Oprativ Privacy Policy

Oprativ is built local-first. The knowledge the product holds about your business lives on your computer or your own private hosted space. When a task needs a frontier model, only the excerpt needed for that task travels — through a zero-data-retention pipe: processed in memory to produce your answer, never stored, never used to train. Our own systems handle accounts, licences, payments and the website.

• Account data — name, email, hashed credentials (contract).
• Licence and subscription data — plan, licence key (hashed), device activation counts, subscription state (contract).
• Payment data — handled by Paddle, our merchant of record; we receive transaction status and invoicing metadata, never your card details (contract; Paddle is an independent controller for payment processing — see Paddle's privacy policy).
• Support correspondence — what you send us (legitimate interests).
• Website basics — server logs, security and rate-limiting data, IP-derived approximate location (legitimate interests: security, fraud prevention).
• Waitlist — email, consent timestamp, source page (consent; withdraw any time via the unsubscribe link or by emailing us).
• Product telemetry — opt-in only, and content-free by design (feature usage counts, crash reports); never your documents, messages, or business records (consent).

No selling personal data. No advertising use. No training AI models on your business content.

When you use AI features, the specific text needed for the task is sent to the AI provider your setup routes to (or the local model, which sends nothing anywhere). Providers used via our capacity operate under zero-data-retention arrangements where offered; if you bring your own keys, your provider agreement governs. The product's design keeps this under your control and visible.

The third parties that process data on our behalf, each under data-processing terms: Vercel (website hosting), Supabase (authentication and database), Resend (transactional email), and GitHub (release/download infrastructure). Paddle processes payments as our merchant of record and is an independent controller for payment data, not our subprocessor (see Paddle's privacy policy). We keep this list current.

Where a subprocessor operates outside the UK/EEA, we rely on an adequacy decision where one applies, or otherwise on the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum.

We set only the essential cookies needed to keep you signed in — no analytics, advertising, or cross-site tracking cookies. Nothing on this site tracks you across the web.

account and licence data for the life of the subscription + up to 6 years (tax/legal); waitlist until launch cohort communications end or you withdraw; support mail 2 years; logs ≤ 90 days.

access, rectification, erasure, restriction, portability, objection; complain to the ICO (ico.org.uk). Email hello@oprativ.ai — we respond within a month.

Oprativ is a business tool for adults; we don't knowingly process children's data.

material changes notified by email/in-product; this page is versioned.