Privacy Policy

1. Opright’s role

Opright acts as a business or controller for account administration, subscription billing, security, support, legal compliance, and operation of its own service. For customer, employee, job, invoice, and other business records a workspace submits, the workspace customer generally decides why and how that information is used; Opright processes it as a service provider or processor under the Data Processing Addendum.

If you are a customer or employee of a business using Opright, contact that business first about its records. Opright will assist the business with verified requests.

2. Information collected

• Account and business information: name, email, phone, authentication identifiers, workspace name, industry, time zone, role, permissions, and settings.
• Customer and work records: customer contact and service addresses, service requests, schedules, job notes, checklists, time entries, crews, estimates, invoices, payment status, expenses, and related communications.
• Files: company logos and support screenshots a user chooses to upload. Support screenshots may contain information visible in the image, so users should remove unnecessary sensitive details before uploading.
• Payments and subscriptions: plan, billing interval, transaction status, processor identifiers, connected-account status, invoice payment, refund, dispute, payout, and chargeback metadata. After a confirmed Checkout payment, the email supplied to Stripe can update the matching workspace customer and invoice contact record. This does not change an Opright account’s sign-in email. Stripe receives payment credentials and identity-verification information directly; Opright does not store full card or bank credentials.
• Automatic sales tax: when a business enables automatic calculation, its service addresses, service categories and line-item amounts are sent to Stripe Tax. Calculation results and payment/refund reporting records are stored with that business’s documents.
• Customer-page activity: service-request details, estimate package and upgrade choices, typed approval names, drawn signature strokes, accepted estimate revisions and snapshots, legal-consent versions, customer-portal actions, and secure link records.
• Communications: support tickets, messages, notification preferences, delivery status, and email addresses used for service notices. Business outreach records may include a public business contact, source website, industry, conversation or call notes, follow-up status, and opt-out status.
• Device, usage, and security data: IP-derived security identifiers, timestamps, browser or device information, optional app usage sessions when enabled, push-subscription details, request identifiers, error data, and audit logs. Basic device details are added to support only when the user chooses that option.
• Location-related information: service addresses may be sent to OpenStreetMap’s Nominatim service for geocoding and cached as coordinates. Opright does not currently collect continuous employee GPS or background location.
• Local storage: authentication state, install and interface preferences, workspace display state, and a local geocoding cache. See the Cookie & Local Storage Notice.

3. Sources

Information comes from account holders, workspace owners and members, customers using public or secure pages, connected providers such as Stripe, devices and browsers, and automated service/security logs. Workspace customers may import information they collected outside Opright. Opright may obtain business prospect contact details from public business websites, referrals, direct conversations, or contact lists with a documented source.

4. How information is used

• Provide, personalize, maintain, and troubleshoot Opright.
• Authenticate users, enforce roles and workspace separation, and prevent fraud or abuse.
• Create schedules, estimates, invoices, payment links, reports, notifications, and support conversations at user direction.
• Process subscription billing and connected-business payment events.
• Send requested or important service, billing, security, support, and legal messages.
• Send relevant business outreach with an unsubscribe control and maintain suppression records to honor opt-outs.
• Improve usability and reliability using limited operational information. Opright does not use workspace customer records to train general-purpose AI models.
• Meet legal obligations, enforce agreements, and establish or defend legal claims.

Business outreach and email tracking

Marketing email may use Resend open-tracking images and tracked links when the sender enables them. These can record an email open or link click and related message identifiers, timestamps, and provider-supplied network or device information. Email privacy features can make those measurements inaccurate. This is separate from browser cookies and the app usage preference.

Each marketing message includes an unsubscribe link. You may also reply asking us to stop or email support@mail.oprightapp.com. We retain a limited suppression record to prevent further marketing. Creating an account, requesting support, accepting an estimate, or paying an invoice does not automatically enroll you in a marketing list. Service messages can still be sent when needed to fulfill a request or account obligation.

5. AI-assisted help and drafts

Opright Guide uses approved product context for help. When an owner requests a record draft, the request and user-entered draft details, which may include customer contact information, are sent to OpenAI to prepare or revise that draft. The owner reviews the draft before saving. Limited customer search results are shown only in the current workspace and are not sent to OpenAI. Guide does not send stored customer lists, invoices, employee financial records, passwords, or full workspace databases to the writing service. Requests use the provider’s non-storage response setting; provider processing and abuse-monitoring retention may still apply. Users must not enter sensitive personal or payment credentials into an AI prompt.

6. When information is disclosed

Opright discloses information to the vendors on the Subprocessor List as needed to provide the service; to a workspace and its authorized users; to a connected payment provider; when a user directs an integration or external link; in a lawful business transfer; or when reasonably necessary to comply with law, protect people, investigate abuse, or defend rights.

Opright does not sell personal information for money and does not share personal information for cross-context behavioral advertising. Opright does not currently use targeted advertising.

7. Retention

• Active workspace data is retained while the workspace is active.
• After a verified workspace-deletion request, a 30-day recovery window normally applies. Production data is then deleted or de-identified, subject to the exceptions below.
• Encrypted backups may retain deleted data for up to 90 additional days before cycling out.
• Security and operational logs are normally retained up to 12 months.
• Support tickets and attachments are normally retained for two years after resolution.
• Billing, payment, tax, fraud-prevention, legal-consent, and dispute records may be retained up to seven years or longer when law or an active claim requires.
• Privacy-request records may be retained for three years to document compliance.

Actual periods may be shorter when information is no longer needed or longer when reasonably required by law, security, litigation hold, or an unresolved transaction.

8. Security

Opright uses administrative, technical, and organizational safeguards designed for the nature of the service, including encrypted transport, tenant-aware database controls, restricted server credentials, token hashing, request limits, signed file access, and audit records. No service can promise absolute security. See Security at Opright.

9. Your choices and rights

Depending on where you live and Opright’s legal obligations, you may request access, correction, deletion, portability, restriction, or an appeal of a privacy decision. Signed-in users can download a workspace export or submit a request from More → Legal & privacy. Anyone may email support@mail.oprightapp.com.

A submitted in-app request is recorded in the requester’s history and alerts an authorized Opright platform administrator so it can be reviewed. Status changes and requester-facing resolution notes appear in the app. Opright also sends the requester an email update when that user’s email-notification setting is enabled.

Opright may verify identity and authority, coordinate with the workspace that controls the record, and retain information that an applicable exception permits. Optional app usage analytics are off until you enable them in Privacy choices. They record signed-in session identifiers, account/workspace identifiers, and activity timestamps for usage reports; they do not record keystrokes or screen contents. Disabling them stops new usage-session collection on this browser. Global Privacy Control and Do Not Track signals keep these analytics off. Necessary security logs, legal acceptance records, job timers, and requested workspace features continue to work. This choice applies to this browser and does not remove previously collected records. Users can manage optional email and device notifications in More → Settings → Notifications. Required security, billing, support, and legal notices may still be sent.

10. Children and minors

Opright is a business service and is not directed to children under 13. Opright does not knowingly collect personal information directly from a child under 13. People under 18 may use a workspace only with an authorized adult’s direction and approval and may not activate paid billing or payment-provider accounts.

11. United States service

Opright is currently offered for U.S. businesses and uses U.S.-based or globally operated vendors. Information may be processed in the United States and other locations where listed providers operate, subject to contractual and legal safeguards.

12. Changes and contact

Material changes will be announced in the app or by account email when practical. The effective date and prior versions will be identified in this center.

Privacy questions or requests: support@mail.oprightapp.com.