Oprativ Privacy Policy

Oprativ is built local-first. The knowledge the product holds about your business lives on your computer or your own private hosted space. We do not receive, store, or read your business content. Our systems handle accounts, licences, payments and the website — that's it.

• Account data — name, email, hashed credentials (contract).
• Licence and subscription data — plan, licence key (hashed), device activation counts, subscription state (contract).
• Payment data — handled by Paddle, our merchant of record; we receive transaction status and invoicing metadata, never your card details (contract; Paddle is an independent controller for payment processing — see Paddle's privacy policy).
• Support correspondence — what you send us (legitimate interests).
• Website basics — server logs, security and rate-limiting data, IP-derived approximate location (legitimate interests: security, fraud prevention).
• Waitlist — email, consent timestamp, source page (consent; withdraw any time via the unsubscribe link or by emailing us).
• Product telemetry — opt-in only, and content-free by design (feature usage counts, crash reports); never your documents, messages, or business records (consent).

No selling personal data. No advertising use. No training AI models on your business content.

When you use AI features, the specific text needed for the task is sent to the AI provider your setup routes to (or the local model, which sends nothing anywhere). Providers used via our capacity operate under zero-data-retention arrangements where offered; if you bring your own keys, your provider agreement governs. The product's design keeps this under your control and visible.

Supabase (database/auth — EU/UK-appropriate hosting), Vercel (website hosting), Paddle (payments, as merchant of record), Resend (transactional email), GitHub (software distribution infrastructure). Each under data-processing terms; list kept current here.

where a processor operates outside the UK/EEA, we rely on adequacy or standard contractual clauses.

account and licence data for the life of the subscription + up to 6 years (tax/legal); waitlist until launch cohort communications end or you withdraw; support mail 2 years; logs ≤ 90 days.

access, rectification, erasure, restriction, portability, objection; complain to the ICO (ico.org.uk). Email hello@oprativ.ai — we respond within a month.

Oprativ is a business tool for adults; we don't knowingly process children's data.

material changes notified by email/in-product; this page is versioned.