DungeonOS — Privacy Policy

Who this applies to

DungeonOS is a private, invitation-only tool for Ordesa’s team and its clients. Accounts are created by an administrator; the public cannot sign up. It is not a consumer service.

Information we collect

• Account & sign-in. Your name, email address, and profile information from your Google account when you sign in, used to authenticate you and apply your role and permissions.
• Calendar availability (Google). When you connect or share a Google Calendar so meetings can be booked at times you're free, we read when you're busy, and, for calendars connected to send invites, create the meeting invitations you book. See Google Calendar data below.
• Connected sending mailbox (Google). When you choose to connect a Google account as a sending mailbox, we receive a refresh token that lets DungeonOS send and read email on that account’s behalf. See Google user data below.
• Sales activity. Call outcomes, notes, transcripts, meeting details, and contact information (name, company, title, phone, email) for the prospects your team engages, used to run and report on outbound work.

Google user data

If you connect a Google account as a sending mailbox, DungeonOS requests the following Google API scopes, and uses the resulting access only as described:

• openid, email, profile — to identify the connected account and display which address is connected.
• gmail.send — to send outbound emails (and replies) that you or your teammates compose in DungeonOS, from the connected mailbox.
• gmail.readonly — to read messages in the connected mailbox so DungeonOS can show replies to your outreach in the app and associate them with the right prospect.

We store the Google refresh token securely on our own server infrastructure and use it solely to provide the sending and reply-tracking features above. You can disconnect a mailbox at any time from the app’s Settings, or revoke access directly at myaccount.google.com/permissions. Disconnecting or revoking immediately ends our access.

Google Calendar data

DungeonOS books meetings with prospects at times that work for the people taking them. Depending on how you connect, it uses the following Google Calendar access, and only as described:

• calendar.readonly — when you connect a calendar, to read your free/busy times so prospects are only offered open slots, and to match booked meetings to their calendar events. We do not copy or store your event details.
• calendar.events — for calendars connected to send invitations (an Ordesa rep’s or a client’s scheduling calendar), to create, move or cancel the meeting invitations a person books in DungeonOS, so Google delivers them with working Accept / Decline.
• Shared free/busy — if you share your calendar’s free/busy with an Ordesa address instead of connecting it, we see only when you are busy, never what is on your calendar. Remove the share in Google Calendar at any time to end it.

Calendar access is stored and handled exactly like a connected mailbox above: on our own infrastructure, used only for scheduling, and revocable at any time at myaccount.google.com/permissions.

Limited Use of Google user data

DungeonOS’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically, we do not use Google user data for serving advertisements; we do not sell it; we do not transfer it to others except as necessary to provide and secure the features you use, to comply with applicable law, or as part of a merger or acquisition; and we do not allow humans to read your Gmail or Calendar data except with your explicit consent, where required for security or to comply with applicable law, or where the data has been aggregated and anonymized.

Video meetings

Some meetings are held on our own video service (meeting links on meet.ordesa.ai or dungeon.ordesa.ai). When you join one, we keep the name and email you enter, when you joined and left, and who let you in, so the host knows who is waiting and so we know whether the meeting took place. A host who confirms their address with Google signs in with their name and email only; we read nothing else from their Google account. We record a meeting only when it says so on a banner at the top of the meeting, and anyone in the meeting can turn recording off from that banner. A recording is transcribed so the team can review the meeting.

How we use information

We use the information above to operate DungeonOS for our team and clients: authenticating users, sending and tracking outbound email, organizing calls and meetings, and producing internal performance reporting. We do not use it for advertising and we do not sell it.

Service providers

We use trusted providers to run the service, including Google (email delivery and sign-in), our cloud hosting provider, and telephony providers for calling and texting. They process data only to provide these services to us and are bound by their own security and privacy obligations.

Retention & your choices

We retain information for as long as needed to operate the service and meet our business and legal obligations. You can disconnect a Google mailbox at any time, which removes the stored token. To request access to, correction of, or deletion of your information, email support@ordesa.ai.

Security

Access to DungeonOS requires authentication, and data is transmitted over encrypted connections. Credentials such as Google refresh tokens are stored on private infrastructure and are not exposed to other tenants.

Changes

We may update this policy from time to time. Material changes will be reflected by the “last updated” date above.