Privacy Policy

Effective October 7, 2026

1. Scope

This policy describes what personal information Opsynth collects from users of Opsynth Desk, and from people who contact us through the forms on opsynth.co, how it is used, and who it is shared with. By using the Service you consent to the data practices described below.

2. Information we collect

Account information. Email address, display name, and organization affiliation, provided when you sign up or connect Microsoft.

Content you provide. Bills of materials, vendor records, contacts, quotes, projects, follow-ups, flowcharts, and any files or text you upload. This includes information about your suppliers and their employees that you or your team enter into the Service.

Mailbox metadata (with your consent). When you connect Outlook, we access message headers (sender, recipient, subject, date), message text, and calendar / contacts data via Microsoft Graph. When the scanner is enabled, the text of each new message is sent to Anthropic Claude to classify it and write a short summary; we keep that summary and the message headers, not the raw message body. We do not train models on your mailbox content.

Website forms. When you use the contact, design partner or waitlist form on opsynth.co, we collect what you enter: your name, work email, company, role, team size, email platform, the product and plan you're interested in, and your message. We store it in our application database and email it to our sales inbox, and use it only to reply to you and, if you joined the waitlist, to set up your account. We do not store your IP address with it. Askprivacy@opsynth.co to delete it.

Usage information. Log data such as IP address, browser type, pages viewed, and error reports, collected via server logs, Cloudflare, and Sentry.

Payment information. Payment card details are collected and processed by Stripe. Opsynth does not store your full card number.

Cookies. We use strictly necessary cookies for authentication (Cloudflare Access, Clerk) and a small number of first-party localStorage keys for user preferences (theme, session flags). No third-party advertising cookies.

3. How we use your information

• Provide, operate, and maintain the Service.
• Classify and summarize inbox messages when the scanner is enabled.
• Draft a project charter from a brief you write, and turn an SOP you upload into a flowchart, when you ask for either.
• Reply to inquiries and waitlist signups sent through opsynth.co.
• Send transactional emails (billing receipts, coverage assignments, digests).
• Diagnose errors, prevent abuse, and secure the Service.
• Comply with legal obligations.

4. Third-party processors

Opsynth shares data with the following processors to deliver the Service. Each is bound by its own privacy commitments and a data processing agreement (DPA) where required:

• Cloudflare — authentication (Cloudflare Access), CDN, DNS. May process IP and connection metadata.
• Railway — application hosting. Processes all Service data at rest.
• Vercel — frontend hosting + edge network.
• Microsoft Graph / Azure — Outlook OAuth, mailbox scan, calendar, contacts. Governed by Microsoft's own privacy terms.
• Anthropic (Claude) — classifying and summarizing inbox messages, drafting a project charter from your brief, and turning an uploaded SOP into a flowchart. Content sent to Anthropic is not used to train their models per Anthropic's API terms.
• Stripe — payment processing. Governed by Stripe's own privacy terms.
• Clerk — user authentication and session management (production sign-up).
• Sentry — error monitoring. Configured with PII redaction and does not receive customer content.

We do not sell your personal information. We do not share personal information with advertising networks.

5. Data retention

We retain your account and Customer Content for as long as your account is active. On account deletion (Settings → Data → Delete workspace), all rows scoped to your workspace are hard-deleted from the primary database immediately. Backups containing the data may persist for up to 30 days as part of standard backup rotation.

Anonymized log data may be retained longer for security and operational analysis.

6. Your rights

You have the right to access, correct, export, or delete your personal information:

• Export. Settings → Data → “Download JSON” exports every row scoped to your workspace as a JSON file.
• Delete. Settings → Data → “Delete workspace” permanently deletes your workspace and every row inside it.
• Correct. Every field in the Service is user-editable from the surface where it appears (vendor names, contact details, project fields, etc.). Email privacy@opsynth.co if you need help.
• Access. Contact us for a full copy of information we hold about you beyond what the export includes.

If you are a resident of the EU/EEA, UK, Switzerland, or California, you have additional rights under GDPR, UK GDPR, and CCPA. To exercise these rights, contact privacy@opsynth.co.

7. Security

We use industry-standard measures to protect your information, including encryption in transit (TLS 1.2+), encryption at rest for production databases, strict access controls, and continuous monitoring via Sentry and Cloudflare. No system is perfectly secure; if you become aware of a vulnerability, please report it tosecurity@opsynth.co.

8. Children

The Service is not directed to children under 16. We do not knowingly collect information from children. If you believe we have collected information from a child, contact privacy@opsynth.co.

9. International transfers

Our processors operate globally. Your information may be processed in the United States, the European Union, or other countries. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced by email or in-app notice at least 14 days before they take effect.

11. Contact

Privacy questions or rights requests:privacy@opsynth.co. Product support: support@opsynth.co.