Privacy Policy

Opsicom Holdings Pty Ltd (ACN 700 742 409) (“Opsicom”, “we”, “us”, “our”) runs the Opsicom platform at opsicom.com, app.opsicom.com and book.opsicom.com, and the Opsicom apps for iPhone, iPad and Android. Our registered office is in New South Wales, Australia.

We have chosen to follow the Privacy Act 1988 and the Australian Privacy Principles as if they applied to us, whatever our annual turnover.

Questions about this policy go to support@opsicom.com.

When we decide. If you sign up for Opsicom, work in an Opsicom workspace, or visit our websites, we decide how your information is used. We are responsible for it. In European and UK law this makes us the controller.

When we act for a studio. Studios and other businesses use Opsicom to store details about their own clients, agents, crew and suppliers, and the files they make for them. The business decides what goes in and why. We hold and process that information for the business and follow its instructions. In European and UK law this makes us the processor, and the business the controller.

If a business that uses Opsicom holds your details and you want to see, correct or delete them, ask that business first. We will help them answer you. You can also contact us.

We collect personal information only where we need it to run Opsicom. This includes:

We use personal information to:

• -Provide, run and improve Opsicom
• -Sign you in and keep accounts secure
• -Process payments and manage subscriptions
• -Send service emails: sign-in links, receipts, booking and delivery notices
• -Send product news, which you can opt out of at any time
• -Answer support requests
• -Measure which of our ads lead to sign-ups (section 6)
• -Understand how the product is used (section 6)
• -Detect and prevent fraud and unauthorised access
• -Meet our legal obligations

For people in the UK, the European Economic Area and Switzerland, our legal bases are: our contract with you (to provide the service), our legitimate interests (security, support, improving the product), your consent (analytics and advertising cookies), and legal obligations.

Opsicom has an assistant called Opsy and tools that draft captions and social campaigns. They use Anthropic's Claude models. Voice input to Opsy uses Groq for transcription.

• -When you ask Opsy something, we send your question and the workspace records needed to answer it, for example the projects, clients or invoices it looks up
• -When you draft a caption or campaign, we send the text and listing details used for the draft
• -When you speak to Opsy, we send the recording to Groq to turn it into text
• -Each night Opsy writes short suggestions for each workspace, such as overdue invoices or requests waiting for a reply. We send Anthropic the suggestion text, which can include a client or project name, and the workspace name

Apart from the nightly suggestions, these features only send data when someone uses them. Under their commercial terms, Anthropic and Groq do not use the data we send them to train their models. Data synced from Google or Microsoft calendars is never sent to an AI service.

If you connect a Google or Microsoft calendar, we access it only through Google's or Microsoft's consent screen and only with the permissions you approve.

• -We read the list of your calendars, and the events on the calendars you tick, so Opsicom can show when you are busy and avoid double bookings
• -For each event on a ticked calendar we store its time, title, location, description and a link back to it
• -Only you see those event details, in your own calendar view in Opsicom. Other people in your workspace only see that you are busy
• -If you turn on publishing, we create and update Opsicom bookings on the calendar you choose
• -When you untick a calendar or disconnect the account, we delete the stored events for it. Disconnecting also deletes the stored access tokens

Opsicom's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google or Microsoft user data for advertising, do not sell it, and do not let people read it except with your consent, for security, or where the law requires. We never send it to an AI or machine learning service and never use it to train AI models.

You can disconnect at any time from your calendar settings in Opsicom, from your Google account permissions, or from your Microsoft account's app permissions.

We do not sell, rent or trade personal information. We share it with:

• -Service providers that run parts of Opsicom for us, listed on our sub-processors page
• -Services you connect, such as Google, Microsoft, Xero and Meta
• -Law enforcement or regulators where the law or a court order requires it
• -A buyer or successor if Opsicom is merged, sold or restructured

The full list of providers, what each one does, what data it sees and where it is, is on our sub-processors page.

Workspace data is stored in Sydney, Australia, with our database provider (Supabase, on Amazon Web Services). Media processing also runs in Sydney.

Some of our providers are overseas, so personal information can be disclosed to recipients in the United States, the United Kingdom, New Zealand, Switzerland and the European Union, and for Vercel and Cloudflare, whichever of their worldwide locations is closest to the person using the service. We choose providers that protect information to a standard consistent with the Australian Privacy Principles, and for people in the UK, the European Economic Area and Switzerland we rely on the safeguards the law recognises, such as adequacy decisions and standard contractual clauses.

The apps use the same account and data as the web, so everything in this policy applies. A few things are specific to the apps:

• -Notifications: if you allow them, we store a device token to send alerts about bookings, messages and work from suppliers. You can turn them off in your device settings. The token is removed when you sign out or delete the app
• -Photos and files: the app only opens your camera or photo library when you choose to upload, and only reads the files you pick
• -Location: the app does not track your location. Analytics may derive a city-level location from your IP address
• -Advertising: the apps do not run the Meta Pixel and do not send sign-up events to Meta
• -Purchases: the apps do not sell subscriptions or storage

The controls we have in place today:

• -All traffic to and from Opsicom is encrypted with TLS
• -Our database, file storage and hosting providers encrypt data at rest
• -Row-level access rules in the database limit each person to the workspaces they belong to
• -Customer accounts sign in without a password: an emailed code or link, a passkey, or Apple or Google
• -The database is backed up daily, and the backups stay in Sydney
• -Payment and billing notifications from Paddle and Stripe are checked against their signatures before we act on them

No system is perfectly secure. If you think your account has been accessed without your permission, contact support@opsicom.com straight away.

If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and any other regulator the law requires.

• -Your account: kept while you use Opsicom. You can delete it in Settings in the app or the web, or at app.opsicom.com/delete-account. You have 30 days to change your mind. After that we delete your sign-in, remove you from your workspaces and anonymise your profile. Records you shared with others, such as messages and projects, stay in their workspace without your name
• -Files: files moved to the trash are permanently deleted 30 days later, or straight away if you empty the trash
• -Calendar events: deleted when you untick the calendar or disconnect the account
• -A whole workspace: deleting a workspace is not self-serve yet. Ask us at support@opsicom.com and we will delete it and confirm when it is done
• -Backups: deleted data can remain in database backups for a short time until they are replaced
• -Records we must keep by law, such as tax and payment records, are kept for as long as the law requires

You can ask us to:

• -Give you a copy of the personal information we hold about you
• -Correct information that is wrong, incomplete or out of date
• -Delete your personal information, unless the law requires us to keep it
• -Stop sending you marketing emails

If you are in the UK, the European Economic Area or Switzerland, you can also ask us to limit or stop some processing, to give you your data in a portable format, and you can withdraw consent at any time.

Send requests to support@opsicom.com. We will reply within 30 days. We may need to confirm who you are first.

If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. In the UK you can complain to the Information Commissioner's Office, and in the European Economic Area to your local data protection authority.

Opsicom does not make decisions about people by automated means that have legal effects or similarly significant effects on them.

Opsicom is not for people under 18. We do not knowingly collect personal information from children. If you think we have, contact us and we will delete it.

We may update this policy. We will post the new version here with a new effective date and, for material changes, tell account holders by email.

For privacy questions, requests or complaints: