PatchOps Privacy Policy

This Privacy Policy explains how PatchOps (“we,” “us,” “our”) collects, uses, and protects information across the PatchOps website, dashboard, APIs, MCP servers, code execution features, and connected integrations (collectively, the “Service”). We keep data collection focused on what is needed to run the dashboard, power MCP workflows, and keep accounts secure.

Data We Collect

We collect information necessary to provide the dashboard and integrations you use, keep the Service reliable, and comply with legal obligations.

How We Use Data

• Power the dashboard and MCP workflows you use.
• Authenticate users, secure sessions, and protect credentials.
• Operate MCP servers, route tool calls, and show usage analytics.
• Debug issues, keep uptime reliable, and maintain audit logs.
• Calculate usage limits, overages, and subscription billing.
• Send account, billing, and security notifications.
• Comply with legal obligations and enforce our Terms.

Sharing & Disclosure

We do not sell user data. We share information only as needed to provide the Service and your dashboard:

• Service providers for hosting, databases, and email delivery (e.g., Supabase, Azure Communication Services).
• Payment processing via Stripe for subscriptions and invoices.
• Third-party connectors you enable (e.g., Corva, Enverus, GeoForce, Google, Microsoft, and similar providers).
• AI assistants you connect to PatchOps (e.g., ChatGPT or Claude), which receive the tool results you request. Depending on your plan with the assistant provider and your agreement with it, the provider acts as a controller or as your processor for that data. See AI Assistants.
• Legal or regulatory requests when required by law.
• Business transfers in the event of a merger, acquisition, or asset sale.

AI Assistants

You can connect PatchOps to an AI assistant, such as ChatGPT or Claude. The assistant sends PatchOps the request and arguments for each tool it calls. PatchOps returns the tool results to the assistant.

• The assistant provider (for example, OpenAI or Anthropic) receives every tool result you request. This includes results from licensed data sources and from accounts you connect, such as Google or Microsoft.
• Depending on your plan with the assistant provider (for example, OpenAI or Anthropic) and your agreement with it, the provider acts as a controller or as your processor for data in your assistant. Its terms govern that data. PatchOps does not control how the provider stores, retains, deletes, or trains on it.
• PatchOps processes the data in each tool call to provide the Service. PatchOps's own role: for Free and Professional accounts, PatchOps acts as the controller of the data in each tool call. For Team and Enterprise customers that have a written customer agreement with PatchOps, PatchOps processes that data on the customer's behalf, as the agreement sets out.
• PatchOps does not send its stored tool-call records to the assistant provider. The provider receives only the results of the calls the assistant makes.
• You must have the right to share licensed data with your assistant provider. Check your data license before you query a licensed source through an assistant.
• PatchOps receives only what the assistant sends in a tool call. PatchOps does not receive your full conversation with the assistant.
• The assistant can use only the tools and data that your PatchOps account and your organization's connections allow.
• PatchOps runs a write action only in two steps: the assistant first gets an action plan for your account, then calls a separate action tool with that plan and an explicit confirmation flag. PatchOps refuses the call without both. The assistant sets the confirmation flag; it is not a click by you. Write tools are marked as destructive so that compatible assistants can ask you for confirmation, but PatchOps cannot make an assistant do so. Workspace admins in ChatGPT can require approval for actions. Whether you see an approval prompt depends on the assistant and its settings.
• PatchOps adds a short activity receipt to a PatchOps Chat thread in your account, so you can see what ran. The receipt holds the tool name, the source and method, the argument names, and the status. It does not hold argument values or results.
• Disconnecting PatchOps in the assistant stops new tool calls from that assistant. It does not revoke the PatchOps sign-in on our side. See Deleting Your Data to revoke it.

Tool-Call Records

PatchOps stores a record of each connector tool call. We use these records to operate the Service, debug problems, and protect accounts. What we store depends on who owns the data.

• Every call: provider, tool and method name, argument names, timing, success or failure, and an error message when a call fails (for Google Workspace, only an error category; see below).
• Secret removal: before we store inputs or outputs, we attempt to remove fields named like tokens, passwords, or API keys, the credentials loaded for that call, and common secret formats. This is a best effort, not a guarantee. Stored inputs are capped at 16 KB and outputs at 32 KB per call.
• Public-record sources (for example, Texas RRC, EIA, EPA, SEC, USGS, and state agencies): we store the inputs in full, including your search terms, filters, names, and locations, and we store the results.
• Screening sources (for example, sanctions, court, federal contractor, and environmental site screening lookups): we store a reduced form of your inputs (defined below) and the public result. We attempt to mask values in the result that repeat your input. Values of fewer than 4 characters may not be masked.
• Licensed data sources (for example, WellDatabase, Enverus, and market-data feeds): we store the inputs and results for operation and debugging, for 12 months from the call.
• Engineering calculations: we store the inputs and results for operation and debugging.
• Your own content and systems (for example, Outlook, Teams, SharePoint, OneDrive, uploaded documents, web pages, your databases, and other accounts you connect with OAuth): we store a reduced form of the inputs and only the shape of the result: field names, item counts, and text lengths. We do not store the message, document, or record text.
• Reduced form means: we keep a text value only when it sits under a control or identifier field (such as id, a field ending in Id, cursor, page token, sort, select, status, type, or mode), has no spaces and no @, is at most 128 characters, and is not made only of 7 or more digits and separators. We keep whole numbers only under paging fields (such as page, limit, offset, and count), and dates only in ISO or timestamp form under date fields. We replace every other value with a placeholder that records only its type or length. Any field whose name suggests personal data (for example, phone, birth, tax, salary, or employee) is always replaced. So a record ID such as a message ID is kept, but a phone, account, or Social Security number is not.
• Google Workspace and partner calls: for Google Workspace connectors (Gmail, Calendar, Drive, Docs, Sheets, Slides), we do not store inputs, results, or error text; only an error category is kept. For calls made through a partner integration, we do not store inputs or results.
• Model training: we do not train models on tool-call records today. Rows from public-record tools are marked as eligible for future model improvement; we will update this policy before any such use. For screening sources, only the masked public result is marked as eligible; the reduced inputs are not. Rows from licensed sources, engineering calculations, your own content and systems, Google Workspace, and partner calls are not marked as eligible.
• Retention: tool-call records are deleted automatically 12 months after the call.

Third-Party OAuth Data

PatchOps' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect a third-party provider through OAuth, PatchOps accesses only the scopes you explicitly authorize and only the account data needed to provide the feature you choose.

Google user data. When you connect a Google service to PatchOps, PatchOps accesses your Google account profile and the specific Google user data covered by the scopes you approve. Access is always limited to the authenticated user's own account and only while your connection is active.

• Gmail: Under the gmail.modify scope, PatchOps can list, read, search, send, draft, label, archive, and trash messages on your behalf so the AI assistant can summarize, compose, and manage your mail at your explicit request.
• Google Calendar: Under the calendar and calendar.calendars scopes, PatchOps can list calendars, list/create/update/delete events, and create or delete secondary calendars so the AI assistant can read your schedule and manage events at your explicit request. The calendar.calendars scope is required for creating and deleting calendar containers themselves, in addition to events.
• Google Drive: Under the drive.file scope, PatchOps can create, read, modify, share, and delete only the files and folders that the AI assistant creates on your behalf or that you explicitly open with PatchOps. PatchOps does not have access to your other Drive files. We use the narrower drive.file scope to follow Google's minimum-scope guidance.
• Google Docs: Under the drive.file scope, PatchOps can create, read, insert text into, and format only the Google Docs that the AI assistant creates on your behalf or that you explicitly open with PatchOps. PatchOps does not have access to your other documents. We use the narrower drive.file scope to follow Google's minimum-scope guidance.
• Google Sheets: Under the drive.file scope, PatchOps can create spreadsheets and worksheets, read cell values and ranges, append rows, update cells, and apply formatting only for the spreadsheets that the AI assistant creates on your behalf or that you explicitly open with PatchOps. PatchOps does not have access to your other spreadsheets. We use the narrower drive.file scope to follow Google's minimum-scope guidance.
• Google Slides: Under the drive.file scope, PatchOps can create presentations, add new slides, read slide structure, update slide content, and delete slides only for the presentations that the AI assistant creates on your behalf or that you explicitly open with PatchOps. PatchOps does not have access to your other presentations. We use the narrower drive.file scope to follow Google's minimum-scope guidance.

Depending on the providers and connectors you enable, PatchOps may access account profile information and limited categories of third-party data needed for the feature you choose, such as files and file metadata, emails and mailbox labels, calendars and events, spreadsheets and documents, tasks, contacts, and meeting or workspace metadata.

Specifically, PatchOps:

• Uses third-party account data only to provide and improve user-facing features of PatchOps that are visible to you.
• Does not sell third-party account data to third parties.
• Does not use third-party account data for advertising, including retargeting, personalized advertising, or interest-based advertising.
• Does not transfer third-party account data to data brokers, information resellers, or similar parties.
• Does not allow humans to read Google user data, except: with your affirmative consent for specific items (e.g. a support ticket you share), for security purposes, to comply with applicable law, or when the data has been aggregated and anonymized for internal operations.
• Does not use third-party account data to determine credit-worthiness or for lending purposes.
• Does not use Google user data to develop, improve, or train generalized or non-personalized AI or machine learning models. Any AI features in PatchOps operate only on the signed-in user's own data, at that user's explicit request, and only for the session in which the request is made.

You can revoke PatchOps's access to a connected third-party account at any time through the provider's account permissions settings or from the PatchOps dashboard.

You can also revoke PatchOps' access to your Google account at any time via your Google Account permissions page at https://myaccount.google.com/permissions.

We use encryption for stored credentials and secure cookies for sessions. We retain data only as long as necessary for the purposes described in this policy.

Your Choices

• Update account information and manage connection settings in your dashboard.
• Revoke OAuth access at any time through your provider or in PatchOps.
• Opt out of non-essential emails and usage alerts where available.
• Request account deletion or data export by contacting support.

Deleting Your Data

To delete your account and its data, send a request through ourcontact formusing the email address on your account. A person handles each request by hand. We verify the request, then complete the deletion within 30 days. Deletion is permanent: we cannot recover the account. A few records remain for a limited time, as listed below.

• We delete your account, your personal connections and their stored credentials, your PatchOps sign-in tokens, your PatchOps Chat threads, your usage counts, and all of your tool-call records, including calls made through your organization's connections. Tool-call records are deleted at that time, even if they are less than 12 months old.
• We cancel your subscription and revoke connected OAuth access where the provider allows it.
• Some data remains after deletion: audit log entries, including a record of the deletion itself (kept up to 24 months from each entry, with the link to your account removed), billing records that the law requires us to keep (including those held by Stripe), and copies in backups until those backups expire.
• Connections that belong to an organization stay with that organization, and so do the organization's audit exports.
• Data that an AI assistant provider already received stays with that provider. Use that provider's controls to delete it.
• Deleting a single PatchOps Chat thread does not delete the tool-call records behind it. Those records stay until their 12-month purge or until your account is deleted.
• To revoke an AI assistant's PatchOps sign-in without deleting your account, disconnect PatchOps in the assistant and send us a request through the contact form. We then revoke that sign-in on our side. PatchOps access tokens expire after 1 hour and refresh tokens after 30 days.

Children's Privacy

PatchOps is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will delete that information promptly. If you believe a child has provided us with personal data, please contact us at support@patchops.ai.

International Users

PatchOps and its service providers may process data in multiple regions, including the United States, to keep the Service reliable. If you are located in the European Economic Area (EEA), United Kingdom, or other regions with data protection laws, you may have the right to access, correct, delete, or port your personal data, as well as the right to restrict or object to certain processing. To exercise these rights, contact us at support@patchops.ai. We process data based on your consent, contractual necessity, or our legitimate interests in operating the Service.

Governing Law

This Privacy Policy is governed by the laws of the State of Texas, United States, without regard to conflict of law provisions.

Contact

Questions about privacy? Email us at support@patchops.ai.