Privacy Policy

1. Who we are

OpsMind Technologies Ltd ("OpsMind", "we") is registered in England & Wales under company number 16946193. Its registered office is 5th Floor, 167–169 Great Portland Street, London W1W 5PF, United Kingdom. We are registered with the UK Information Commission (formerly the ICO) under reference ZC166859. For anything in this policy, write to hello@opsmind-tech.com.

2. Our role

For visitors to our website, people who ask us for a demo, and the people who use OpsMind accounts, we decide how their personal data is used: we are its controller.

Businesses use OpsMind to answer their own calls and messages. For the data inside a customer's workspace (its callers, chat visitors, contacts, recordings, transcripts and messages), the customer is the controller and we process it only on the customer's instructions, as its processor under Article 28 UK GDPR and our Data Processing Agreement. If you called or messaged a business that uses OpsMind, that business's privacy notice applies, and you should contact it first; we will help it answer you.

3. What we process

• Account data: name, email, organisation, role, the IP address you sign in from, which version of our terms you accepted and when, and a log of account actions. You give us this when you sign up; if your organisation or a partner created your account, they gave us your name and email.
• Workspace data: agent settings, knowledge documents, phone numbers, call recordings, transcripts, chat and WhatsApp messages (including voice notes and images), leads and contacts. We process these for the customer, on its instructions.
• Billing data: plan, usage and billing contact. Payment cards are entered on Stripe's page; we never see or store card numbers.
• Technical logs: application logs on our server, kept up to 30 days. We mask phone numbers and email addresses in them; until that covers every service they can contain phone numbers, and they can contain message text.
• On our public pages (not inside the app) we count visits with our own analytics, run on our own server: no cookies, no advertising trackers, and nothing is shared with anyone else. It records the page, the referring site and a rough device and country, never your name, number or what you type.

You need to give us your name, email and organisation to have an account; without them we cannot provide the service.

4. Why we use it, and our legal basis

• To provide the service you signed up for: contract (Article 6(1)(b) UK GDPR).
• To keep the service secure, prevent abuse and fix faults: our legitimate interest in running a safe, working service (Article 6(1)(f)).
• To keep accounting and tax records: legal obligation (Article 6(1)(c)).
• We do not use customers' calls or messages to train AI models. To test changes to our voice agents before release, we keep a small set of past call transcripts with phone numbers removed and no audio.
• We do not make decisions about account holders based solely on automated processing that have legal or similarly significant effects. The AI agents in a workspace act on the customer's instructions.

5. Who receives data (sub-processors)

Our main server, which holds the application, the database and call recordings, is in Palestine (West Bank). We also use the providers below. This list is Annex 1 of our Data Processing Agreement. We email each workspace owner 30 days before we add or replace a provider.

When an agent looks up an address, the address is sent to the OpenStreetMap Foundation's Nominatim service, which handles it as its own controller in the UK and the Netherlands. Webhooks and integrations a customer sets up send data to the systems that customer chooses.

6. International transfers

We are a UK company, and personal data we handle is processed outside the UK:

• Palestine: our main server. No UK adequacy regulations cover Palestine. Until we offer hosting in the EU, we do not take on customers whose workspace data must stay within the UK or the EEA.
• United States: live voice (Google), phone and WhatsApp (Twilio), email (Resend), payments (Stripe), web search (Tavily). Where the provider is certified to the UK Extension to the EU–US Data Privacy Framework, UK adequacy regulations cover the transfer; the table shows which.
• Germany and the EEA: backups (Frankfurt), our phone switch, and Infobip. UK adequacy regulations cover the EEA.

Ask us at hello@opsmind-tech.com for details or a copy of the safeguard used for any provider.

7. How long we keep data

• Account data: for the life of the contract plus 6 years.
• Call recordings, transcripts and messages: for as long as the workspace exists. Nothing deletes them automatically yet, and single records cannot yet be deleted from inside the app; the owner can close the whole workspace in Settings, or we delete them when the customer asks us in writing.
• After a workspace is closed: its records are removed from the live system about 30 days later. The owner closes it in Settings, and service stops at once. Recording files are not yet removed by that step; we delete them on request. Backup copies expire within about 2 months.
• Technical logs: up to 30 days.
• Billing records: 7 years.
• Audit logs: at least 13 months.

8. Your rights, and how to complain

You can ask for a copy of your data, ask us to correct or erase it, to restrict or stop using it, or for a copy to take elsewhere. Write to hello@opsmind-tech.com. We reply within one month. Leads and contacts can be downloaded as a CSV from their pages in the app; other requests are handled by our team by hand.

If you are unhappy with how we handle your data, you can complain to us at the same address. We acknowledge a complaint within 30 days and tell you the outcome. You can also complain to the UK Information Commission (formerly the ICO) at ico.org.uk.

9. If you are in Palestine or Jordan

Most of our customers and their callers are in Palestine and Jordan. Jordan's Personal Data Protection Law No. 24 of 2023 applies to businesses that process data of people in Jordan. It relies mainly on consent, limits transfers outside Jordan, and gives individuals rights similar to those above. A customer that uses OpsMind for callers in Jordan is responsible, as controller, for its legal basis, its notices to callers, and the conditions for sending their data to the countries listed above. We will help with the information it needs. We are not aware of a general personal-data protection law in force in Palestine; we apply the standards in this policy there too.

10. Security

How we protect data, and its current limits, is described on our Security page.

11. Changes

We post changes here and update the effective date. When a change affects account holders, we ask them to accept the new version when they next sign in.

Questions about this document? Contact hello@opsmind-tech.com.

OpsMind Technologies Ltd · Registered in England & Wales · Company No. 16946193 · Registered office: 5th Floor, 167–169 Great Portland Street, London W1W 5PF, United Kingdom · Information Commission (ICO) registration ZC166859.