Privacy Policy

1. Purpose and scope. Operaitor develops industrial AI software and aims to handle information carefully and transparently. This policy covers the Operaitor website, public AI demo and operational processing for invited company accounts. Contact: Operaitor; privacy questions can be sent to partner@operaitor.app.

2. Public demo and local choices. You can currently use the public website and public demo without an account. To offer a suitable default language, we determine the country associated with your IP address using a local database on our server, without an external location service. You can always change the language yourself. With your consent, the website may save your chosen language and display theme in your browser; this optional website storage is separate from the demo, which may save settings and progress locally. You can delete local data in your browser or withdraw consent for optional website storage; withdrawal does not affect past processing.

3. Information you provide. To answer a contact enquiry, we ask for your name, email address and message; company is optional. Demo prompts, images and document content may also be sent when you use those features. Use only non-confidential examples in the public demo, such as information already publicly available. You choose whether to provide contact information, but without your name, email and message we may not be able to respond. For invited company accounts, we process your email address and information needed for authentication and login verification, company or workspace membership, your role, and invitation or access details.

4. Technical information. Replit hosting and storage infrastructure, and related services, may process your IP address, request metadata and other technical security data needed to deliver the website and demo, manage capacity, protect systems and prevent abuse. For authenticated invited company accounts, we also process new operational telemetry in aggregate: aggregate metrics for requests, errors, latency, AI tokens, cost and outcomes, plus an aggregate session-duration measure to support focused recent-activity views. This new telemetry does not include prompts, document contents or IP addresses, and we do not use it to count anonymous unique visitors or track time spent by public visitors. Session identifiers are HMAC-derived, but that does not guarantee anonymity; an identifier is marked inactive after 15 minutes without activity and removed during periodic cleanup. The 15-minute inactivity mark is not an exact promise of physical deletion at that time.

5. Technical service providers. We use Replit for hosting, technical processing and storage, Anthropic to process relevant messages and images and generate AI responses, and SendGrid to deliver contact emails to partner@operaitor.app using your email as the reply address. Depending on the feature, content may be processed remotely through these services.

6. Purposes and legal bases. We use information to provide requested demo functionality, respond to enquiries and follow up where needed, and maintain security and prevent abuse. We process contact enquiries to take steps at your request or perform a contract where applicable. We rely on legitimate interests to respond to business enquiries, provide the requested public demo functionality, and protect reliability and security and prevent abuse. We use consent for optional website storage. The operational telemetry described for authenticated invited company accounts supports service operation, reliability, capacity management and abuse prevention.

7. Sharing. Information is shared with the technical providers described above only as needed for hosting, storage, AI processing, email delivery and service operation and security, and with competent authorities when legally required. The contact-form acknowledgement concerns handling your enquiry and is not marketing permission.

8. Retention criteria. We use purpose-based criteria: correspondence is kept while needed to handle or follow up on your request or meet legal obligations; local browser data remains until you delete it, and optional website data is removed when you withdraw consent; externally processed demo content is subject to the applicable provider's retention policy; technical security data is kept as needed for operation, security and legal obligations. Operational metrics for authenticated invited company accounts are retained for 30 days and periodically pruned. Session identifiers are removed through periodic cleanup after being inactive for 15 minutes; the inactivity threshold does not promise physical deletion exactly at 15 minutes. Ask partner@operaitor.app about deletion of a specific submission.

9. Your rights. Where applicable, you may request access, rectification, deletion, restriction of processing, object to processing or receive your data in a portable format. You may withdraw consent for optional website storage at any time; this does not affect processing already carried out. Contact us, and you may complain to the Autoriteit Persoonsgegevens or another local supervisory authority.

10. Automated decisions. The website and public demo support users; they do not make solely automated decisions with legal or similarly significant effects about you.

11. Transfers and updates. Technical providers may process information outside the EEA. Applicable safeguards depend on the provider and service; contact us for details about a particular processing route. We may update this policy and publish the current version here.