Effective date: October 8, 2026
This policy describes the Google account integrations of Chief OpenClaw, a private assistant operated by B Whitlock, PLC / Whitlock Cosmetic Center. It is separate from the practice’s patient privacy notices and the WCC Chief Finance integration.
Information accessed
Depending on the permissions granted and the task, Chief may access account identity and email address; Gmail message content, metadata, labels, and attachments; Calendar events and calendar metadata; and Drive files, contents, and metadata. Connected accounts are authorized separately.
Use of information
Information is used to perform the account holder’s authorized tasks, including email organization and summaries, calendar management, document search and organization, internal reporting, and executive-assistant workflows. Write operations depend on granted permissions and user instructions.
Processing and sharing
Chief runs on operator-controlled systems and communicates with Google APIs. Relevant task content may also be processed by configured AI service providers, including Anthropic, and included in owner-authorized notifications through Telegram. These providers process information under their applicable terms and settings. The operator and specifically authorized personnel may access task records for operation, review, or troubleshooting.
The operator permits Google user data to be used only for authorized assistant functions, not for sale, advertising, or training generalized AI models. Any transfer of Google user data must comply with Google’s applicable user-data policies.
Chief OpenClaw’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and applicable Google Workspace API policies.
Storage and security
Google OAuth credentials are stored in encrypted credential files on the operator-controlled computer. Retrieved content, reports, task history, and work products may be stored separately in local files or authorized connected services. Encrypted credential storage does not mean every report or work product is encrypted. Access to these systems must be restricted to authorized users.
Retention, deletion, and revocation
Stored task records and work products may remain until the operator deletes them, subject to operational and applicable recordkeeping needs. Revoking Google access stops future authorized API access but does not automatically delete previously saved copies. Request deletion of retained integration data by contacting the address below; the operator will identify applicable copies and any retention limits. Connected providers may retain their own records under their policies.
You can revoke authorization in Google Account third-party connections.
Contact
B Whitlock, PLC / Whitlock Cosmetic Center
Tulsa, Oklahoma
chiefofstaffwcc@gmail.com