Optical

Privacy

How Bajanov Advisory Pty Ltd handles your data in the hosted trial of Optical.

Last updated: 24 October 2026

Who we are

Bajanov Advisory Pty Ltd (ABN 32 694 338 497) operates the hosted trial of Optical. You can reach us at info@optical-scheduler.com. The hosted trial is invitation-only: see the hosted trial page and the terms that apply to it. In this policy, “we” means Bajanov Advisory Pty Ltd and “the service” means the hosted trial of Optical.

What we access and why

You sign in with Google or Microsoft. The service asks only for the permissions below.

Google

  • userinfo.email: your email address, so we know who you are.
  • calendar.events: to write planned work blocks to your calendar, move them when things change and mark them done, and to read and move meetings you organise. To plan around the rest of your week, the service reads the events in the weeks it plans: their titles, times, organiser, attendees’ email addresses and replies, and the service’s own markers. It does not ask Google for event descriptions or locations.
  • calendar.freebusy: to check attendees’ free/busy before proposing a move of a meeting you organise. It sends their email addresses to Google and keeps only the answer, and only while it plans.
  • gmail.send: to send from your own address the weekly plan for you to accept, and poll, booking and cancellation notices to you and your invitees. It is send-only. The service never reads your mail.
  • Offline access: a refresh token, so the service keeps working when you’re not signed in.

Microsoft

  • openid, profile and email: who you are, taken from the sign-in token.
  • offline_access: so the service keeps working when you’re not signed in.
  • Calendars.ReadWrite: the same purposes as Google’s calendar.events, including free/busy. Microsoft’s change feed, which the service uses to keep up with edits, can’t be limited to those fields, so it also returns descriptions and locations; the service discards them without storing them.
  • Mail.Send: the same purposes as Google’s gmail.send. It is send-only. The service never reads your mail.
  • The service does not request User.Read. Your identity comes from the sign-in token, not from a profile lookup.

The scopes calendar.acls, gmail.readonly and Mail.Read exist only in our internal test setup. They are off in the hosted trial and never requested.

If you untick any permission on the consent screen, sign-in is refused and the partial grant is revoked. There is no reduced mode.

What we store

The service runs on Cloudflare Workers in Bajanov Advisory Pty Ltd’s Cloudflare account, with its own Cloudflare D1 database, KV and Durable Objects, kept apart from its other Optical deployments. The one part it shares with them is the solver that works out a plan: it is sent your tasks and the titles and times of the busy events it plans around, returns a plan, and holds no data afterwards. The D1 database’s primary location is Sydney, Australia (Oceania region). Cloudflare may process data outside Australia.

What the service keeps about you:

  • Your account: your email address, your Google or Microsoft account ID, your timezone and when you joined and last used the service.
  • Your tasks, templates, projects and settings, including your booking page. Meetings you organise are copied in as tasks: title, time and duration, without attendees.
  • Plans. A plan records the times it proposes and, for the days it changes, the titles and times of other events on your calendar, including invitations from other people. Plans you don’t accept are deleted within 72 hours. The titles of other events in an accepted plan are removed within a day of you accepting it.
  • People you book, invite or poll. For a booking: the booker’s name, email address, note and any phone number or address they give. For a poll: each invitee’s name, email address and the times they marked. Anonymous visitors to your booking page or a poll’s guest link are checked with Cloudflare Turnstile, which sees their IP address. We keep only a hashed form of it, to limit repeat attempts.
  • A security audit log of sign-ins, account changes and deletions. It has no IP addresses.

Operational logs, which can include your account email, are kept by Cloudflare for 7 days.

How we protect your data

  • In transit: every connection to the service, and from the service to Google, Microsoft and SMTP2GO, uses TLS.
  • At rest: Cloudflare’s database and KV storage are encrypted at rest. On top of that, your Google or Microsoft refresh token, and the short-lived access tokens cached from it, are encrypted with AES-GCM by the service itself, each with its own key held as a Worker secret. The cache is keyed by a hash, not your email address.
  • Hashed or signed, not stored: the service’s own access and refresh tokens, sign-in codes and poll invitation links are stored only as hashes. The links in plan and confirmation emails are signed and not stored at all.
  • Your token stays with the service: the service never gives your Google or Microsoft token to your assistant. Your assistant gets its own Optical token, which can only call Optical’s API.
  • Least access: every query is scoped to the signed-in user. Only the operator can reach the production systems, through accounts protected by multi-factor authentication with hardware keys, and deployment credentials carry only the minimal permissions that deployments require.
  • Minimal collection: the service never reads your mail, keeps no event descriptions or locations, and shows other people’s event titles to your assistant as “Busy”. Problem capture, debug logging and the internal test scopes are all off.
  • Breaches: if a breach is likely to cause you serious harm, we notify you and the OAIC under the Notifiable Data Breaches scheme, and notify Google or Microsoft where their policies require it.

How long we keep it

Your data is kept while you use the service, except the short-lived items described above. If there is no sign-in or use for 76 days, we send you one warning email. If there is still none, we delete your data once 90 days have passed with no activity, and never sooner than 14 days after the warning. Any activity resets the clock, including use through your assistant.

Deleting your data

You can have your data deleted at any time, two ways:

  • Ask your assistant. Ask it to delete your Optical account. It calls deleteAccount (DELETE /v1/account), which needs an explicit confirmation field.
  • Email us at info@optical-scheduler.com.

You can also remove Optical’s access yourself. For Google, go to Google Account → Third-party connections at myaccount.google.com/connections. For Microsoft, use account.live.com/consent/Manage for a personal account, or myapps.microsoft.com for a work or school account. This stops Optical’s access to your calendar and mail, but does not delete the data we hold. That is deleted at the 90-day idle sweep described above, when you ask us to delete it, or when you use the deletion endpoint above.

Deletion removes your tasks, templates, projects, plans, calendar sync state, booking page, bookings, scheduling settings, stored Google or Microsoft tokens, the service’s own access tokens, the KV cache and your per-user state. Upcoming work blocks the service placed on your calendar are removed on a best effort basis. Past blocks stay. When you delete through the service, we revoke the Google grant too. Microsoft has no per-service revoke, so remove Optical yourself at the links above: deletion erases the Microsoft tokens we hold, but the grant they were issued under stays in place at Microsoft until you remove it.

After deletion we keep a minimal record: a deactivated account record (your email address, role, and when you joined, last used the service, were sent a retention warning and deleted your account) and security audit log entries. We keep it for 30 days. After that the account record is deleted and the audit log entries no longer carry your email address.

The data deletion topic on the Trust page has more detail.

Who else processes it

  • Cloudflare hosts the service and runs its database and compute.
  • SMTP2GO sends mail from optical@optical-scheduler.com to you only: retention warnings and deletion notices, and, when your own mailbox can’t send, the email with a confirmation or plan-review link. It receives your address and the message. Those link emails carry no event titles.
  • Cloudflare Turnstile checks anonymous visitors to booking pages and poll guest links, as described above.

Plans, polls and bookings are sent from your own mailbox through Google or Microsoft, not through SMTP2GO.

People you invite, book or poll receive your email address (with the name on your Google or Microsoft account, if it has one) and meeting details, sent from your own mailbox or calendar.

We share your data with no one else, except the AI or MCP client you connect to Optical, at your request, or where the law requires it.

Your AI assistant

Optical runs no AI model itself and sends your data to no AI provider. You use it through an assistant you connect yourself, which receives your scheduling data only when you ask it to. The terms require that assistant not to use what it receives from Optical to train or improve AI models: a commercial plan that doesn’t train, or a consumer plan with model training turned off. They list the major assistants and where each one’s setting is.

What we never do

We show no ads and never sell your data. We never use it to train or improve AI or machine-learning models. People read your data only to give you support with your consent, for security, or where the law requires it.

Google user data

Our use of Google user data follows the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy.

Optical's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Your rights

We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). You can ask for access to the personal information we hold about you, and ask us to correct it. Write to the contact below.

If you have a complaint, write to us first. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Changes

If we change this policy, we update this page and its “Last updated” date.

Contact

Privacy questions, access and correction requests, and deletion requests: info@optical-scheduler.com.