Privacy Policy

This Privacy Policy applies when you visit opalefy.com, create or use an Opalefy account, use a website or workspace hosted by Opalefy, contact us, or submit information to an Opalefy form.

A customer’s published website may collect information under that customer’s instructions. The customer controls the questions it asks and is responsible for explaining its own data practices to visitors. This Policy describes Opalefy’s platform practices, not every customer’s independent privacy policy.

Opalefy is the service name used in this Policy. The legal entity operating the service, its registered address, and the privacy contact must be confirmed in the deployed legal notice.

Account information may include your first and last name, email address, password credential, account status, and email-verification or password-reset records. Opalefy uses account information to create and secure your account, sign you in, verify your email, and help you recover access.

Workspace and service information may include organization names and settings; member and role assignments; invitations; website names, addresses, pages, page designs, themes, settings, logos, favicons, custom-domain settings; assets; and content you create or upload.

If you use Opal AI, Opalefy processes the prompts, conversation messages, selected page or component content, attached documents, and generated output needed to provide the requested feature. Do not include confidential or sensitive personal information in a prompt unless you are authorized to share it.

If you make a purchase, billing records may include the plan, billing cycle, amount, currency, tax breakdown, payment status, transaction reference, subscription dates, and credit or redemption history. The payment provider handles payment processing. Opalefy does not ask you to send card security codes by email.

If you submit an inquiry or feedback, Opalefy may receive the name, email address, phone number, company, subject, message, page information, and related support details you choose to provide.

When analytics are enabled on a published website, the request may include the page URL, event type, referrer, browser user-agent, and IP address. Opalefy may use the user-agent and request metadata to classify browser, device, or country information for that website’s analytics, depending on the request and deployment.

When a visitor submits a public form or file upload, the application may also record the visitor’s IP address for repeat-submission and abuse controls. Do not assume this value is anonymized or irreversibly hashed.

When you visit the public Opalefy marketing website, basic technical data may be processed to deliver pages and protect the service. The precise hosting logs and operational data depend on the deployed infrastructure.

Opalefy uses account and workspace information to provide sign-in, invitations, collaboration, website editing, hosting, asset storage, publication, customer support, and the features available to your plan.

Opalefy uses AI prompts, attachments, and selected content to process your request through the AI provider selected by the service. The selected provider may process that information to return the result. Provider terms and practices may also apply.

Opalefy uses purchase records to verify transactions, activate or renew subscriptions, apply credits, provide receipts, prevent duplicate processing, and handle payment questions.

Opalefy uses inquiry and feedback information to reply, investigate the issue, and manage the support or feedback request.

Opalefy uses visitor-event information to generate the analytics requested by a website owner, maintain the analytics feature, and help protect the Services from misuse or security problems.

Opalefy may use information when necessary to comply with law, respond to lawful requests, establish or defend legal claims, enforce its agreements, or protect the rights and safety of Opalefy, its customers, and other people.

Opalefy uses authentication cookies to keep signed-in sessions working. The access token expires after 15 minutes; the refresh token expires after 7 days. The cookies are HttpOnly and use SameSite=Lax. In production, the Secure flag is enabled. Signing out clears the cookies.

The reviewed application analytics tracking does not use an analytics cookie. Browser settings can block or clear cookies, but doing so may prevent sign-in or session renewal.

For additional details, read the [Cookie Policy](/cookies). A production deployment or an integration may use additional technologies; the operator must verify those technologies against the live site.

Opalefy shares information with service providers when they need it to provide the Services: hosting and object-storage providers for website content and assets; email providers for account and service emails; payment providers to process or verify purchases; and the AI provider selected for a generation request.

Opalefy shares a published website and its public content with visitors when the website owner publishes it. The website owner may also give organization members access to workspace content according to their roles.

Opalefy may disclose information when required by law or a valid legal process, or when reasonably necessary to protect people, investigate suspected fraud or abuse, enforce these Terms, or protect the security and integrity of the Services.

Opalefy does not use this Policy to claim that it sells personal information or uses personal information for cross-context behavioral advertising. Any such practice must be described accurately if introduced.

Opalefy stores account, website, and service data in the infrastructure configured for the platform. Assets may be delivered through public asset URLs. The reviewed startup code grants anonymous object read, upload, and deletion permissions when it creates a new storage bucket. It does not set or verify the policy for a bucket that already exists. The policy of a deployed bucket has not been verified. Do not treat object storage as private or upload confidential material unless the service operator has confirmed its actual access controls.

AI, email, payment, hosting, and storage providers may process information in locations outside your country, depending on the service and deployment.

The applicable providers, processing locations, transfer safeguards, and Opalefy legal entity must be confirmed for the live service. Where privacy law requires a specific transfer notice or safeguard, Opalefy will provide it through the applicable service terms or legal notice.

Opalefy keeps information for as long as reasonably needed to provide the Services, maintain your account and websites, complete transactions, respond to support requests, secure the platform, and meet legal obligations.

Different records may be kept for different periods. Account, website, AI-session, analytics, billing, and support data do not necessarily share one retention period. The current application does not establish a complete published retention schedule. A verified schedule must be supplied for the deployed service.

Canceling a plan does not itself delete the account or its content. If you need information removed, contact Opalefy and identify the account and records involved. Opalefy will review the request under applicable law and any record-retention obligations.

Depending on where you live, you may have rights to request access to, correction of, deletion of, restriction of, or a copy of certain personal information, or to object to certain processing. Applicable rights and exceptions depend on local law.

To make a request, email [email protected]. Tell us how to identify your account, the information or action you are requesting, and a safe way to contact you. Opalefy may need to verify your identity or authority before acting.

A customer’s website visitor should contact the website owner about information that the owner collected through its forms. If Opalefy handles the information for that customer, we may direct the request to the customer or assist as required by the applicable agreement and law.

If you believe a child or another person shared information without appropriate authority, contact Opalefy and identify the relevant account or website. Do not include passwords, invitation tokens, payment credentials, or sensitive form responses in your request.

For privacy questions, use the contact form.

Opalefy uses technical and organizational measures intended to protect information, including access controls for account and workspace features and secure authentication cookies. No internet service or storage system can guarantee absolute security.

You are responsible for protecting your credentials, using appropriate access roles, and avoiding sensitive information in public pages, form fields, or AI prompts. Contact Opalefy promptly if you suspect unauthorized access.

Opalefy’s Services are not a substitute for the permission or safeguards required when an account or website involves a minor. An educational institution and its account administrators must have authority to submit student or other personal information and must use suitable notices and safeguards.

Do not upload student records or other sensitive institutional information unless the institution has authorized the processing and any required written terms are in place.

The Services may link to a payment page, domain registrar, or other third-party service. Those parties operate under their own privacy notices and terms. Opalefy does not control a third party’s independent practices.

Opalefy may update this Policy when its Services, providers, or legal requirements change. The revised Policy will show its effective date. Opalefy will provide additional notice or obtain consent when applicable law requires it.

For a privacy question or request, email [email protected].