Skip to content
Free betaEvery module free while we build it with the first companies.Join the waitlist elsewhere
Operadox
EN
EnglishFrançais
Start free

Legal

Privacy

Effective date: [OWNER: launch date].

Who handles your information

Operadox is provided by [OWNER: legal entity name], at [OWNER: registered business address]. For privacy questions, copies of your data or rights requests, contact [OWNER: privacy contact email].

We are the controller of account, billing, support and service-security information: we decide why and how it is used. For personal information your company puts in its workspace, your company is the controller and we process it on its instructions to provide Operadox.

UK representative: [OWNER: provide name, UK address and contact email if required, or remove this line after documenting an applicable exception].

Calculator inputs

Inputs to the free calculator never leave your browser. Calculations run locally; those inputs are not sent to Operadox or any of the providers below. Saving a result in an account is a separate action that sends the result to your company’s workspace.

What we collect

  • Account information you or your company provide: email addresses, company profile, team invitations, roles and sign-in records. If you set a password, we store its hash.
  • Workspace information your company saves or imports: calculation results, job references, costs, hours, notes, reviews and settings. This may include personal information entered by your team.
  • Billing information: chosen plan, subscription status, payment references and referral records. Payment details are entered with Stripe; we do not store full card numbers.
  • Support information: messages and attachments you send us.
  • Partner list: if you ask to join the partner program on the partner page, your name, e-mail, main profile link, what you do and your optional message, kept to contact you at launch.
  • Technical information generated when you use the service: IP address, browser information, request times and security logs.

We receive these details from you, your company’s authorised users, service requests and payment-status updates from Stripe. An email address is needed for account access, and payment information is needed for a paid subscription. You can use the free calculator without an account or payment details.

Why we use it

We use information to run accounts and workspaces, process payments, handle referrals, send sign-in and service emails, answer support requests and protect the service.

Where UK GDPR applies to our controller activities, we rely on contract necessity when providing a service to an individual contracting with us; legitimate interests in serving company users, providing support and preventing abuse; and legal obligations for required financial records. Your company decides the lawful basis for personal information it puts in its workspace.

If your company chooses to contribute to peer benchmarks, we use its selected business figures to create grouped comparisons. Other companies see grouped figures, not your company’s individual records.

Providers that process data

  • Cloudflare (hosting and database): serves the website and app and stores account and workspace data; handles service requests and security information.
  • Stripe (payments): processes payment and billing details and returns subscription and payment-status information.
  • Resend (email): processes recipient addresses and email content to send sign-in links, invitations and service messages.
  • Anthropic (AI assistant): company-data AI answers from Operator (Free written support help uses no AI model), processes your question and relevant data from the asking company only. Another company’s data is not included.

Only use the AI assistant with information you are authorised to share. Its answers support your decisions; it does not make decisions with legal or similarly significant effects about individuals.

Authorised members of your company can see workspace information according to their access. We may also disclose information where the law requires it or where necessary to protect the service or legal rights.

[OWNER: confirm and state whether any personal information is sold or shared for advertising, and describe any required opt-out method].

Where information is processed

Providers may process information outside the UK, including in the US. [OWNER: list the actual processing countries and the UK transfer mechanism for each relevant provider, including any required transfer assessment]. Contact [OWNER: privacy contact email] to request details or a copy of applicable transfer safeguards.

Cookies and security

We use an essential session cookie to keep you signed in. It expires after 30 days or is cleared when you sign out. On your first visit we also set a first-party cookie (opx_src, 90 days) that remembers only which link or site brought you (for example a post’s tag or a search engine), so we know which channels bring sign-ups; it holds no name, e-mail or IP address, and visitors from the EEA, the UK and Switzerland do not get it. Visits are counted per day and per source, never per person. [OWNER: confirm the complete production cookie and browser-storage list, purposes and durations, and any consent choices required for non-essential use].

Access controls limit workspace access to authorised users. Keep sign-in links and account credentials private and contact us if you suspect unauthorised access.

Copies, cancellation and retention

You can export an individual result. Your company can request a full copy of its data at [OWNER: privacy contact email].

Nothing is deleted when you cancel or downgrade: existing data stays readable, and your new plan’s limits apply to adding more. Cancelling a subscription is separate from closing an account or requesting deletion.

After you request deletion or close an account, deleted data remains recoverable by your company for 30 days. During this period it is kept only for your recovery, and is not exploited by Operadox or any third party. After 30 days, it is permanently purged from our systems, including stored files and copies. Service-provider copies and backups must follow the same deletion deadline.

The exception is invoices and payment records that the law requires us to keep, generally for 5–10 years depending on the country. We keep those records only for the required legal period, separately from the active workspace, and do not exploit them or allow third parties to exploit them.

[OWNER: verify country-specific statutory periods and configure them before launch; verify provider and backup deletion within the same 30-day deadline. Set separate ordinary retention criteria for support messages, security logs, email records and AI prompts/outputs before launch.]

Your rights

Where UK GDPR applies, you can request access, correction, deletion, restricted use or a portable copy of your personal information, subject to the conditions and exceptions in the law. If we rely on consent, you can withdraw it at any time by contacting us.

You can object to processing based on legitimate interests. Contact [OWNER: privacy contact email] to exercise this right or any other privacy right. We may need to verify your identity. For information controlled by your company, contact it first; we assist it with requests.

You can complain to the UK Information Commissioner’s Office about our use of your personal information.

If the CCPA applies, California residents, including business contacts, may request to know, access, correct or delete personal information and exercise applicable sale/sharing opt-out and sensitive-information rights without unlawful discrimination. An authorised agent may act for you. Contact [OWNER: privacy contact email]. [OWNER: confirm CCPA applicability and add any required California disclosures and additional request methods].

Updates

We update this notice when our practices change and show the effective date above. We will tell account holders about material changes before using their information for a new purpose.

Demo workspace

The app preview uses illustrative local records. They are not customer records. Demo controls change only the displayed example; they do not save data to a server or create a customer account. Your calculator result is not imported into the demo workspace.

Accounts and subscriptions

Account connection, email sign-in links, server saving and subscription billing are not active in this preview. The disabled account form collects no email address. No payment information is collected here.

Website infrastructure

Ordinary hosting and security logs may be generated by the service hosting the website. The website and the application load Microsoft Clarity (heat maps and session recordings; customer records in the application are masked, and visitors from the EEA, the UK and Switzerland get its cookieless mode) and count visits per day and per source as described under Cookies.

Before launch

A final privacy notice will identify the legal seller, contact channel, processors, retention rules and applicable rights before account features are enabled. It will describe account data storage and the planned portability of customers’ own data. This draft does not claim legal completeness.