Privacy Notice

This Privacy Notice explains how OPIFIRM, trading as OPIFIRM ("we", "us"), collects and uses personal data when you visit our site or use the OPIFIRM service.

1. Our role

OPIFIRM is the data controller for personal data relating to account holders, workspace members and website visitors. Where you upload business records about your own customers, suppliers or employees into your workspace, you are the controller of that data and we act as a processor on your instructions.

2. Personal data we collect

• Account data — name, email address, password (hashed), phone number, country, company name, job role and workspace membership.
• Content you submit — records you create in the Service, including suppliers, customers, employees, documents and transactions.
• Support data — messages, attachments and correspondence you send us.
• Usage and telemetry — pages and features used, actions recorded in audit logs, timestamps and error reports.
• Device and connection data — IP address, browser and device identifiers, language and time-zone settings.

Card and bank details are never collected or stored by us; payment data is handled directly by Paddle, our Merchant of Record.

3. Why we use it, and our legal basis

• Creating and administering accounts and workspaces — performance of our contract with you.
• Providing, hosting and supporting the Service — performance of our contract.
• Security, fraud prevention and audit logging — our legitimate interest in keeping the Service and customer data safe.
• Service improvement and troubleshooting — our legitimate interest in maintaining and improving the product.
• Customer support — performance of our contract and our legitimate interest in responding to you.
• Marketing emails about our product — your consent, which you may withdraw at any time.
• Meeting accounting, tax and other legal duties — compliance with legal obligations.

4. Who we share data with

• Service providers and subprocessors — cloud hosting, database and email infrastructure providers who process data on our behalf under contract.
• Merchant of Record — Paddle, for sale of the product, subscription management, payments, tax compliance and invoicing.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where disclosure is required by law or to establish or defend legal claims.

We do not sell personal data.

5. International transfers

Our providers may process data outside your country, including outside the UK and EEA. Where that happens we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

6. Retention

We keep account and workspace data for as long as your subscription is active. After closure, data is retained for a limited recovery window (by default 30 days, extendable where your administrator has configured a longer retention period) and is then deleted or anonymised, except where we must keep records longer to satisfy legal, tax or accounting obligations.

7. Your rights

Subject to applicable law, you may request:

• access to the personal data we hold about you;
• correction of inaccurate or incomplete data;
• erasure of your data;
• restriction of, or objection to, certain processing;
• a portable copy of data you provided to us; and
• withdrawal of consent where processing is based on consent.

Contact opifirm.erp@gmail.com to exercise these rights; we aim to respond within one month. If you are in the UK or EEA you also have the right to complain to your local supervisory authority.

8. Security

We apply appropriate technical and organisational measures, including encryption in transit, row-level access controls that isolate each company workspace, role-based permissions, hashed credentials and audit logging of sensitive actions. No system is completely secure, so we also ask you to protect your credentials.

9. Cookies and local storage

We use strictly necessary cookies and browser local storage to keep you signed in and to remember preferences such as language, theme and default currency. We do not use advertising cookies. You can clear or block storage in your browser settings, though signing in will not work without the essential items.

10. Contact

OPIFIRM — opifirm.erp@gmail.com