Connector
data practices.

Ordinary LLC stores registered client names and exact callback URLs; short-lived authorization requests and codes; hashed access and refresh tokens; and account grants containing selected scopes, building IDs, expiry, revocation and last-use time. Raw tokens are returned only during token exchange. Authorization requests expire in 10 minutes, codes in one minute, access tokens in 15 minutes, and grants and refresh-token families after 30 days. Expired records are removed asynchronously by MongoDB TTL indexes.

Depending on selected permissions, your agent receives authorized building labels, addresses and virtual numbers; access-rule labels, codes, schedules, expiry and use limits; readiness and activity records. The agent host receives tool responses and applies its own data policies. The connector does not expose forwarding phones, payment links or API key management.

Mutation audit records retain grant, tool, building, rule, request, operation, outcome and timestamp identifiers for 30 days. They omit codes, tool-input content and natural-language instructions. Service HTTP logs omit authorization headers and OAuth query/route parameters. Hosting providers may retain platform request metadata under their own policies.

You can disconnect an agent on the connections page. Disconnection stops current and future tokens; it does not delete entry rules or undo prior entry. Revoke rules separately. New scopes or buildings require new consent.