Content in its section 4. Section 2 of our Data Processing Addendum sets out all three and explains why they sit outside that agreement. This Privacy Policy is the document that governs them.
• Data about your end contacts. These are the leads, prospects, and customers your AI agents talk to, together with their conversations and the records your agents build. You decide who enters the platform and why, so you are the controller and we are the processor. That processing is governed by the Data Processing Addendum rather than by this policy, and this policy describes it only so that the picture is complete.

If you are an end contact who has spoken with an AI agent built on Operator Base, the business that operates that agent decides what happens to your data. Contact them first. Section 8 explains what we do if you write to us instead.

2. Information we collect

Account data

When you create an account, we collect your email address, name, and password. Your password is cryptographically hashed by our authentication provider and is never stored in plain text.

Content you create in the operator app

We collect content you create within the operator app, including posts, messages, comments, files you upload, and other community contributions.

Device and usage data

We automatically collect:

• device type, operating system, and app version;
• push notification tokens, held so that we can deliver the notifications you have turned on;
• usage and diagnostic events, such as which features are used and when an error occurs, which we use to operate and improve the Service.

Payment data

Payments are processed by Stripe. We do not store your card number, bank account details, or other financial instruments, and card numbers never reach our systems. We retain your subscription status and transaction history for billing purposes.

Data you place in the AI agent platform

When you build and run agents, the platform holds the data those agents work with: contact records, conversation history across chat, SMS, email, and messaging channels, voice call recordings and transcripts, agent memory, conversation summaries, text embeddings, appointment and opportunity records, and anything else you choose to put into custom fields, uploaded files, or agent instructions. Section 4 of the Data Processing Addendum sets out these categories in full. We hold this data on your behalf and on your instructions.

The Service is not designed for special categories of personal data, for data relating to criminal convictions, or for protected health information. Do not put that data into the Service.

3. How we use information

• Provide the Service. Authentication, data synchronization, the operator app and its community features, and the building, deployment, and running of your AI agents across the channels you connect.
• Send notifications. Notifications you have turned on, such as mission reminders, messages, and community updates.
• Operate and improve the product. Usage and diagnostic events help us understand how features are used and where something is failing.
• Billing and fraud prevention. Process subscriptions and detect unauthorized transactions.
• Communicate with you. Respond to support requests and send service-related announcements.
• Keep the Service secure. Rate limiting, abuse controls, audit logging, and investigating incidents.

We do not sell personal information. We do not use it to train generalized artificial intelligence or machine learning models of our own.

4. How we share information

We share data with third-party providers that process it on our instructions in order to deliver the Service. Rather than duplicate that roster here, where it would drift out of date, we publish and maintain it on our Sub-processor page. That page names every provider we engage across the whole of Operator Base, covering the operator app, the AI agent platform, and this website. For each one it states what it does, which category of data it can reach, and where it processes that data. It is kept current there rather than here.

The categories of provider we engage are:

• cloud hosting and application infrastructure;
• database, file storage, and caching;
• AI model providers, for the platform features that classify, summarize, index, and search content, and for in-product help;
• content safety classification, where you have enabled the safety guard on an agent;
• email sending and receiving, both for the email your agents handle and for transactional email to operators;
• messaging channels;
• real-time audio and video transport, and recording, for the live calls and hangouts in the operator app;
• speech to text, for the voice notes you record and for our course and help videos;
• contact data services used by the prospecting and outreach tools: web search, contact enrichment, and email address verification;
• payment processing, and the customer relationship management system that holds our own record of you as a customer;
• error monitoring, infrastructure alerting, product analytics, advertising and affiliate attribution on this website, and retrieval of the public web pages you add as a knowledge base source;
• video hosting, delivery and compression, over-the-air app updates, and GIF search.

Push notifications for the operator app are delivered through the platform push services: the Apple Push Notification service on iOS, Firebase Cloud Messaging on Android, and your browser's push service if you enable web notifications. These receive the device token and the notification itself, which can name the person who sent you a message and quote the first 100 characters of it.

Analytics, session recording, and advertising. When you use the operator app in a web browser, a session recording provider records the screen so we can see where the interface is failing people. It is tied to your Operator Base user identifier, not to your email address, and it does not run in the iOS or Android app. On this website we run product analytics and advertising, affiliate, and click attribution tags. Each of these providers is named on the Sub-processor page with what it can reach. We do not run any of them against the conversations or contact records held in the AI agent platform.

Integrations you connect. Some vendors receive data only because you connected an account and supplied your own credentials, such as your CRM, your telephony provider, your calendar, and the model provider key your agents run on. You choose those vendors and hold the contract with them, so they are not our sub-processors. They are listed separately on the Sub-processor page. Disconnecting an integration stops any further transmission to it, and data already delivered is held under your agreement with that vendor.

We may also disclose information if required by law, regulation, legal process, or governmental request.

5. Google user data (Google Calendar)

Delta Agents is the AI agent platform that is part of Operator Base. If you connect a Google account to Delta Agents, Delta Agents asks Google for the permissions below. We use each one only for the purpose stated.

• See your free and busy times (calendar.freebusy). Delta Agents reads only the start and end times of the times you are busy, so that your AI agent offers appointment times that do not clash with your calendar. We do not see the titles, descriptions, attendees or locations of your events.
• See the list of your calendars (calendar.calendarlist.readonly). Delta Agents reads the names and ids of your calendars so you can choose which calendars to check for conflicts and which calendar receives new bookings.
• Create and manage events on calendars you own (calendar.events.owned). When a booking is made in Delta Agents (by you, your team or your AI agent), Delta Agents adds it to the calendar you chose, and updates or removes that event when the booking is moved or cancelled. Delta Agents also re-reads the events it created to warn you when one was moved or deleted outside Delta Agents. Delta Agents does not edit or delete events it did not create.
• Your email address and basic sign in information (openid, email). Delta Agents shows which Google account is connected.

What we store. An encrypted OAuth refresh token, so the connection stays on until you disconnect it; the id of each event Delta Agents created, so it can update or remove that event; and a cache of your busy start and end times for at most 15 minutes. Short lived access tokens are kept only in memory. We do not store the contents of events that Delta Agents did not create. For a location that handles health information, Delta Agents writes only a "Busy" block with no patient details.

Who it is shared with. Delta Agents never sends your busy times, calendar names, email address or event details to an AI model. From your busy times it works out which appointment times are open, and only that list of open times (and the words "that time is busy" when a requested time clashes) can be passed to the AI model that runs your agent, so it can offer a time inside a conversation you or your business started. We share Google user data with no one else, except as needed to run these scheduling features, to comply with the law, or as part of a merger or acquisition after notice to you.

What we do not do. We do not sell Google user data. We do not use it for advertising, retargeting or interest based ads. We do not use it to decide credit or lending. We do not use it to develop, improve or train generalized artificial intelligence or machine learning models. No person at Delta Agents reads your Google user data unless you ask us to (for example in a support request), it is needed for security, or the law requires it.

Deletion. You can disconnect Google Calendar at any time in Delta Agents, or remove access in your Google Account permissions. When you disconnect, or delete your account, we delete the stored refresh token and the cached busy times. The events Delta Agents created stay in your calendar unless you delete them.

Limited Use. Delta Agents' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs, including Google Calendar, will adhere to the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including the Limited Use requirements. We do not transfer Google user data, raw, aggregated or derived, to any AI service that uses it to train or improve AI or machine learning models.

Microsoft Outlook calendar data

If you connect a Microsoft account (Outlook.com, Outlook or Microsoft 365) to Delta Agents, Delta Agents asks Microsoft for the permissions below. We use each one only for the purpose stated.

• Read and write your calendars (Calendars.ReadWrite). Delta Agents works out the times you are busy from the start and end times of your events, so that the times offered and booked through Delta Agents do not clash with your calendar. It may read the names of your calendars, so you can choose which ones to check for conflicts and which one receives new bookings. It adds the appointments booked through Delta Agents to your calendar, with their details, and updates or removes those events when an appointment is moved or cancelled. If an agent is set up to book straight into your Outlook calendar, that agent can also read the events on that calendar, including their titles, descriptions and attendees, to look up, move or cancel appointments.
• Stay connected (offline_access). Delta Agents keeps the connection working without asking you to sign in again.
• Your email address and basic sign in information (openid, email). Delta Agents uses it to show and keep a record of which Microsoft account is connected.

What we store. An encrypted OAuth refresh token, so the connection keeps working until you disconnect it, and the email address of the connected account. We may also store the names and ids of your calendars, the choices you make for them, and the id of each event Delta Agents added, so it can update or remove that event. Short lived access tokens are kept only in memory. To work out busy times, Delta Agents keeps only the start and end times of your events, and any cached copy of those times is used for at most 15 minutes. When an agent checks your availability, or looks up, books or moves an appointment, what it gets back, which may include event details, may also be saved in the records of that conversation.

Who it is shared with. Your busy times, or the open times worked out from them, and the event details an agent gets back when it looks up, books or moves an appointment may be passed to the AI model that runs your agent, during a conversation. We do not share Microsoft calendar data with anyone else, except as needed to run these scheduling features or to comply with the law.

What we do not do. We do not sell Microsoft calendar data, and we do not use it for advertising.

Deletion. You can disconnect Outlook at any time in Delta Agents. When you disconnect, we delete the stored refresh token. The events Delta Agents added stay in your calendar unless you delete them, and the settings of any agent that points at that calendar stay until you change them.

6. Data retention

Your account data. We retain it for as long as your account is active or as needed to provide the Service.

What happens when you delete your account. Deletion runs immediately, not on a delay. Your sign-in account is deleted and the private records attached to it are removed with it, in the same request. Two exceptions are worth knowing before you press the button, because they are deliberate rather than accidental:

• Community content stays, under a deleted author. Your community posts, comments, lounge messages, and the direct messages you sent are reassigned to an anonymous placeholder author and your name and profile photo are stripped from them. Deleting them outright would remove the other side of conversations other members are still part of. The content remains; the attribution to you does not. Files you uploaded, including the images and video attached to that content, stay with it.
• Some records are kept where the law requires it, for example transaction records needed for tax and accounting, or records needed to resolve a dispute.

If you want the anonymized content removed as well, email support@operatorbase.app and our team will action it.

Data in the AI agent platform. This stays in the Service while your subscription is active, so that your export tools keep working, and we delete or return it on your instruction. Section 12 of the Data Processing Addendum governs deletion and return, and it is the controlling document if the two ever read differently. Residual copies in routine backups are removed on the ordinary backup rotation of our infrastructure provider.

Two limits are worth stating plainly. Erasure of an individual contact pseudonymizes that contact record rather than deleting the underlying row. Deletion by us does not reach copies held in the third-party systems you connected, such as your CRM or your telephony provider, which have to be erased in those systems as well.

7. Security

Our technical and organizational measures are described in full on our Security page, including tenant isolation enforced in the database, encryption in transit and at rest, application-level encryption of the credentials you connect, redaction of logs and error reports, an append-only audit trail, and access controls. That page also states the known limits of those controls, and lists the certifications and controls we do not hold, including SOC 2, ISO 27001, HIPAA, and independent penetration testing. We do not claim any certification or audit that we have not obtained.

No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe you have found a vulnerability, the reporting process is on the Security page.

8. Your rights and choices

If you hold an Operator Base account:

• Access and correction. You can view and update your profile information at any time within the app.
• Account deletion. You can delete your account from Settings > Account > Delete Account. You may also request deletion by emailing support@operatorbase.app.
• Notifications. You can disable push notifications at any time through your device's system settings or your browser settings.
• Account export. A tenant administrator can request an export of the account's data from the dashboard, delivered through a short-lived signed link.

Data subject requests. Depending on where you live, you may have rights to access, correct, delete, port, or object to the processing of your personal data. Send the request to support@operatorbase.app and the Operator Base team will action it and confirm back to you. Where we are assisting one of our customers with a request about their end contacts, we do that within 10 business days, as set out in section 9 of the Data Processing Addendum.

One operation is still performed by our team rather than through a self-service control: an export narrowed to a single data subject. There is no button for that one today, and we would rather say so than imply one that does not exist. Erasure of an individual contact used to be on that list and no longer is: since August 19, 2026 a tenant administrator can erase a contact from the AI agent platform dashboard, with a preview of the affected records and a cancellation window before anything is destroyed.

If a request reaches us about a customer's end contact. Where the data belongs to one of our customers rather than to us, we will confirm receipt, direct the request to that customer, and notify them. Section 9 of the Data Processing Addendum sets out how we assist our customers with these requests.

9. Children's privacy

Operator Base is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected data from a child under 13, we will take steps to delete that information promptly.

10. Where we process data, and international transfers

We process data in the United States. The AI agent platform's application services and primary database run in the AWS us-east-1 region. The operator app's backend, which also holds the sign-in accounts used across the Service, runs in a separate project in the us-west-2 region. We have not configured a European or other non-US region for any part of the Service. Delivery is not the same as storage: our hosting and content delivery providers serve files and run edge code from whichever network location is nearest your device, which can be outside the United States, while the systems that store your data stay in the regions named here. Processing locations for our sub-processors are listed on the Sub-processor page.

If you are outside the United States, using the Service means your information is transferred to and processed in the United States. Where a transfer involves personal data protected by the GDPR or the UK GDPR, the transfer mechanism, including the standard contractual clauses, is set out in section 14 of our Data Processing Addendum.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through an in-app notification. Changes to the list of providers we use are notified through the process described on the Sub-processor page. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

12. Contact us

If you have questions about this Privacy Policy or our data practices, contact us at:

DIGITAL WARRIORS LLC
180 NE 29th St, Apt 330
Miami, FL 33137
support@operatorbase.app