Use CasesPricingBlogFAQContact
LoginStart free
Start free

Privacy Policy

Last updated: September 29, 2026

1. Introduction

LSL Group INC ("Overten," "we," "our," or "us") operates the Overten AI platform, a workflow automation and AI-assisted document workspace (the "Service"). This Privacy Policy describes how we collect, use, disclose, and safeguard information when you access or use the Service, and the choices and rights available to you. By using the Service, you acknowledge that you have read and understood this Policy.

2. Scope of This Policy

This Policy applies to the Overten website, web application, APIs, and any workflows, integrations, or automations you configure within the Service. It does not apply to third-party services you connect to Overten, such as Gmail, Google Drive, Slack, or HubSpot, which are governed by those providers' own privacy policies. It also does not apply to information our business customers process as independent controllers of their own end users; those relationships are governed by our Data Processing Agreement and the agreement between the customer and their end users.

3. Information We Collect

3.1 Information You Provide Directly

  • Account information: name, email address, password (stored as a salted hash), and authentication method
  • Profile details: company name, job role, and team or organization membership
  • Payment information: billing name, address, and payment method details, processed and stored by our payment processor; we do not store full card numbers
  • Content: documents, files, templates, comments, and other material you create, upload, or generate in the Service
  • Workflow configuration: triggers, conditions, connected accounts, and actions you define when building an automation
  • Communications: messages you send to support, feedback, and survey responses

3.2 Information Collected Automatically

  • Usage data: features accessed, actions taken, workflow executions, and time spent in the Service
  • Device and connection information: browser type and version, operating system, device identifiers, IP address, and approximate location derived from IP address
  • Log data: access times, pages viewed, error reports, and API request logs
  • Cookies and similar technologies, described in Section 19

3.3 Information From Third-Party Integrations

When you connect a third-party account to Overten, for example Gmail, Google Drive, Google Calendar, Google Sheets, Slack, Microsoft 365, HubSpot, Salesforce, Zoho, Odoo, Notion, Airtable, WhatsApp, or Telegram, we receive the data that account's permission scope allows and that your workflow configuration requests, such as message content, contact records, calendar events, or file contents. Section 7 describes our handling of Google user data specifically, and Section 8 describes our handling of data from other connected providers.

4. Legal Bases for Processing (GDPR)

Where the GDPR or UK GDPR applies, we process personal data under the following legal bases:

  • Contractual necessity: to provide the Service you have subscribed to, including account creation, workflow execution, and billing
  • Legitimate interests: to secure the Service, prevent fraud and abuse, improve features, and communicate with you about the Service, balanced against your rights and interests
  • Consent: where you explicitly opt in, such as connecting a third-party account, enabling optional cookies, or subscribing to marketing communications; you may withdraw consent at any time
  • Legal obligation: to comply with applicable law, respond to lawful requests, and meet tax, accounting, and regulatory requirements

5. How We Use Your Information

We use collected information to:

  • Provide, operate, and maintain the Service, including executing the workflows and automations you configure
  • Process transactions, manage subscriptions, and send billing confirmations
  • Provide customer support and respond to your requests
  • Send service updates, security notices, and, where you have not opted out, product communications
  • Monitor, analyze, and improve the performance, security, and reliability of the Service
  • Detect, investigate, and prevent fraud, abuse, and violations of our Terms & Conditions or Acceptable Use Policy
  • Comply with legal obligations and enforce our agreements

We do not use the content of your documents, workflows, or connected-account data for advertising purposes, and we do not sell your personal information.

6. AI and Data Processing

When you use AI features in Overten:

  • Your content is processed by AI models only to provide the functionality you request, such as drafting, summarizing, or analyzing a document or workflow step
  • AI processing runs through Google Vertex AI with data retention disabled, so your prompts and content are not logged by, or used to train, Google's or any other models
  • We do not use your content to train AI models, ours or any third party's
  • AI processing is encrypted in transit and at rest
  • You retain full ownership of all content you create, including AI-assisted output, subject to Section 12 of our Terms & Conditions
  • AI features may make mistakes; you are responsible for reviewing AI-generated output before relying on or acting on it

7. Google API Services and User Data

Overten integrates with Google APIs (Gmail, Google Drive, Google Calendar, and Google Sheets) to power workflow automation features that you configure yourself, such as triggering a workflow when a new email arrives, sending an email from your own account as part of a workflow you built, importing a file you select from Drive, or connecting your calendar and spreadsheets to a workflow.

We request the following Google scopes, each limited to what the corresponding feature needs:

  • Gmail, read-only: powers the "new email" workflow trigger and email data-source steps you configure. We never delete mail, change labels, or modify account settings.
  • Gmail, send: sends messages from your own connected account when a workflow you built reaches a "send email" step, including threaded replies. We never access drafts or mailbox settings.
  • Google Drive, file picker (read-only): imports a file you explicitly select using Google's own file picker. We do not browse, list, or sync your Drive in the background.
  • Google Drive, app-created files: lets a workflow you build upload a file into Drive; this grants access only to files Overten itself creates, never your existing files.
  • Google Calendar, events: reads or creates calendar events as part of a workflow you configure.
  • Google Sheets: reads or writes spreadsheet data as part of a workflow you configure.

You can disconnect any Google integration at any time from your account settings. Doing so revokes our access through Google's own revocation endpoint and stops further use of that data immediately.

Limited Use disclosure. Overten's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Where a workflow step or the AI assistant processes Google user data through our AI pipeline, that processing runs through Google Vertex AI with data retention disabled. We do not use raw, aggregated, or derived Google user data, including Gmail, Drive, Calendar, or Sheets content, to develop, train, or improve any AI or machine learning model, and we do not sell this data.

8. Other Third-Party Integrations

Beyond Google, Overten supports connections to a number of third-party services as part of its workflow automation features, including Slack, WhatsApp, Telegram, Microsoft 365, HubSpot, Salesforce, Zoho CRM, Odoo, Notion, and Airtable. Each connection is authorized separately, typically through OAuth, and is scoped to what the specific workflow steps you configure require, such as reading or writing CRM records, sending a chat message, or reading spreadsheet data. Credentials for these connections are encrypted at rest, and you can disconnect any integration at any time from your account settings. We do not access data from a connected third-party account beyond what your configured workflows use it for, and we do not use that data to train AI models.

9. Information Sharing and Disclosure

We share information only in these circumstances:

9.1 With Your Consent

We share information when you explicitly direct us to, such as when a workflow you configure sends data to a connected third-party account.

9.2 Service Providers

We engage service providers who process data on our behalf to operate the Service, including hosting and infrastructure, AI processing (Google Cloud Vertex AI), customer support tooling, analytics, and payment processing. These providers are contractually bound to protect your data and use it only to provide services to us. A current list of sub-processors is available at overten.ai/subprocessors.

9.3 Legal Requirements

We may disclose information when required by law, regulation, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

9.4 Business Transfers

If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any resulting change in ownership or use of your personal information.

9.5 No Sale of Personal Information

We do not sell your personal information, and we have not sold personal information in the preceding 12 months, as "sale" is defined under the CCPA and similar laws.

10. Data Security

We implement technical and organizational measures designed to protect your information, including:

  • Encryption of data at rest (AES-256) and in transit (TLS 1.2+)
  • Role-based access controls and multi-factor authentication for internal systems
  • Network security monitoring and regular vulnerability scanning
  • Periodic third-party security assessments
  • Employee security and privacy training
  • Incident response procedures, described in Section 11

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security, and you are responsible for maintaining the confidentiality of your account credentials.

11. Data Breach Notification

If we become aware of a security incident involving unauthorized access to your personal information, we will notify affected users and, where required by law, the relevant supervisory authority, without undue delay and in accordance with applicable law. Notifications will describe the nature of the incident, the categories of data involved, and the steps we are taking in response.

12. Data Retention

We retain personal information for as long as your account is active or as needed to provide the Service. Specific retention periods include:

  • Account and profile data: retained until account deletion, then deleted within 30 days, except where retention is required by law
  • Content and workflow configuration: deleted within 30 days of account deletion, or immediately upon your request within an active account
  • Google and other third-party integration data: use stops immediately upon disconnecting the integration; retained data is deleted on the same schedule as other content
  • Billing records: retained for the period required by applicable tax and accounting law, typically up to 7 years
  • Support communications and logs: retained for up to 24 months for quality and security purposes

13. Your Privacy Rights

Subject to applicable law, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate or incomplete data
  • Request deletion of your data
  • Export your data in a portable format
  • Restrict or object to certain processing
  • Withdraw consent where processing is based on consent
  • Opt out of marketing communications
  • Control cookie preferences

To exercise these rights, contact us at info@lslgroupinc.com. We will respond within 30 days, or the timeframe required by applicable law. We may need to verify your identity before fulfilling a request. If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority.

14. International Data Transfers

We are based in the United States, and your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. Where we transfer personal data from the European Economic Area, United Kingdom, or Switzerland to countries not deemed adequate by the relevant authority, we rely on Standard Contractual Clauses or other lawful transfer mechanisms, and we implement supplementary technical and organizational safeguards as appropriate.

15. Children's Privacy

The Service is not directed to, and is not intended for use by, individuals under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will delete it promptly. Parents or guardians who believe we may have collected information from a child should contact us at info@lslgroupinc.com.

16. European Economic Area and United Kingdom Users

If you are located in the EEA, UK, or Switzerland, the GDPR or UK GDPR gives you additional rights, including:

  • Right to access your personal data
  • Right to rectification
  • Right to erasure ("right to be forgotten")
  • Right to restrict processing
  • Right to data portability
  • Right to object to processing, including for direct marketing
  • Right to lodge a complaint with your local supervisory authority

Our EEA and UK representative contact information, where applicable, is available on request at info@lslgroupinc.com.

17. California Privacy Rights (CCPA/CPRA)

California residents have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

  • Right to know the categories and specific pieces of personal information we collect, use, and disclose
  • Right to delete personal information we have collected from you, subject to certain exceptions
  • Right to correct inaccurate personal information
  • Right to opt out of the sale or sharing of personal information; we do not sell or share personal information as those terms are defined under the CCPA
  • Right to limit use and disclosure of sensitive personal information
  • Right to non-discrimination for exercising your privacy rights
  • Right to designate an authorized agent to make a request on your behalf

The categories of personal information we collect are described in Section 3, and the categories of third parties with whom we disclose information are described in Section 9. To exercise your CCPA rights, contact us at info@lslgroupinc.com.

18. Other U.S. State Privacy Rights

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws have similar rights to access, correct, delete, and port their personal data, and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in targeted advertising or sell personal data. To exercise these rights, contact us at info@lslgroupinc.com.

19. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

  • Strictly necessary: required for core functionality such as authentication and security; cannot be disabled
  • Functional: remember your preferences and settings
  • Analytics: help us understand how the Service is used so we can improve it
  • Marketing: used on our marketing website to measure campaign performance; not used within the authenticated application

You can control cookies through your browser settings and, where available, our cookie preference center. Disabling strictly necessary cookies may prevent the Service from functioning correctly. We do not currently respond to browser "Do Not Track" signals, as no common industry standard for interpreting them has been adopted. See our Cookie Policy for further detail.

20. Automated Decision-Making

Workflows you configure in Overten may automatically take actions, such as sending an email, updating a CRM record, or creating a calendar event, based on triggers and conditions you define. These automations execute the logic you configured; we do not use your personal data to make automated decisions about you that produce legal or similarly significant effects without your involvement, and every workflow is one you build, review, and can disable at any time.

21. Third-Party Websites and Services

The Service may contain links to third-party websites or integrate with third-party services that are not operated by us. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of any third-party service before connecting it to Overten or providing it with information.

22. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes via email or through the Service, and will update the "Last updated" date above. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

23. Contact Us

For privacy-related questions or requests:

Email: info@lslgroupinc.com
Company: LSL Group INC
Address: 1111B S Governors Ave STE 20111, Dover DE 19904, USA

Overten is a product of LSL Group INC, 1111B S Governors Ave STE 20111, Dover DE 19904, USA.