Privacy Notice

Version 2026-10-03 · Effective 2026-10-03

Who this notice covers

This website and the Octtopus application are operated by Octtopus, LLC. This notice applies to this website — the public Octtopus marketing pages and the waitlist application form — and to the Google user data the Octtopus application receives when a customer firm connects its Google Calendar, described in Google user data in the Octtopus app below. Other processing inside a customer firm’s own deployment is governed by the agreement with that firm.

It also applies to the data the Octtopus application receives from Meta when a customer firm connects its Facebook Page, Instagram professional account or WhatsApp Business number, described in Facebook, Instagram and WhatsApp data in the Octtopus app below. To ask us to delete your data, see How to request deletion of your data.

Octtopus, LLC, 2100 Ponce de Leon Blvd., Suite 1170, Coral Gables, FL 33134. splos@octtopus.us

What we collect

When you submit a waitlist application, we collect:

• • Your full name and business email address.
• • Your law firm’s name and website.
• • Your primary practice area or areas.
• • The conversation channels your firm uses today.
• • Your description of the intake problem you want to solve.
• • Optionally, your phone number, your monthly inbound lead volume, and the CRM or case-management system you use.
• • The fact that you accepted this notice, the version you accepted, and when.
• • If you gave one: whether you separately agreed to be called or texted at that number, the version of that permission, and when you gave it.

We do not ask for, and you should not send, confidential client information or case details through this form.

Why we collect it

We use this information to evaluate your application and to contact you about it. That means reading what you sent, understanding how your firm’s intake works, and replying about next steps. We do not sell it, and we do not use it for advertising.

Two separate permissions

Accepting this notice and agreeing to be called or texted are separate permissions, and we ask for them separately. Accepting this notice does not give us permission to call or text you.

• • Your phone number is optional. You can apply without giving one, and we will not treat a missing number as a reason to set your application aside.
• • A phone number on its own is not permission. We call or text only if you separately ticked the box agreeing to it. If you do not want to give phone-contact permission, leave the optional phone field blank and apply without it.
• • Those contacts are manual and about your application. A person at Octtopus, LLC places the call or writes the message, and it concerns the application you submitted — including any follow-up or a quote, where one is needed.
• • When we would call. We intend to call or text on weekdays, during business hours in your own local time.
• • You can stop it. Tell us to stop by replying STOP to a text, saying so on a call, or emailing us. Message and data rates may apply to texts you receive or send.

Initially we run no advertising or tracking pixels on this site, no newsletter, and no automated marketing sequences. We do not use robocalls, automated calls, or bulk SMS campaigns. If that changes, we will update this notice and, where a new permission is needed, ask for it separately.

Who processes it

We use a small number of service providers to operate this site. Each processes data only to provide its service to us:

• • Hosting and storage — our cloud hosting provider and our managed database provider store the site and your application record.
• • Bot protection — we use Cloudflare Turnstile, and we use it only to check that a form submission comes from a person rather than an automated script. To do that it may process technical signals about your network, browser, and device, including IP-related information. The verification token it issues is checked by our server and is not stored on your application record.

We do not sell waitlist application data, and we do not share it for third-party advertising.

How long we keep it

We keep a waitlist application for up to 12 months after your last interaction with us about it. If there was no interaction after you applied, we count from the date you applied.

If your firm becomes an Octtopus customer, the relevant information may instead be governed by the agreement with your firm and by the business records we are required or reasonably need to keep.

Google user data in the Octtopus app

A customer firm can connect its own Google Calendar so that the Octtopus assistant can offer a website visitor free consultation times and book the one the visitor chooses. This section explains exactly what Octtopus does with the data it receives from Google when a firm does that.

What we access, and why

• • Your list of calendars (calendar.calendarlist.readonly) — only to show you the calendars you own, so you can choose the one appointments are booked into, and to label the connection.
• • Free/busy information (calendar.events.freebusy) — only the start and end times of busy periods on the calendar you chose, to work out which times are free. We do not receive the titles, descriptions, attendees or any other details of your events.
• • Events on calendars you own (calendar.events.owned) — only to create the appointment event when a visitor books, and to move or delete that same event when the visitor reschedules or cancels. Octtopus reads back and changes only events it created itself.

What we store

• • The OAuth access and refresh tokens for the connection, encrypted (AES-256-GCM) before they are stored.
• • The identifier and name of the calendar you chose, and the account label of the connection.
• • For each appointment Octtopus books: the Google event identifier, the event link, the start and end time and the time zone. The times Octtopus last offered in a conversation are stored with that conversation.
• • We do not store your free/busy information, and we never read or store your other events.

How we use it, and who sees it

• • Google user data is used only to provide the scheduling feature you turned on in Octtopus.
• • To word the offer to the visitor, the free times are passed to the AI model that runs the conversation (Google Gemini or Anthropic Claude). Those providers process it only to generate that reply, under terms that do not allow them to use it to train their models.
• • We do not use Google user data to develop, improve or train generalized artificial-intelligence or machine-learning models.
• • We do not sell Google user data, use it for advertising, or transfer it to anyone else, except as needed to provide this feature, for security purposes, or to comply with the law.
• • People at Octtopus, LLC do not read Google user data, unless you ask us to in a support request, it is necessary for security purposes, or the law requires it.
• • The appointments are visible to your firm in its own Octtopus dashboard. The visitor receives the calendar invitation Google sends.

Disconnecting and deletion

• • You can disconnect Google Calendar at any time from Integrations → Calendar in the Octtopus dashboard. When you do, Octtopus revokes its access at Google and deletes the stored tokens.
• • You can also remove Octtopus’s access from your Google Account settings.
• • Appointment records Octtopus created stay in your dashboard as part of your firm’s records. To have them deleted, email splos@octtopus.us; they are also deleted when your firm’s account is closed, subject to the backup limits described under Your choices below.

Limited Use

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

Facebook, Instagram and WhatsApp data in the Octtopus app

A customer firm can connect its own Facebook Page, Instagram professional account and WhatsApp Business number to Octtopus, so that the Octtopus assistant can answer the messages people send to the firm there. This section explains what Octtopus does with the data it receives from Meta Platforms when a firm does that.

What we receive

• • From the firm that connects an account: the identifiers and names of the Pages, Instagram accounts and WhatsApp numbers it chooses to connect, and the access token Meta issues for that connection.
• • When someone sends a message to a connected account: their messaging identifier on that platform (a Page- or Instagram-scoped ID, or, on WhatsApp, their phone number), the text of the message, and when it was sent.
• • We process text messages only. Photos, voice notes, stickers and other attachments are ignored and are not stored.

Why we use it

• • Only to provide the service the firm turned on: replying to the message on the firm’s behalf, collecting the contact details and the description of the legal matter that the person chooses to share, booking a consultation in the firm’s calendar when the person asks for one, and showing the conversation and the resulting lead to the firm.
• • If the firm has connected a CRM or case-management system, the lead is also sent there.

Who processes it

• • To write each reply and to pick out the contact details from the conversation, the conversation text is passed to the AI model that runs the conversation (Google Gemini or Anthropic Claude). Those providers process it only to produce that output, under terms that do not allow them to use it to train their models.
• • Our hosting and database providers store it.

What we do not do

• • We do not sell this data, use it for advertising, or share it with data brokers.
• • We do not share one firm’s data with another firm.
• • We do not use it to develop, improve or train generalized artificial-intelligence or machine-learning models.
• • People at Octtopus, LLC do not read these conversations, unless the firm asks us to in a support request, it is necessary for security purposes, or the law requires it.

How we store it

• • Access tokens are encrypted (AES-256-GCM) before they are stored.
• • Each conversation and lead is stored in the account of the firm that received it and is visible only to that firm, in its own Octtopus dashboard.

How long we keep it

• • Conversations and leads are kept as part of the firm’s records while the firm’s Octtopus account is active, unless deletion is requested as described in How to request deletion of your data.
• • When a firm disconnects a channel, Octtopus stops receiving messages from it and deletes the stored access token.
• • When a firm’s account is closed, its conversations and leads are deleted, subject to the backup limits described under Your choices below.

Your choices

You can ask us for a copy of the application you submitted, ask us to correct anything inaccurate in it, ask us to delete it, or withdraw your agreement to calls and texts. Email splos@octtopus.us from the address you applied with, or tell us which firm the application was for. We may need to confirm who you are before acting on a request.

When you ask us to delete an application, we delete the active application record and any operational copies under our control, such as an email thread we exchanged with you about it. Two honest limits apply: our service providers’ systems and routine backups may retain copies until their normal retention cycles expire, and we may need to keep specific information where the law or a documented business-record requirement obliges us to.

How to request deletion of your data

If you messaged a firm that uses Octtopus — on Facebook Messenger, Instagram, WhatsApp or a firm’s website chat — you can ask us to delete the conversation and the contact details collected from it. Email splos@octtopus.us with:

• • the name of the firm you contacted;
• • the platform you used;
• • your username on that platform, or the phone number you wrote from on WhatsApp.

We may need to confirm that the conversation is yours. We will delete the messages, the conversation and the lead details within 30 days, confirm by email when it is done, and let the firm know. The backup limits described under Your choices apply.

If you are a firm, you can disconnect a channel at any time from Channels in the Octtopus dashboard. You can also remove Octtopus’s access from your Facebook settings (Business Integrations) or your Instagram settings (Apps and websites). To delete all of your firm’s data, email splos@octtopus.us.

For waitlist applications and Google Calendar data, see Your choices and Google user data in the Octtopus app above.

Security

Applications are stored in a database with no public or logged-in read path: access is limited to our authorized server-side systems using a privileged credential, authorized personnel, and the service providers described above. No system is perfectly secure, and we do not claim any certification or formal compliance status for this website.

Changes

If we change this notice, we will update the version at the top of this page. The version you accepted is recorded with your application.

Contact

Questions about this notice or about data you sent us: splos@octtopus.us, or Octtopus, LLC, 2100 Ponce de Leon Blvd., Suite 1170, Coral Gables, FL 33134.