Privacy Policy

Section 1Introduction

This Privacy Policy (the "Policy") describes the practices of Oluri AI LLC, a Tennessee limited liability company with a principal place of business at 370 Mallory Station Road, Suite 503, Franklin, Tennessee 37067, United States ("Oluri," "we," "us," or "our"), regarding the collection, use, disclosure, and protection of information obtained in connection with Foreman by Oluri ("Foreman" or the "Service"), our website at oluriai.com (the "Website"), the application at app.oluriai.com, and any related products, features, or functionality.

Foreman is business software sold to companies. It is used by network hardware dealers to run quoting, purchasing, inventory, shipping and the accounting records that go with them. It is not a consumer product and is not offered to individuals for personal use.

The single most important fact in this Policy: all artificial intelligence processing performed by the Service runs on hardware that Oluri owns and operates in Nashville, Tennessee. Customer data is never sent to a third-party artificial intelligence provider, and is never used to train a model for anyone else. Section 7 describes this in detail.

Section 2Scope and Our Role

2.1 Who our customer is. Our customer is a company (the "Company"). The Company authorizes individuals to use the Service on its behalf ("Authorized Users"). An Authorized User's access is granted, controlled and revoked by the Company.

2.2 Two different roles. Oluri's role differs depending on the information involved:

• As a service provider or processor. With respect to Company Data (defined in Section 3), including accounting records synced from QuickBooks Online and the contents of the Company's business mailbox, Oluri acts on the Company's documented instructions. The Company decides what to connect, what the Service may do, and when to disconnect. Personal information belonging to the Company's own customers, vendors and contacts reaches us only because it is present in the Company's own records; the Company remains the controller of that information.
• As a controller. With respect to Account Data (defined in Section 3), such as the names and work email addresses of Authorized Users, billing records, and Website analytics, Oluri determines the purposes of processing and acts as a controller or business.

2.3 Individuals whose information appears in Company Data. If you are a customer, vendor or contact of a Company that uses Foreman and you wish to exercise rights over information about you, please direct your request to that Company. If you contact us directly at tyler@oluriai.com, we will refer you to the relevant Company or assist that Company in responding, as required by applicable law.

2.4 Where a written agreement controls. Where Oluri and a Company have entered into a written services agreement or data processing agreement, that agreement governs to the extent it conflicts with this Policy for the Company's Company Data.

Section 3Definitions

3.1 "Account Data" means information relating to the Company's account with Oluri, including Company name and address, the names, work email addresses and roles of Authorized Users, authentication data, billing and invoicing records, and support correspondence.

3.2 "Company Data" means data the Service accesses, receives, generates or stores on the Company's behalf through a Connected Service or through the Company's use of the Service, including accounting records, email content and attachments, inventory and serial number records, shipment records, and documents.

3.3 "Connected Service" means a third-party service the Company authorizes Foreman to access, specifically QuickBooks Online, a Microsoft 365 or Google Workspace business mailbox, and UPS and FedEx carrier accounts.

3.4 "Personal Information" means information that identifies, relates to, describes, or is reasonably capable of being associated with an identified or identifiable natural person, as defined under Applicable Privacy Laws.

3.5 "Applicable Privacy Laws" means privacy and data protection laws applicable to the processing described in this Policy, including the Tennessee Information Protection Act, the California Consumer Privacy Act as amended, other United States state consumer privacy statutes, and, where applicable, the EU and UK General Data Protection Regulation.

3.6 "Process" or "Processing" means any operation performed on information, including collection, recording, storage, retrieval, use, disclosure, erasure, or destruction.

Section 4Information We Collect

4.1Information the Company Provides Directly

Company legal name, business address and business contact details; the names, work email addresses and assigned roles of Authorized Users; authentication credentials for the Service; billing and invoicing information; and the content of support requests and correspondence with us.

4.2Information from QuickBooks Online

When the Company connects its QuickBooks Online company file, it does so through Intuit's OAuth 2.0 authorization flow. The Company signs in at Intuit and grants access; Oluri never receives or stores the Company's QuickBooks username or password.

Scope requested: com.intuit.quickbooks.accounting. In plain words, this is the accounting scope: reading and writing accounting records. Under this scope the Service accesses:

• Invoices and estimates, to know what has been quoted, what has been billed and what is outstanding;
• Purchase orders and bills, to know what has been ordered from vendors and what a part actually cost;
• Items and inventory, to know what is on the shelf and how it is described;
• Customers and vendors, to associate records with the correct trading partner;
• Reports, to compute margin and other operational figures.

The Service also writes accounting records within the same scope, so that work an Authorized User approves in Foreman (for example converting an approved quote into an estimate, or a confirmed order into an invoice) is recorded in QuickBooks without re-keying. Writes are initiated by actions taken by Authorized Users.

Records accessed under this scope may contain Personal Information about the Company's own customers, vendors and their staff, such as names, business email addresses, telephone numbers and billing or shipping addresses.

4.3Information from the Business Mailbox

When the Company connects a Microsoft 365 or Google Workspace business mailbox, it does so through that provider's OAuth authorization flow. Oluri never receives or stores the mailbox password.

The Service reads messages in the connected business mailbox, including message headers, message bodies and attachments such as purchase order PDFs, in order to identify requests for quote, extract part numbers and quantities, extract purchase order numbers from attachments, associate messages with the correct customer and deal, and determine which threads are awaiting a reply. Message content may contain Personal Information about the Company's correspondents.

The Service prepares draft replies. It does not send email to the Company's customers on its own. An Authorized User reviews, approves and sends every outbound message.

Google API Services Limited Use. Oluri's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Information obtained from Google APIs is used only to provide and improve the user-facing features described in this Policy, is not transferred to others except as necessary to provide those features or as required by law, is not used for advertising, and is not read by humans except with the Company's explicit permission, to resolve a specific support issue, for security purposes, or as required by law. Information obtained from Microsoft 365 is handled on the same terms.

4.4Carrier Account Information

The Company provides its own UPS and FedEx account numbers and API credentials. The Service uses them to request rates, generate shipping labels, and retrieve tracking and exception status. Shipment records include recipient names and delivery addresses supplied by the Company.

4.5Marketplace and Market Pricing Information

To support sourcing and pricing, the Service retrieves part availability and pricing information from dealer marketplaces and industry listings. This information concerns parts and prices. The Company's customer list, costs and accounting records are not published to those venues.

4.6Information Collected Automatically

When the Service or the Website is used, we automatically collect technical and operational information including IP address, browser and device type, pages or screens accessed, timestamps, referring URL, and diagnostic and error information. Within the application we log operational events such as sign-in activity, connection and disconnection events, and actions taken by Authorized Users, for security and auditability.

4.7Information Generated by the Service

The Service generates derived records from the information above, including drafted quotes and replies, computed margin figures, deal and purchase order records, inventory valuations, serial number records (including serial numbers read from photographs supplied by the Company), and search indexes used to retrieve the Company's own records.

Section 5What We Do Not Collect

Stating a scope we deliberately do not request is more useful than a general assurance, so:

5.1 Oluri does not request the QuickBooks Payments scope (com.intuit.quickbooks.payment).

5.2 Oluri does not process, store, or transmit payment card data. The Service does not accept card numbers, does not initiate card transactions, and does not move money. Foreman is invoiced to Companies directly and does not require a payment card on file.

5.3 Oluri does not collect precise geolocation from Authorized Users or their devices.

5.4 Oluri does not connect to, read, or store personal mailboxes. The Service is connected to the business mailbox the Company designates.

5.5 Oluri does not sell Personal Information for monetary or other valuable consideration, and does not share Personal Information for cross-context behavioral advertising, as those terms are defined under applicable United States state privacy laws.

5.6 Oluri does not use Company Data to train, fine-tune, or improve any model made available to any other customer or to any third party. Training that does occur is confined to the Company's own model and is described in Section 7.3.

Section 6How We Use Information

6.1 To provide and operate the Service. To organize customer email threads, identify and group requests for quote, price against actual recorded cost, draft quotes and replies for approval, extract purchase order numbers from attachments, maintain inventory and valuation records, generate carrier rates and labels, track shipments, surface sourcing options and market pricing, and write approved records back to the Company's accounting system.

6.2 To administer the account. To authenticate Authorized Users, apply the Company's role and visibility settings, provide support, and issue and collect invoices.

6.3 To secure the Service. To detect, investigate and prevent unauthorized access, abuse, and technical failure, and to maintain audit records of significant actions.

6.4 To comply with legal obligations, including tax and accounting recordkeeping, and to establish, exercise or defend legal claims.

6.5 To communicate with the Company about service changes, security matters, and billing. Marketing communications to business contacts are sent only where permitted by law and can be stopped by replying or by writing to tyler@oluriai.com.

6.6 Legal bases (EEA, UK, Switzerland). Where the GDPR or UK GDPR applies, we rely on: performance of a contract for Account Data necessary to provide the Service; legitimate interests for security, service integrity and business communications; compliance with a legal obligation for recordkeeping; and, for Company Data processed on a Company's instructions, the Company's own legal basis as controller.

Section 7Artificial Intelligence Processing

7.1 Where inference runs. All artificial intelligence processing performed by the Service, including the reading and interpretation of email, the extraction of data from attachments, the drafting of quotes and replies, and the retrieval of the Company's own records, is performed on computing hardware that Oluri owns and operates in Nashville, Tennessee.

7.2 No third-party AI provider. Customer data is not sent to any third-party artificial intelligence provider. This includes, without limitation, OpenAI, Anthropic, Google, and any other provider that would perform inference on infrastructure Oluri does not own. No such provider is a sub-processor of Oluri and none receives Company Data.

7.3 Training on the Company's own data. The Service fine-tunes a model on the Company's own records, including accounting records synced from QuickBooks Online such as invoice and vendor bill history, so that the quotes, prices and replies it drafts reflect how that Company actually does business. This training is confined to a single Company: the training data is stored separately for each Company, the resulting model serves only that same Company, and one Company's data is never combined with another's. Company Data is not used to train, fine-tune, or otherwise improve any model that is made available to any other customer or to any third party, and is not used to train any general-purpose or foundation model. Training runs on the same Oluri-owned hardware described in Section 7.1. Training data derived from Company Data is Company Data, and is retained and deleted on the schedule in Section 10 and on request under Section 11.

7.4 Human review of output. The Service produces drafts and computed figures. Outbound customer communications and movements of money are approved by a person before they take effect. The Service does not make decisions producing legal or similarly significant effects concerning an individual.

7.5 Accuracy. Automated extraction and drafting can be wrong. Figures, drafts and extracted values produced by the Service are working output for a person to review, not a substitute for the Company's own verification, and not accounting, legal or tax advice.

Section 8How We Share and Disclose

We do not sell Personal Information and we do not share it for cross-context behavioral advertising. We disclose information only as follows.

8.1 Within the Company. Company Data is visible to Authorized Users according to the visibility setting the Company chooses. A Company may allow all Authorized Users to see all quotes and deals, which is the default, or restrict each salesperson to their own. Owners always see all of it.

8.2 Connected Services the Company authorizes. The Service exchanges data with QuickBooks Online, the connected mailbox provider, and the Company's carrier accounts as necessary to perform the actions the Company has authorized. These are the Company's own accounts at those providers. Their handling of that data is governed by their own terms and privacy policies.

8.3 Sub-processors. As described in Section 9.

8.4 Professional advisors. Legal, accounting and tax advisors bound by professional confidentiality obligations.

8.5 Business transfers. If Oluri is involved in a merger, acquisition, reorganization, financing, sale of assets, or similar transaction, information may be transferred to the successor. We will use reasonable efforts to ensure the successor continues to process information consistently with this Policy, or to notify affected Companies of any material change.

8.6 Legal compliance and protection. We may disclose information where we reasonably believe disclosure is required by law, to respond to valid legal process, to enforce our Terms, to establish, exercise or defend legal claims, or to investigate or prevent fraud or a security incident. Where we are legally permitted to do so, we will notify the affected Company before disclosing its Company Data.

8.7 Aggregate and de-identified information. We may use and disclose information that has been aggregated or de-identified so that it does not identify a Company or an individual.

8.8 At the Company's direction. To any other party the Company explicitly directs.

Section 9Sub-processors

9.1 The complete list of sub-processors is short, and it is short on purpose:

9.2 No third-party artificial intelligence provider is a sub-processor of Oluri, and none receives Company Data.

9.3 Connected Services are not sub-processors. QuickBooks Online, Microsoft, Google, UPS and FedEx are services the Company already uses and separately contracts with. The Company authorizes Oluri to access the Company's own account at those services. We do not hand Company Data to them beyond what is necessary to carry out the actions the Company has authorized in its own account.

9.4 We will make a current list of sub-processors available on request at tyler@oluriai.com, and will provide notice of a new sub-processor that will process Company Data before it begins doing so.

Section 10Data Retention

10.1 We retain information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes and enforce our agreements. The periods are:

10.2 A Company may request earlier deletion at any time under Section 11. Where we are required to retain a record by law, we will retain only that record and only for the period required.

Section 11Disconnection and Deletion

11.1 Disconnecting a Connected Service. A Company may disconnect any Connected Service at any time from Settings inside the Service. On disconnection, the Service stops accessing that provider and the stored credential or access token for it is destroyed.

11.2 QuickBooks disconnection revokes at the source. When a Company disconnects QuickBooks Online, Oluri revokes the access grant with Intuit, rather than only ceasing to use it on our side. The authorization stops existing at Intuit and can be confirmed in the Company's Intuit account. A Company may also revoke the connection directly from within QuickBooks Online, which likewise ends our access.

11.3 Deletion. Every stored credential and connector token is encrypted at rest and can be destroyed on request or on account closure. A Company may request deletion of its Company Data by writing to tyler@oluriai.com from an Authorized User account with owner-level access. We will confirm the request, carry it out within a reasonable period, and confirm completion in writing.

11.4 What deletion does not reach. Deletion within the Service does not delete the Company's own records held at a Connected Service. Records in the Company's QuickBooks Online company file, its mailbox and its carrier accounts remain with those providers and are the Company's to manage. Backups are purged on the rolling schedule in Section 10, and records we are legally required to retain are retained for the period required.

Section 12Data Security

12.1 We implement and maintain administrative, physical and technical safeguards designed to protect information against unauthorized access, disclosure, alteration and destruction. Our measures include the following, stated specifically so they can be held to:

• Connector tokens and credentials are encrypted at rest using AES-256-GCM under a key specific to the Company they belong to;
• Disk-level encryption using AES-256-XTS on the volumes that hold customer data;
• Transport Layer Security (TLS) for data in transit between the browser, Connected Services and the Service; and
• Artificial intelligence inference on hardware Oluri owns, with no third-party artificial intelligence provider receiving customer data.

12.2 What we do not claim. Oluri is not SOC 2 certified, is not ISO 27001 certified, and is not PCI certified. Oluri maintains an internal security policy set modeled on the ISO 27001 framework; being modeled on a framework is not the same as being audited or certified against it, and we do not represent otherwise. We do not publish an uptime guarantee, a penetration testing cadence, or a continuous monitoring claim.

12.3 No method of transmission over the Internet and no method of electronic storage is completely secure. While we use commercially reasonable means to protect information, we cannot guarantee absolute security. The Company is responsible for maintaining the confidentiality of Authorized User credentials and for removing access when a person leaves.

Section 13Data Breach Notification

In the event of a security incident resulting in unauthorized access to, acquisition of, disclosure of, or loss of Personal Information or Company Data, Oluri will:

13.1 Investigate and contain the incident as promptly as reasonably practicable;

13.2 Notify the affected Company without undue delay, and in any event within the time required by applicable law, including within seventy-two (72) hours of becoming aware of a notifiable breach where the GDPR applies;

13.3 Notify applicable regulators where required by law;

13.4 Provide the affected Company with the nature of the incident, the categories of information involved, the likely consequences, the measures taken, and steps the Company can take; and

13.5 Cooperate with the Company in meeting the Company's own notification obligations to its customers or regulators.

Section 14Your Privacy Rights

14.1Rights of Companies and Authorized Users

A Company may, at any time: access and export the Company Data held in the Service; correct inaccurate Account Data; disconnect any Connected Service; request deletion of Company Data; and close its account. An Authorized User may request access to, correction of, or deletion of Account Data about them, subject to the Company's control of the account.

14.2Requests about Company Data

Where an individual's Personal Information appears in Company Data because it is in a Company's own business records, the Company is the controller. We will refer such requests to the Company and assist the Company in responding, as required by applicable law.

14.3Tennessee Residents

Under the Tennessee Information Protection Act you may have the right to confirm whether we process your Personal Information, access and obtain a copy of it, correct inaccuracies, delete it, obtain a portable copy, and opt out of targeted advertising, sale, and profiling that produces legal or similarly significant effects. Oluri does not engage in targeted advertising, sale of Personal Information, or such profiling. You may appeal a denial by writing to tyler@oluriai.com with the subject "TIPA Appeal."

14.4California Residents

Under the CCPA as amended by the CPRA, you may have the right to know what Personal Information we collect and the purposes for which it is used, to delete it, to correct it, to opt out of sale or sharing, to limit use of sensitive Personal Information, and not to be discriminated against for exercising these rights. Oluri does not sell Personal Information and does not share it for cross-context behavioral advertising. Much of the Personal Information we handle is processed as a service provider on a business customer's behalf; in that role we use it only to perform the services and not for our own purposes. Submit requests to tyler@oluriai.com with the subject "California Privacy Request." You may use an authorized agent, and we may require verification of the agent's authority.

14.5Other United States State Privacy Laws

Residents of states with comprehensive consumer privacy statutes, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware and Florida, may have rights to access, correct, delete, obtain a portable copy of, and opt out of certain processing of their Personal Information, and to appeal a denial. Oluri does not engage in targeted advertising, sale, or automated decision-making producing legal or similarly significant effects. Submit requests to tyler@oluriai.com.

14.6European Economic Area, United Kingdom and Switzerland

Where the GDPR or UK GDPR applies you may have rights to access, rectification, erasure, restriction of processing, objection to processing based on legitimate interests, data portability, withdrawal of consent, and to lodge a complaint with your supervisory authority.

14.7Response Timelines and Verification

We will respond within forty-five (45) days where required by the CCPA, one (1) month where required by the GDPR, or the timeline set by other Applicable Privacy Laws, and may extend once where reasonably necessary, with notice. To protect the security of the information, we will take reasonable steps to verify identity and authority before acting on a request, and will not ask for more information than is reasonably necessary to do so.

Section 15Children and Minors

The Service is business software sold to companies and is not directed to children. We do not knowingly collect Personal Information from anyone under the age of eighteen (18). If you believe a minor's Personal Information has been provided to us, write to tyler@oluriai.com and we will investigate and delete it as required by law.

Section 16International Data Transfers

The Service is operated from the United States and information is stored and processed on hardware located in Nashville, Tennessee. If a Company or an individual accesses the Service from outside the United States, information will be transferred to and processed in the United States, which may have data protection laws that differ from those of the originating jurisdiction. Where a transfer from the EEA, UK or Switzerland is subject to the GDPR, we will use an approved transfer mechanism, such as the Standard Contractual Clauses, where required.

Section 17Cookies and Similar Technologies

17.1 Marketing website. oluriai.com is a static website. It does not set advertising cookies and does not carry third-party advertising or social media tracking pixels.

17.2 Application. The application at app.oluriai.com uses strictly necessary cookies and similar storage to keep an Authorized User signed in, to maintain session security, and to remember interface preferences. These are required for the Service to function and cannot be switched off within the Service.

17.3 Managing cookies. Browsers can be configured to block or delete cookies. Blocking strictly necessary cookies will prevent signing in to the application.

Section 18Do Not Track and Global Privacy Control

Because we do not engage in targeted advertising and do not sell or share Personal Information for cross-context behavioral advertising, there is nothing for a Do Not Track or Global Privacy Control signal to opt out of. We honor such signals to the extent required by applicable law.

Section 19Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date and version above. If a change is material, we will notify the Company by email to an Authorized User with owner-level access, or by notice within the Service, before the change takes effect. Continued use of the Service after the effective date of a revised Policy constitutes acceptance of it.

Section 20Contact Us

Questions about this Policy, requests to exercise privacy rights, requests for a current sub-processor list, and requests to disconnect or delete data:

Oluri AI LLC
370 Mallory Station Road, Suite 503
Franklin, Tennessee 37067
United States
Privacy: tyler@oluriai.com
General: tyler@oluriai.com
Telephone: 636-248-7171

See also the Terms of Service, the security overview, and the integrations page, which describes exactly what each connection reads and writes and how to disconnect it.

End of Privacy Policy, version 5.1.