Original Factor Privacy Policy

Effective date: 29 September 2026
Last updated: 29 September 2026

Who we are

Original Factor ("OGF") is software for independent service providers, such as makeup artists, hair stylists, photographers and home-service professionals ("providers"). It helps providers show their work, answer customer enquiries, build quotes, and take bookings and payments. If a provider chooses, it also lets them read and answer their customers' Instagram messages and comments, WhatsApp messages and email in one place, with each reply going back out in the same channel.

Original Factor is a product of Serwiz. Serwiz AI Inc. ("Serwiz", British Columbia incorporation number BC1499054) is a company registered in British Columbia, Canada, with its registered office at #250 – 997 Seymour Street, Vancouver, British Columbia V6B 3M1, Canada. Serwiz runs OGF. In this policy, "we" and "us" mean Serwiz. You can reach us about privacy at privacy@originalfactor.com.

This policy explains what personal information OGF handles, why, who else sees it, how long we keep it, and what you can do about it.

The short version

• We work for the provider. When you message a provider who uses OGF, we handle your messages only for that provider and only as they direct.
• Each provider's data is kept separate. We never mix one provider's customers or messages with another provider's.
• We never sell personal information, and we never use it for advertising.
• We never use providers' data or their customers' messages to train AI models, ours or anyone else's.
• An AI assistant helps the provider. It reads enquiries, drafts replies and suggests quotes. The provider reads every reply and presses Send; nothing is sent automatically. The first reply in each conversation says that an assistant helped.
• Replies come from the provider. Each reply goes back in the channel you used, from the provider's own Instagram account, WhatsApp number or email address. OGF brings you to its own pages only to accept terms and to pay.
• Payments are processed by Stripe. We never see or store your full card number.
• You can ask us to delete your data at any time. Copies of Instagram, WhatsApp and email messages that we hold for a provider are deleted within 30 days after the provider disconnects that channel or closes their account, or within 30 days after a valid request from you. See Deleting your data.

Who this policy covers

• Providers who have an OGF account, and anyone they let use it.
• Providers' customers. These are people who contact a provider through the provider's OGF page, Instagram, WhatsApp or email, and people who open a quote, terms or payment page that OGF shows on a provider's behalf. You do not need an OGF account for this policy to protect you.
• People who use OGF's own assistant to look for a provider.
• Visitors to originalfactor.com.

Who decides what happens to the data. For a provider's customers, the provider decides why and how their customers' information is used. We handle it for them, following their instructions and the promises in this policy. Some privacy laws call the provider the "controller" and us the "processor" or "service provider". Serwiz decides, and is the "controller", for providers' own account information; for what a customer gives OGF directly, such as an accepted quote and terms, payment records or an OGF account; and for people who use OGF's own assistant or website.

What we collect

From providers

• Account details: your name, email address, phone number, and records of your sign-ins. Sign-in runs on Amazon Cognito. One-time sign-in codes are stored only in scrambled (hashed) form.
• Your business and your page: business name, display name, tagline, bio, years of experience, contact phone and email, locations and service area, travel fees, availability, services, packages, add-ons, prices, policies (for example deposit, cancellation and rescheduling terms), brand colours, logo, and photos of you and your work.
• Licences and certificates you choose to add: the type, issuer, number, expiry date and a copy of the document.
• Material you give us to build your page: your website address and what is on it, price lists and other documents you upload, reviews you bring from other sites (the reviewer's public display name, the rating and the text, as shown on that site), and links to your social profiles.
• Accounts you connect:
  • Instagram or a Facebook Page, to build your page: your profile information, posts and media.
  • Google Calendar: your calendar events (times and titles) from the last 30 days and the next 365 days, so OGF can show when you are busy and add bookings.
  • Instagram, WhatsApp and email, for messaging: see Instagram, WhatsApp and email you connect.
  • For each connection we store an access key (a "token") that lets OGF act for you within what you allowed. Tokens are stored encrypted.
• How you use the assistant: your instructions, the drafts it writes, your edits and approvals, and a private profile of your writing style (for example how you usually sign off) so that drafts sound like you.
• Terms you accepted: which version, and when.
• Payment and billing: your plan, your billing history and the ID of your Stripe account. Stripe collects your identity and bank details directly, under its own agreement with you. We do not store your bank account or card numbers.

About providers' customers

• What you send and receive: messages, comments, photos and files sent to or from the provider, the time they were sent, and whether they were delivered or read.
• Who you are on that channel: your name or display name, your Instagram username and profile picture, your phone number or WhatsApp username, and your email address.
• What you need, as understood from your messages: for example the service, date, time, place, number of people, budget and style notes.
• Quotes and bookings: quotes sent to you, the terms you accepted (which version, and when), bookings, and deposit and payment status.
• Your choices: for example whether you agreed to receive WhatsApp updates or text messages, and when, or whether you unsubscribed from email.
• What the provider records: notes, tags, and dates such as a birthday or anniversary, if the provider chooses to add them.
• How you found the provider: the link, website or campaign tag that brought you to the provider's page.
• Reviews: the rating and text of any review you leave.

From people who use OGF's own assistant to find a provider

What you tell the assistant about your event or need, and your account details if you sign in. We share your request with providers who might take it. We do not share your name or contact details with a provider until you choose that provider or accept their quote.

Collected automatically

• Technical details: IP address, device and browser type, and records of sign-in sessions.
• Cookies: only the cookies OGF needs to work. They keep you signed in (4 hours), keep a guest conversation going (up to 7 days), remember a display setting (24 hours), and run a provider's booking widget on another website (24 hours). We do not use advertising cookies or third-party analytics trackers, on OGF itself or on the originalfactor.com website.
• Page statistics: visits to a provider's page, the referring website and campaign tags. These are shown to that provider.
• Error reports: when something breaks, we keep a technical report for 30 days. Our filter removes personal details from these reports where it can find them.
• Fonts and the payment script: OGF pages load fonts from Google Fonts, and payment pages load Stripe's script. Those services receive your IP address when your browser fetches them.

Why we use it

• To run the provider's business tools: showing the provider's page, gathering enquiries from every channel into one customer list, drafting replies, building quotes, scheduling bookings, taking deposits, and sending confirmations and reminders.
• To deliver the replies the provider sends back to you in the same Instagram chat or comment thread, WhatsApp chat or email thread you used.
• To keep OGF safe and working: signing people in, preventing fraud, spam and abuse, and finding and fixing errors.
• To bill providers for OGF.
• To send service messages, such as booking confirmations. We send marketing email only where it is allowed, and every marketing email has an unsubscribe link.
• To improve OGF: we look at how features are used, and at whether the assistant's drafts were sent, edited or thrown away. We do not use providers' data, the content of customers' messages, or data we receive from Google, Meta or Microsoft, to train AI models or to build profiles of people across providers.
• To meet legal duties and enforce our terms.

Where a law requires us to name a legal basis for using personal information (for example in the UK or the EU), we rely on: our contract with the provider, to run OGF for them; the provider's and our legitimate interest in answering enquiries, running bookings and keeping OGF safe; your consent, where we ask for it (for example, for text messages); and our legal duties.

How the AI assistant uses messages

What the assistant does. It reads enquiries and picks out the facts: who, what, when, where and budget. It suggests which of the provider's services fit. It drafts replies. It suggests quote lines and prices, worked out from the provider's own prices and terms. It helps build the provider's page from material they upload.

The provider stays in charge. The assistant only drafts. Nothing is sent to a customer until the provider reads the reply and presses Send. The assistant cannot confirm a price, discount, booking or payment on its own.

Replies are sent from the provider. Replies go out in the channel the customer used, from the provider's own Instagram account, WhatsApp number or email address. They come from the provider.

We tell customers an assistant helped. The first reply in each conversation includes one short line, such as: "Glow Studio's assistant here." You can always reach the provider as a person.

Which AI services we use. We use Google's Gemini models, through Google Cloud's Vertex AI, to read and draft. We use Google's text-embedding model to make messages searchable within a provider's own conversations. We also use TypeSafe's Jev model for short yes-or-no and choice questions, such as which of the provider's services fits a request. We do not send Jev any messages from Instagram, WhatsApp or email. We send these services only what the task needs. In the parts of OGF where we have tested it, phone numbers and email addresses that customers type are replaced with placeholders before the text reaches an AI model.

No training on your data. We do not use providers' data, messages from Instagram, WhatsApp, Gmail or any other email, or any data we receive from Google APIs, to train, fine-tune or improve AI models, ours or anyone else's. The AI services we use process the text only to give us an answer.

Private helpers that stay in the provider's account.

• A searchable index of the messages in the provider's conversations, so the assistant can find an earlier detail, such as the venue a customer mentioned last week.
• A private writing-style profile, so drafts sound like the provider. It is built only from text the provider writes in OGF that is not sent through Instagram, WhatsApp or email (for example, their page and their replies in OGF's own chat). Messages sent or received through Instagram, WhatsApp or email are left out of it.

Both belong to that provider's account only. They are never shared with other providers, never used to train AI models, and deleted with the provider's account. The index entries for a customer's messages are deleted with those messages.

AI can be wrong. Drafts and suggestions can contain mistakes. That is why the provider reviews every reply.

Checking AI quality. We keep a record of what the assistant was asked and what it answered, in OGF's own systems, with contact details removed where our filter finds them, for up to 12 months, or less when a deletion request covers it. We use it only to find mistakes and keep the assistant safe, never to train AI models.

Instagram, WhatsApp and email you connect

This section applies only when a provider connects these accounts to OGF.

Official connections only. We connect through Instagram's official API (the provider signs in with Instagram), Meta's official WhatsApp Cloud API, Google's and Microsoft's official email permissions, and email forwarding that the provider sets up. We never ask for anyone's Instagram, WhatsApp or email password.

For that provider, and nobody else. We process each provider's messages only on behalf of that provider and at their direction. We keep each provider's messages and customer list separate from every other provider's. We never join the same person's records across different providers. We never share one customer's messages with another customer. We never sell this data, use it for advertising, or use it to train AI models.

Instagram. A provider can connect an Instagram professional (business or creator) account by signing in with Instagram. They allow OGF to see the account's basic profile, and to read and answer its direct messages and the comments on its posts. We then receive the account's direct messages, replies to and mentions in the provider's stories, comments on the provider's posts, and the sender's name, username and profile picture. When the account is first connected, we can read the latest 20 messages of each existing chat. After that we receive new messages and comments as they arrive, including replies the provider types in the Instagram app, so the conversation in OGF is complete. A reply to a comment is public on Instagram, like any other comment.

WhatsApp. A provider can connect their own WhatsApp Business number through Meta's WhatsApp Cloud API. The number stays theirs, and replies go out from it. If they keep using the WhatsApp Business app on their phone, messages they send from the phone are copied to OGF too. When connecting, a provider can choose to copy up to 6 months of past chats and their contacts into OGF. A business may send you WhatsApp messages only if you messaged them first or agreed to hear from them. You can stop messages at any time by blocking the business in WhatsApp.

Email. A provider forwards their business email to a private OGF address on originalfactor.com, so enquiries reach OGF. To send replies from their own address, they connect Gmail or Outlook (Microsoft 365). For that, OGF asks Google or Microsoft only for permission to send email as the provider. That permission cannot read the mailbox. We read only mail the provider forwards to us; we do not read the provider's Gmail or Outlook inbox.

What we store. The messages and comments; the photos and files in them (we copy these, because the platforms' links expire); the sender details listed above; and delivery and read status.

The platforms' own rules. Meta, Google and Microsoft also hold these messages, under their own privacy policies. Deleting data from OGF does not delete it from their services.

Google user data (Limited Use)

What we receive from Google, and why.

• Google Calendar, if a provider connects it: calendar events, to show when the provider is busy and to add OGF bookings to their calendar.
• Gmail, if a provider connects it: permission to send email from the provider's own address, so replies reach customers in the same email conversation, and the connected account's email address, so we know which address replies come from. This permission can only send. It cannot read the mailbox, and we do not read the provider's Gmail.

Our commitment. Original Factor's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain words:

• We use Google data only to provide and improve the features you can see in OGF, such as your calendar and your customer conversations.
• We transfer it to others only to provide those features, to keep OGF secure, to meet the law, or as part of a merger or sale of OGF (with the same promises). We do not transfer it for any other reason.
• We never use it for advertising. We never sell it or give it to data brokers or information resellers.
• Our staff do not read it unless you ask us to look at specific messages (for example, for support), it is needed for security, the law requires it, or the data has been combined and made anonymous for internal operations.
• We do not use Google Workspace data, including Gmail and Google Calendar data, to develop, improve or train generalized AI or machine-learning models. See the Google Workspace API User Data and Developer Policy.

You can remove OGF's access to your Google account at any time. See Revoking access to a connected channel.

Who we share it with

The provider. If you are a provider's customer, the provider sees your messages, your details, and your quotes and bookings.

Customers. If you are a provider, customers see your public page and the messages, quotes and terms you send them.

Companies that run parts of OGF for us. They may use the information only to provide their service to us.

When the law requires it, or to protect people. We may share information if the law requires it, to protect someone's safety, or to prevent fraud or abuse.

If OGF changes hands. If OGF is sold or merged, information may pass to the new owner, who must keep these promises.

Never for advertising. We never sell personal information. We never share it with advertisers or data brokers, and we never use it to target ads.

Payments

• Customers review quotes and accept terms on OGF's own pages. OGF brings a customer to its own pages only for this and for payment; everything else happens in the channel they used. The card payment itself is taken by Stripe, a payment processor, either on a secure Stripe payment page or in a Stripe payment form inside OGF's page. OGF never sees or stores your full card number.
• Payments go straight to the provider's own Stripe account. The money does not pass through OGF.
• Stripe's own privacy policy covers what Stripe collects.
• We never ask for card details in an Instagram, WhatsApp or email message. A payment request always links to an OGF page.
• Providers also pay OGF for their plan through Stripe.

Where your data is stored

OGF's main database is kept in Canada, with Amazon Web Services. Provider photos and files are stored with Google Cloud in the United States. Some information is processed in the United States and in other countries: by Google Cloud (AI), by Stripe and Twilio, and by Meta, Google and Microsoft when a provider connects their accounts. When information is processed outside Canada, our contracts with these companies require them to protect it, but it may be available to the courts, law enforcement and national security authorities of those countries.

How long we keep it

Your choices

If you are a provider

• Edit or remove your page, services, photos and customer notes in OGF at any time.
• Disconnect Instagram, WhatsApp, email or Google Calendar at any time.
• Ask us for a copy of your data by writing to privacy@originalfactor.com. We send it within 30 days.
• Close your account by writing to privacy@originalfactor.com from the email address on your account.

If you are a provider's customer

• Ask the provider to correct or delete what they hold about you, or ask us directly.
• Stop WhatsApp messages by blocking the business in WhatsApp. Stop marketing email with the unsubscribe link in the email. To stop other messages, such as text messages, tell the provider or write to us.
• Ask us what OGF holds about you, or ask us to correct or delete it.

For everyone

• Write to privacy@originalfactor.com. We will check that the request comes from you (we never ask for passwords), and we will answer within 30 days.
• If a request is about a provider's customer data, we will tell the provider and help them answer it.
• If you are unhappy with our answer, you can complain to the privacy regulator where you live. Because Serwiz is based in British Columbia, you can also complain to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.

Deleting your data

You can ask us to delete your data at any time, whether or not you have an OGF account. Our Data Deletion Instructions page explains exactly how to ask, what we delete, how fast, and what we keep and why.

Revoking access to a connected channel

A provider can remove OGF's access at any time, in OGF or in the other service. Menu names change from time to time.

• In OGF: open your settings and disconnect the account, or write to privacy@originalfactor.com and we will disconnect it for you.
• Instagram: in the Instagram app, open your settings, find the apps and websites connected to your account, and remove Original Factor.
• Facebook or Meta Business: in your Facebook settings, open Business Integrations and remove Original Factor.
• WhatsApp Business app: go to Settings > Account > Business Platform > Disconnect Account.
• Google: go to myaccount.google.com/connections (Third-party apps and services) and remove Original Factor.
• Microsoft personal account: go to account.live.com/consent/Manage and remove Original Factor.
• Microsoft work or school account: ask your organisation's IT administrator to remove Original Factor.

When access is removed, we stop receiving new messages from that account, and we delete the copies of customer messages that came through it within 30 days. If you remove access only in the other service, please also disconnect in OGF or write to us, so that we know to delete what we hold.

Security

• Access keys for connected accounts are stored encrypted.
• Sign-in runs on Amazon Cognito. Sign-in session keys and one-time codes are stored only in scrambled (hashed) form.
• Provider photos and files are kept in private storage and shown through links that expire.
• We check that messages and notices from outside services really come from those services before we act on them.
• Only staff who need to, in order to support you, keep OGF secure or meet a legal duty, can see account data. Our staff open a provider's customer conversations only when the provider asks or agrees (for example, for support, or to check the assistant's drafts during our pilot), when security requires it, or when the law requires it, and we keep a record each time.
• No system is perfectly secure. If you find a security problem, please tell us at privacy@originalfactor.com. If a breach affects your information, we will tell you as the law requires.

Children

OGF is not meant for children under 13. Providers must be at least 18. If you believe we hold information about a child that we should not have, contact us and we will delete it.

Changes to this policy

We will post any change on this page and update the date at the top. If a change is significant, we will tell providers by email or in OGF before it takes effect.

Contact

Privacy questions and requests: privacy@originalfactor.com. The person responsible for privacy at OGF reads this address.
Other questions: support@originalfactor.com