Legal
Privacy Policy
1. What this policy covers
Oshoma Systems LLC (Oshoma, we) builds and operates governed multi-agent systems. This policy describes how we handle data in three places:
- This website, oshomasystems.com (Section 2).
- The n8n_Oshoma application, a private workflow-automation deployment that accesses Google APIs on behalf of the account that authorized it (Section 3).
- Products we build and operate for clients, including Tonantzin, Voz Inbound, Voz Outbound, and Amaru Operative (Section 4).
Clean Slate of Washington is a separate company that licenses technology from Oshoma Systems LLC. Its services are governed by its own privacy policy, published on its own website, not by this one.
2. This website
The website is a static page. It has no accounts, no forms, and no login. The only ways to contact us from it are a mailto link and a telephone link, both of which open software on your own device.
What we collect
We do not run analytics, advertising, or tracking scripts on this site, and we do not set cookies of our own.
Hosting and network provider
The site is served by Cloudflare, which acts as our hosting and content delivery provider. In the course of delivering the page Cloudflare processes standard connection data such as your IP address, user agent, and the pages requested, and applies its security services, which may set a small number of Cloudflare security cookies and insert scripts that protect the site from automated abuse and that obscure our email address from scrapers. Cloudflare processes this data under its own privacy policy. We do not receive personal data from it beyond aggregate traffic counts.
If you email or call us
If you write to or call us, we keep your message and contact details for as long as needed to respond and, if a working relationship follows, for the duration of that relationship and any period required by law.
3. The n8n_Oshoma application and Google user data
n8n_Oshoma is a private workflow-automation deployment operated by Oshoma Systems on a self-hosted n8n instance at n8n.oshomasystems.com. It is not a public product. It is used by the operator to automate their own workflows and is not offered to, marketed to, or made available for sign-up by the general public. This section describes how the application accesses, uses, stores, and shares data obtained from Google APIs.
3.1 What Google data the application accesses
When you authorize the application, Google asks you to grant specific permissions (scopes). The application requests only the scopes listed below, and only accesses data belonging to the Google Account that granted them.
| Gmail messages (read and send) | Reads message metadata and content in order to classify, extract, and route information into automated workflows. Sends messages on the authorizing user's behalf when a workflow is configured to do so. |
|---|---|
| Google Sheets and Docs (read and write) | Reads spreadsheet and document content as workflow input, and writes results back into files owned by the authorizing user. Results include records, summaries, and status updates. |
The application does not access Google data belonging to anyone other than the account that granted authorization.
3.2 How the data is used
Google user data is used solely to provide the automation features the authorizing user has configured. Specifically, the application does not:
- sell, rent, or trade Google user data;
- use Google user data for advertising, ad targeting, or audience building;
- use Google user data to train, fine-tune, or otherwise improve generalized artificial-intelligence or machine-learning models;
- transfer Google user data to data brokers, information resellers, or any other party for independent use;
- allow humans to read Google user data, except with the authorizing user's explicit consent for a specific message or file, where necessary for security purposes (such as investigating abuse), to comply with applicable law, or where the data has been aggregated and de-identified.
3.3 Limited Use disclosure
The application's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
3.4 Storage and retention
Credentials. OAuth access and refresh tokens issued by Google are stored in the credential store of the self-hosted n8n instance, encrypted at rest using n8n's configured encryption key. Tokens are used only to make API calls on the authorizing user's behalf.
Content. Message and document content is processed transiently in the course of a workflow run. Where n8n retains execution data for logging or debugging, that data resides on infrastructure controlled by Oshoma Systems and is subject to the instance's configured retention window. No copy of Google user data is maintained beyond what the configured workflows require.
Location. The application runs on private server infrastructure controlled by Oshoma Systems. Data is not stored on third-party analytics, advertising, or data-enrichment platforms.
3.5 Sharing with third parties
Google user data is not shared with third parties, except where a workflow the authorizing user has explicitly configured sends data to a service of their choosing, and except where disclosure is required by law. Where a workflow routes content through an external service, for example a language model or a storage provider, that routing is configured, and therefore known, by the authorizing user.
3.6 Revoking access
Authorization can be withdrawn at any time from the Google Account permissions page at myaccount.google.com/permissions. Revoking access immediately invalidates the application's tokens and ends its ability to read or write data. Stored credentials can additionally be deleted from the n8n instance on request to the contact address above.
3.7 Security
Access to the n8n instance is restricted to the operator and protected by authentication. Traffic to n8n.oshomasystems.com is served over TLS. Credentials are encrypted at rest. No security program is absolute, and no representation is made that the application is immune to compromise.
4. Products we build and operate
Oshoma builds products for specific client businesses and runs them on infrastructure we control. In each case the client business decides what the product does, who it talks to, and what it may publish or send. The client is the party responsible for its own customers' data; Oshoma processes that data on the client's instructions and under a written agreement with the client. If you are a customer of a business that uses one of these products, your relationship is with that business, and requests about your data should go to it first. We will assist the business in responding.
4.1 The products and what they process
| Tonantzin | Drafts social media posts for a restaurant or small food business from a prompt or photo the owner sends through a messaging app, and publishes to the business's social accounts only after the owner approves. Processes: the owner's messaging account identifier, the messages and photos the owner sends, the drafts and approval decisions, and the published post identifiers returned by the social platform. |
|---|---|
| Voz Inbound | An inbound AI receptionist that answers a business's phone line in multiple languages. Processes: the caller's phone number, the audio of the call and a transcript of it, and the information the caller chooses to leave, such as a name, a callback number, or the reason for calling, which is passed to the business. |
| Voz Outbound | A WhatsApp messaging assistant that answers messages and follows up with a business's clients who have opted in. Processes: the client's WhatsApp number and display name, the content of the conversation, and the opt-in record. |
| Amaru Operative | A strategy and drafting tool used by a political consultancy. Processes the material its users provide for analysis and drafting. It is not connected to voter files or to any consumer data source, and it does not send messages to the public. |
4.2 Approval before action
These products are built so that a designated person at the client business approves consequential actions before the system takes them. Tonantzin publishes nothing the owner has not approved. Voz Outbound messages only people who have opted in with the business. A record of each approval is kept so the business can see what was authorized and when.
4.3 Service providers
To operate these products we use service providers that process data on our behalf. Depending on the product, these include messaging and telephony platforms (Meta's WhatsApp Business Platform and Instagram Graph API, Telegram, Twilio), AI model providers that generate drafts, transcripts, or responses from the content supplied, and database and hosting providers (Supabase and Hetzner). Each provider processes data only to provide its service to us. We do not permit providers to use client or end-customer data for advertising or to build profiles.
4.4 Automated decisions and AI
Drafts, transcripts, and conversational replies are generated by AI models. They are reviewed by a person at the client business before anything consequential happens, as described in 4.2. We do not use client or end-customer data to train, fine-tune, or otherwise improve generalized AI models, and our agreements with model providers prohibit them from doing so with data we send.
4.5 Retention and deletion
Conversation content, drafts, call audio, and transcripts are kept for as long as the client business needs them to operate the product and to review what the system did, and are deleted when the client's agreement with us ends or earlier at the client's request. Operational logs used to monitor spend, errors, and system health are kept for a limited period and contain identifiers rather than full content wherever the design allows. A business or an individual can request deletion of data we hold by writing to the contact address above; we will act on the request directly where we are the responsible party and relay it to the client business where it is.
4.6 Meta platform data
Where a product uses Meta's WhatsApp Business Platform or Instagram Graph API, we access only the data needed to send and receive messages and to publish approved content on the client's own accounts, we use that data only to provide the product to the client, and we comply with Meta's Platform Terms and Developer Policies. To request deletion of data obtained through a Meta platform, email the contact address above with the account or phone number concerned; we will confirm deletion in writing.
5. General terms
5.1 Where data is processed
Oshoma Systems is based in Washington State, United States. We process data on servers in the United States and in the European Union operated by our hosting providers. If you are outside the United States, your data will be transferred to and processed in the United States.
5.2 Your rights
Depending on where you live, you may have the right to ask what personal data we hold about you, to have it corrected or deleted, to object to certain processing, or to receive a copy of it. Write to the contact address above. We will respond within the time required by applicable law and will not treat you differently for exercising a right. Where we act on a client's behalf, we will pass the request to the client and help it respond.
5.3 Children
Our website and products are not directed to children and we do not knowingly process data relating to anyone under 13. If you believe a child has provided data to us, contact us and we will delete it.
5.4 Security
We restrict access to systems and credentials to the people who operate them, serve traffic over TLS, encrypt stored credentials, and keep audit logs of actions taken on our infrastructure. No security program is absolute, and we do not represent that our systems are immune to compromise. If a breach affects your data we will notify you as required by law.
5.5 Changes to this policy
We update this policy when our products or practices change. The effective date at the top reflects the latest version. Material changes to how we handle Google user data or Meta platform data will be reflected here before they take effect.
5.6 Contact
Oshoma Systems LLC, Tacoma, Washington. oshoma@oshomasystems.com, (253) 319-3711.