Privacy Policy

Last updated: 2026-05-11.

This Privacy Policy describes how the Company ("OpsMax", "we", "us") collects, uses, and shares information when you use the OpsMax service (the "Service"). The Company's legal name and jurisdiction are pending entity formation — see the notice at the top of this page. The Service is offered globally and we comply with the GDPR, CCPA, and other applicable data-protection laws.

1. Information we collect

Account information. When you create an account, our identity provider (Clerk) collects your email address, authentication factors (password and/or third-party OAuth identifiers), and basic profile details you choose to provide.

Tenant content. Anything you place inside your OpsMax tenant — messages, contacts, documents, and what OpsMax makes from them, such as drafts and suggestions — is stored on our infrastructure and treated as your data.

Billing information. When you subscribe to OpsMax Platform or OpsMax Agency, our payment processor (Stripe) collects your payment-method details. We never store full card numbers.

Product analytics. On our public website we count page views and when a page is left, we count each read of a docs page and each join of the waitlist (by the plan chosen and the page it came from, never by email address), and we send error reports, all with PostHog, without cookies, and we do not record sessions. Inside the signed-in product we record page views and named product events; we never record sessions there either.

Operational logs. Our hosting provider (Vercel) records standard request logs (timestamp, IP address, request path) for the operation, security, and debugging of the Service.

Waitlist entries. If you join the waitlist, we collect your email address, which option you selected (OpsMax Platform or OpsMax Agency) and, for OpsMax Platform, whether you are starting fresh or already running on your own tools, and your answers to a short set of qualifying questions — your company's monthly business spend band and how many companies you run (both optional), team size, what runs your back office today, which area you want OpsMax to take on first (optional), and an optional indication that you would be interested in working with the OpsMax team. We also record which landing page your submission came from.

1a. The waitlist

We treat waitlist entries as a distinct category, because they belong to people who are not yet customers.

Why we collect it. Admissions, and only admissions. We admit in small batches sized to the onboarding capacity we actually have, and the answers you give are what let us decide which batch you belong in. If you selected the agency offering, your entry is recorded as a sales lead and routed to a scoping call rather than to the waitlist — it is not entered into the admissions pipeline.

Consent scope. When you join, we email you a confirmation link. Pressing the button on the page that link opens records your consent to transactional admissions mail only: your confirmation, your invitation when a batch opens, and arranging your intro call. It does not sign you up for a marketing list, and there is no marketing list to be signed up for. If you never confirm, your entry stays inert — it cannot be invited — and is deleted on the schedule below.

Processors. Two services email you: Clerk, when we send you an invitation to create an account, and our email provider, Resend, when we send you a confirmation. Our hosting and database services, listed in section 3, store your entry. No other service receives waitlist data. Waitlist entries are not exported, and the Service provides no way to download or bulk-copy them.

Retention.

• Unconfirmed entries are deleted after 90 days.
• Denied entries, and entries that never progressed, are deleted after 12 months.
• Entries that converted into accounts are retained as a record of how that account was admitted, for as long as the account exists.

Purging is run deliberately by our operator; nothing is deleted or retained by an automated schedule alone.

Deletion on request. Write to us and we delete your waitlist entry outright. If you were holding an unused invitation, we revoke it at the same time, so no copy of your address survives at our identity provider either.

2. How we use information

• to provide, maintain, and improve the Service;
• to authenticate you;
• to bill you for paid subscriptions;
• to communicate with you about your account and material changes to the Service;
• to detect, investigate, and prevent fraud, abuse, or violations of our Terms;
• to comply with our legal obligations.

We do not sell personal information. We do not use tenant content to train machine-learning models, and we never use email from a connected mailbox to train them (see section 3a).

3. Sub-processors

These are the outside services that receive your data so that OpsMax can run. This list names the services that receive data today. A service is added here before it receives any.

Services you connect are not on this list. When you connect an account you hold with another service, such as your email or your books, OpsMax reads from it and, only where you allow it, writes to it. That account and its terms are yours.

Each sub-processor is bound by a data-processing agreement appropriate to its role. International transfers are made under Standard Contractual Clauses or equivalent mechanisms where required.

3a. Email from a mailbox you connect

How we access it. OpsMax reads your email only after someone in your company connects a mailbox and approves it on Google's own consent screen. We ask Google for three things: permission to read your email, permission to manage drafts and send email, and your basic profile (your name and email address). We do not ask for permission to label, archive, or delete your email. The permission Google gives us is stored encrypted.

How we use it. We use your email only to run the features you see in OpsMax: sorting your inbox, summarising threads, finding bills and invoices for your books, and suggesting replies. A suggested reply is saved as a draft in your own mailbox. Nothing is sent until a person in your company presses send.

How we store it. For each thread we keep the sender's name and address, the subject, the date, a short excerpt, the number of messages, whether it is read or starred, and its labels. We also keep what we work out from it: its category, a summary, suggested tasks, what is at stake if it goes unanswered, and the text of a suggested reply. We do not keep whole messages or attachments. This is held in our file storage (the Vercel row above). When you disconnect a mailbox, we stop reading it, and you can ask us to delete what we hold for it.

How we share it. To sort a thread, summarise it, or suggest a reply, we send the parts of the email that feature needs to our AI model provider (the Anthropic row above). We do not sell your email data. We do not use it for advertising. We do not use it to decide credit or lending. We do not use it to train AI models. People at OpsMax do not read your email, except with your documented agreement, when it is needed for security (for example, to investigate abuse or a bug), or when the law requires it.

Google's Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

4. Your rights

Depending on your jurisdiction, you may have the right to:

• access the personal information we hold about you;
• correct or update inaccurate information;
• delete your account and associated personal information;
• request a copy of your tenant content in a machine-readable format (we fulfil the request; there is no self-serve export);
• object to or restrict certain processing;
• lodge a complaint with your local data-protection authority.

California residents have additional rights under the CCPA, including the right to know, the right to delete, and the right to opt out of "sales" of personal information (we do not sell personal information).

To exercise any of these rights, write to privacy@opsmax.ai. We will respond within the timeframes required by applicable law.

5. Data retention

We retain account information and tenant content for as long as your account is active. When you delete your account, we delete or anonymize your data within 30 days, except where retention is required by law (e.g., billing records).

6. Security

Your data is encrypted in transit, and our database provider encrypts the data it holds at rest. Keeping each company's records apart inside the database itself is not in place yet. Access by our own staff is kept to what their work needs.

7. Cookies and tracking

Our public website sets no analytics or advertising cookies and records no sessions. Our sign-in provider (Clerk) sets cookies that are strictly necessary for signing in, on the pages that load it. Inside the signed-in product those cookies keep your session, and our product analytics (PostHog) may keep an identifier in a cookie and in your browser's local storage so that the pages you use are counted against your account. We do not show a cookie consent banner.

8. Children

The Service is not directed to individuals under 16. We do not knowingly collect personal information from children under 16.

9. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be announced via the Service or by email to the address associated with your account.

10. Contact

For questions about this Policy or our handling of your data, write to privacy@opsmax.ai.