Privacy Policy
This policy explains how Opsey ("we", "us") handles personal data when you visit our website, request access to the platform, or use it. Opsey is operated by [legal entity name], [registered address], Malta, [company registration number].
1. Who is responsible for your data
For the information in this policy (website visitors, account holders and sign-up requests) we are the data controller. For the business data your organisation enters into Opsey (for example staff, sales, stock and guest feedback records), your organisation is the controller and we act as its processor, under the terms of our agreement with you.
2. What we collect
- Sign-up and account details: your name, work email, company name, chosen plan and number of locations, and your acceptance of our terms.
- Login and security data: login times and technical details needed to keep accounts secure.
- Billing details: when payments are switched on, billing is handled by our payment provider. We do not store full card numbers.
- Support messages: what you send us when you contact us.
- Platform data: the information your organisation enters or connects, such as staff records, rotas, sales and stock data, and feedback submitted by guests.
- AI assistant requests: the questions, text and photos you submit to the assistant, and the answers it returns.
3. Why we use it, and our legal basis
- To create and run your account and provide the platform (performance of a contract).
- To keep the platform secure and prevent abuse (legitimate interests).
- To send you service emails, such as your password link (performance of a contract).
- To bill you and meet tax and accounting duties (contract and legal obligation).
- To respond to your requests and improve the service (legitimate interests).
We do not sell personal data, and we do not use your platform data to advertise to you.
4. Who we share it with
We use trusted providers to run the service. They process data only on our instructions:
- Supabase for the database, authentication and file storage (hosted in the EU).
- Cloudflare to serve our website and app.
- Stripe for payments and invoicing, once enabled.
- Anthropic to power the AI assistant. Requests sent to the assistant are processed by Anthropic to produce a reply.
- Meta (Facebook and Instagram), only if your organisation connects its accounts to publish posts.
- Google Fonts to display fonts on this website; this means your browser contacts Google when the page loads.
We may also disclose data where the law requires it. Where a provider is outside the EU or EEA, we rely on appropriate safeguards such as standard contractual clauses.
5. How long we keep it
We keep account data while your account is active and for as long afterwards as needed for legal, tax and dispute purposes. Customer feedback contact details are deleted automatically after the retention period set by your organisation. When an organisation leaves, we delete or return its platform data in line with our agreement.
6. Your rights
You may ask to access, correct, delete or export your personal data, to restrict or object to certain processing, and to withdraw consent where we rely on it. If you are an employee or guest whose data sits in an organisation's account, please contact that organisation first. To exercise your rights with us, email hello@example.com. You also have the right to complain to the Office of the Information and Data Protection Commissioner (IDPC) in Malta, or to your local supervisory authority.
7. Security
We use access controls, encryption in transit and organisation-level data separation to protect your data. No system is completely secure, so please use a strong, unique password and tell us promptly about anything suspicious.
8. Cookies
This website does not use advertising or analytics cookies. The platform uses only the storage needed to keep you logged in and remember your preferences.
9. Changes
We may update this policy and will change the date above when we do. If a change is significant, we will tell account holders by email.
10. Contact
Questions about privacy: hello@example.com.