Privacy Policy

1. Introduction

Opiexon is a business productivity and intelligence platform operated by Loop Tech Limited ("Loop Tech", "we", "us" or "our").

Loop Tech Limited is a company registered in England and Wales under company number 09624830, with its registered office at 175 High Street, Tonbridge, Kent, TN9 1BX, United Kingdom.

Opiexon connects with business systems authorised by its users and uses that information to help organisations understand what is happening across their business, identify matters requiring attention, organise work, generate summaries and recommendations, and assist users through the Opie AI assistant.

This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal data in connection with the Opiexon website, platform and related services.

For privacy enquiries or to exercise your data protection rights, contact:

Email: loopedge.studio@gmail.com

Opiexon is intended solely for businesses, organisations and their authorised users. It is not intended for consumers or anyone under the age of 18.

2. Our role under data protection law

Depending on the circumstances, Loop Tech may act either as a controller or a processor of personal data.

Where we act as controller

Loop Tech generally acts as controller where we determine why and how personal data is processed for our own purposes, including:

• administering Opiexon user accounts;
• managing our relationship with customers;
• authentication and security;
• customer support and communications;
• billing and subscription administration;
• operating and protecting our website and services;
• service analytics;
• complying with legal and regulatory obligations; and
• sending permitted business marketing communications.

Where we act as processor

Where a customer organisation connects its business systems to Opiexon and instructs us to process personal data contained within those systems to provide the Opiexon service, the customer will generally be the controller and Loop Tech will act as its processor.

This can include personal data obtained from Gmail, Google Calendar, Google Drive, Xero and other supported business integrations.

Our processing of such information is governed by our agreement with the relevant customer, including applicable data processing terms.

The customer organisation remains responsible for determining whether its use of personal data through Opiexon is lawful and for meeting its own obligations as controller.

3. Personal data we may process

The personal data processed through Opiexon depends on the services and integrations that a customer chooses to use.

Account and organisation information

We may process information such as:

• name;
• email address;
• organisation;
• job title;
• organisational role;
• Opiexon account role and permissions;
• account and authentication information; and
• organisation membership information.

Email information

Where a user authorises an email integration such as Gmail, Opiexon may process:

• sender and recipient names;
• email addresses;
• subject lines;
• email bodies and message contents;
• dates and timestamps;
• conversation and thread information;
• attachments where supported; and
• other information contained within emails.

Calendar information

Where a user connects a supported calendar, Opiexon may process:

• event names and titles;
• descriptions;
• attendees;
• dates and times;
• locations;
• meeting links; and
• other information contained within calendar events.

Document and file information

Where a user authorises access to a supported document or file service such as Google Drive, Opiexon may process:

• file names;
• file types;
• file metadata;
• ownership information;
• modification dates;
• links and identifiers; and
• the contents of authorised files and documents where the relevant integration and permissions permit this.

This may include the contents of documents, spreadsheets, presentations, PDFs and other supported files.

Accounting and financial information

Where an organisation connects an accounting platform such as Xero, Opiexon may process:

• organisation and accounting information;
• customer and supplier information;
• contact details;
• invoices;
• bills;
• payments;
• bank and transaction information;
• account balances;
• financial reports; and
• other accounting information made available through the authorised integration.

Access to financial information may be restricted within Opiexon according to organisation permissions.

Information submitted to Opie

We may process:

• questions and prompts submitted to Opie;
• instructions given to the service;
• manually entered information; and
• feedback or other information users provide.

Opie-generated information

Opiexon may generate information from connected business data, including:

• summaries;
• tasks;
• priorities;
• recommendations;
• business insights;
• suggested actions;
• executive briefs;
• workflow information; and
• other business intelligence.

Technical and security information

We may process information such as:

• IP address;
• device and browser information;
• authentication and session information;
• security events;
• error information;
• page paths;
• system logs; and
• connection information.

Billing information

Where paid subscriptions are offered, we may process information required to administer subscriptions, payments and billing. Payment card information may be processed by a payment provider rather than stored directly by Loop Tech.

Support and correspondence

If you contact us, we may process your name, email address, organisation, correspondence, screenshots and other information you voluntarily provide.

4. Where personal data comes from

We may obtain personal data:

• directly from Opiexon users;
• from the organisation that provides or manages a user's Opiexon account;
• from business systems that a user or organisation chooses to connect to Opiexon;
• from other users within the same organisation where permitted by Opiexon's access controls; and
• automatically when people use our website or service.

Connected sources currently include services such as Google Gmail, Google Calendar, Google Drive and Xero.

Business systems connected to Opiexon may contain personal data relating to people who are not Opiexon users, including customers, suppliers, employees, professional advisers, email correspondents and meeting attendees.

We do not independently purchase personal data from data brokers for use by Opie, nor is Opiexon designed to scrape personal data from unrelated public sources.

5. How and why we use personal data

We may process personal data to:

• provide and operate Opiexon;
• connect authorised third-party business systems;
• synchronise and organise authorised business information;
• authenticate users;
• manage organisations, memberships, roles and permissions;
• allow Opie to understand relevant business context;
• identify matters that may require attention;
• generate summaries, tasks, recommendations and insights;
• answer user questions;
• identify business changes and patterns;
• assist users in planning and prioritising work;
• prepare drafts and suggested actions for user review;
• provide shared organisational intelligence where permitted;
• provide and improve service reliability;
• diagnose errors and technical problems;
• protect Opiexon, our customers and users against security threats and abuse;
• provide customer support;
• administer subscriptions and billing;
• communicate important service, security, account and integration information;
• comply with legal and regulatory requirements;
• establish, exercise or defend legal claims; and
• where permitted, communicate with businesses about Opiexon and related services.

6. Lawful bases

Where Loop Tech acts as controller, we rely on one or more lawful bases under UK data protection law depending on the particular processing.

Contract

We may process personal data where necessary to enter into or perform a contract with an individual, including providing an Opiexon account and requested services.

Legitimate interests

We may process personal data where necessary for our legitimate interests or those of another person, provided those interests are not overridden by the individual's rights and interests.

Our legitimate interests may include:

• operating and improving a B2B software service;
• administering customer relationships;
• protecting the security and integrity of Opiexon;
• preventing fraud and misuse;
• providing customer support;
• understanding how our service is used;
• maintaining appropriate business records; and
• promoting our services to businesses where permitted by law.

Legal obligation

We may process information where necessary to comply with a legal or regulatory obligation.

Consent

Where the law requires consent for a particular activity, we will rely on consent. Where processing is based on consent, consent may be withdrawn at any time.

Different lawful bases may apply to different processing activities.

Where Loop Tech acts solely as a processor, the relevant customer organisation is responsible for establishing the lawful basis for the underlying processing.

7. How Opie uses artificial intelligence

Opie uses artificial intelligence to analyse authorised business information and provide business productivity and intelligence functionality.

Depending on the integrations and permissions enabled, relevant information from emails, calendars, documents, accounting systems, user prompts and other authorised sources may be provided to AI-processing services in order to:

• understand business context;
• summarise information;
• answer questions;
• identify matters requiring attention;
• generate recommendations;
• prioritise work;
• identify relationships or changes across business information; and
• prepare drafts or suggested actions.

Opiexon currently uses AI infrastructure made available through Lovable's AI Gateway, through which AI models, including Google Gemini models, may process information required to provide Opie's functionality.

AI training

Loop Tech does not use customer Gmail, Google Calendar, Google Drive, Xero, prompts or other customer business data to train Opiexon's own AI models.

Where third-party AI infrastructure is used, those providers process information subject to the applicable contractual and data protection arrangements governing their services.

Human control

Opie is designed as a decision-support and productivity tool.

Opie may analyse information, prioritise matters, generate recommendations and prepare suggested actions or drafts. However, Opie is not intended to make solely automated decisions that produce legal or similarly significant effects on individuals.

Users remain responsible for reviewing Opie's output and for decisions and external actions taken using that output.

Where Opie prepares an external action, such as a communication or draft, the user remains responsible for reviewing and approving the action before it is executed unless a separately disclosed and authorised workflow provides otherwise.

8. Google user data

Where a user chooses to connect a Google account, Opiexon accesses Google user data only after the user has authorised the relevant permissions through Google's OAuth process.

Depending on the Google services connected and permissions authorised, Opiexon may access:

• Gmail messages and associated email information;
• Google Calendar events and associated information; and
• Google Drive file metadata and authorised file contents.

Opiexon uses Google user data to provide user-facing business productivity and intelligence functionality, including synchronising authorised information, generating business context for Opie, identifying matters requiring attention, answering user questions, generating summaries and recommendations, and providing other requested Opiexon functionality.

Relevant Google user data may be stored within Opiexon's systems where necessary to provide the service and may be transmitted to service providers acting on our behalf where necessary to provide Opiexon's functionality, including infrastructure and AI-processing providers.

We do not sell Google user data.

We do not use Google user data for advertising.

We do not transfer Google user data to data brokers.

Loop Tech does not use Google user data obtained through Google Workspace APIs to develop, improve or train generalised or personalised artificial intelligence or machine-learning models.

Our use and transfer of information received from Google APIs is intended to comply with the Google API Services User Data Policy, including applicable Limited Use requirements.

A user's Google account is authorised separately by that user. An organisation administrator cannot use Opiexon to authorise another person's Google account on that person's behalf.

Access to Google data is subject to Opiexon's permission model. Connecting an individual Google account does not automatically make that person's private Gmail, Calendar or Drive information directly accessible to other users within their organisation.

Opie may generate organisational intelligence from information that users are authorised to contribute to the organisation, but information presented to users is subject to applicable Opiexon access controls and permissions.

9. Special category and criminal offence data

Opiexon is a general business productivity and intelligence platform.

Opiexon is not designed or intended as a system for the deliberate storage or processing of special category personal data or criminal conviction and offence data.

However, because Opiexon can process information contained in business emails, calendars, documents and other connected systems, such information may occasionally appear incidentally within data supplied to the service.

Customers are responsible for ensuring they have an appropriate lawful basis and, where required, an applicable condition or other legal authority before intentionally processing special category or criminal offence data through Opiexon.

Customers should not intentionally use Opiexon for such information unless they have established that doing so is lawful and appropriate.

10. Sharing personal data

We may disclose personal data to third parties where necessary to operate Opiexon, including categories of recipients such as:

• cloud hosting and database providers;
• authentication providers;
• AI-processing and infrastructure providers;
• connected integration providers;
• email and communication providers;
• payment and billing providers;
• security and technical service providers;
• professional advisers; and
• regulators, courts, law enforcement bodies or other authorities where legally required.

Providers involved in the current Opiexon architecture include Lovable and its infrastructure, Supabase, Google and Xero.

We require service providers processing personal data on our behalf to handle that information in accordance with applicable contractual and data protection requirements.

We do not sell or rent personal data to advertisers or data brokers.

We may disclose information where reasonably necessary to comply with law, court orders or lawful regulatory requests, or to establish, exercise or defend legal claims.

11. International transfers

Opiexon uses technology providers that may process personal data in different countries.

Our primary application database and authentication environment is currently hosted in the European Economic Area, in Frankfurt, Germany.

Other providers and infrastructure used by Opiexon may process information in the United Kingdom, European Economic Area, United States or other jurisdictions.

Where personal data is transferred internationally, we take steps intended to ensure that an appropriate legal mechanism is available for the transfer. Depending on the destination and provider, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses; or
• another transfer mechanism permitted under applicable UK data protection law.

Where required, additional safeguards may also be considered in relation to the transfer.

You may contact us for further information about safeguards applicable to international transfers.

12. Data storage and retention

We retain personal data only for as long as reasonably necessary for the purposes for which it is processed, taking account of contractual, operational, security and legal requirements.

Connected business information

Disconnecting an integration stops future access and synchronisation through that connection.

Information previously synchronised into Opiexon may remain as part of the organisation's existing business history until it is deleted in accordance with the organisation or account deletion process or another applicable retention requirement.

Account and organisation deletion

Where an Opiexon organisation or account is deleted, customer data is scheduled for deletion on the 30th day following deletion, unless retention for a longer period is required or permitted by law.

Cancelled subscriptions

Where a subscription is cancelled without the account being deleted, we may retain the account and associated information for up to 90 days to permit reactivation.

If the service is not resumed, the account and associated customer data will then be scheduled for deletion in accordance with our deletion process, subject to applicable legal requirements.

Users leaving organisations

Where an individual leaves an organisation, their access and membership may be removed while legitimate organisational records that they previously contributed or synchronised may remain with the organisation.

Backups

Deleted information may remain temporarily in secure backup systems until those backups are overwritten or expire under the applicable provider's backup-retention cycle.

Backup information is not intended to be restored to active use except where required for legitimate disaster recovery, security or legal purposes.

Support and business records

Support correspondence and other controller-held business records may be retained for as long as reasonably necessary to resolve the relevant matter, maintain appropriate business records, comply with legal obligations or establish, exercise or defend legal claims.

13. Security

We use technical and organisational measures intended to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.

Measures used within Opiexon include, where applicable:

• authenticated access;
• server-side validation of user identity;
• organisation-level data isolation;
• role and capability-based permissions;
• database row-level security;
• user-specific protection of personal connected data;
• encryption of sensitive connection credentials and tokens;
• encrypted communications between systems;
• server-side filtering of information supplied to Opie;
• restricted handling of infrastructure secrets and credentials; and
• security and error monitoring.

No internet-based service can guarantee absolute security. Customers and users are also responsible for maintaining appropriate security over their accounts and credentials.

14. Organisation access and permissions

Opiexon is designed so that users directly access their own connected personal Google services rather than automatically gaining access to another user's account.

An Owner, Administrator or Manager within an organisation does not automatically receive direct access to another user's personal Gmail, Calendar or personal Drive data merely because of their organisational role.

Information contained in genuinely shared organisational resources may be available to authorised organisation users according to applicable permissions.

Certain information, including financial information, may be subject to additional capability restrictions.

Opie may use permitted information to generate shared organisational intelligence. The information made available to a particular user remains subject to the permissions applicable to that user.

15. Website analytics, cookies and similar technologies

Our website may use cookies and similar technologies for essential functionality, security, authentication, preferences and analytics.

Essential technologies may be used where necessary to operate and secure the website and service.

Where non-essential analytics technologies require consent under applicable law, we will seek the appropriate consent before using them.

Our website currently uses Lovable's analytics functionality to understand matters such as page views, session duration, referral source, device type, browser language, timezone and general usage patterns.

Analytics may use a temporary session identifier to distinguish visits.

We do not currently use third-party advertising trackers to build advertising profiles of Opiexon website visitors.

Further information may be provided through our cookie controls or Cookie Policy where applicable.

16. Marketing communications

We may send permitted communications about Opiexon and related services to business contacts where permitted by applicable law.

Marketing communications will provide an appropriate method of opting out or unsubscribing.

You may ask us to stop sending direct marketing at any time.

Opting out of marketing does not prevent us from sending necessary service communications, including messages concerning accounts, security, integrations, subscriptions or material changes to the service.

17. Your data protection rights

Depending on the circumstances and the lawful basis for processing, individuals may have rights under UK data protection law including the right to:

• request access to their personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• object to processing;
• receive certain personal data in a portable format;
• withdraw consent where processing is based on consent; and
• raise a complaint concerning the processing of their personal data.

You have the right to object to processing based on legitimate interests in appropriate circumstances and the right to object at any time to processing of your personal data for direct marketing purposes.

These rights are not absolute and may be subject to exemptions or other conditions under applicable law.

To exercise a right relating to information for which Loop Tech is controller, contact:

loopedge.studio@gmail.com

We may need to verify your identity before responding to a request.

Where Loop Tech processes information solely on behalf of a customer organisation, we may refer the request to, or assist, the relevant customer as controller rather than independently altering or deleting that customer's records.

18. Complaints

If you have concerns about our handling of personal data, please contact us at loopedge.studio@gmail.com so that we have an opportunity to investigate and respond.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

19. Personal data relating to other people

Customers and users must ensure that they are authorised to provide, connect or otherwise make personal data available through Opiexon.

Where an organisation connects business systems containing personal data about employees, customers, suppliers, correspondents or other people, that organisation is responsible for meeting its own transparency, lawful-basis and other obligations under applicable data protection law.

20. Accuracy of information

Customers are responsible for ensuring that personal data they provide to or connect with Opiexon is accurate, appropriate and lawfully processed.

Where Loop Tech controls inaccurate personal data, we will take reasonable steps to correct it when appropriately notified.

Where information forms part of a customer's underlying business records, requests for correction may need to be addressed to the relevant customer organisation.

21. Data breaches and security incidents

We maintain procedures for responding to suspected personal data breaches and security incidents.

Where Loop Tech acts as processor, we will notify the affected customer controller without undue delay after becoming aware of a personal data breach where required by applicable law and our contractual obligations.

Where Loop Tech acts as controller, we will assess whether a breach must be reported to the Information Commissioner's Office and, where applicable, affected individuals within the timeframes required by data protection law.

22. Business transfers

If Loop Tech or Opiexon is involved in a genuine merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction, relevant personal data may be disclosed or transferred as part of that transaction where permitted by law.

Appropriate confidentiality, security and data protection requirements will continue to apply.

23. Children

Opiexon is a business-to-business service and is not intended for anyone under the age of 18.

We do not knowingly offer Opiexon accounts to children.

If we become aware that personal data has been directly collected from a child in circumstances where it should not have been, we will take appropriate steps.

24. Third-party services

Opiexon integrates with third-party services selected by customers and users.

Those third parties may separately process personal data as independent controllers in accordance with their own privacy policies and terms.

Connecting a third-party service to Opiexon does not make Loop Tech responsible for the independent privacy practices of that provider.

Users should review the privacy information provided by third-party services they choose to connect.

25. Changes to this Privacy Policy

We may update this Privacy Policy as Opiexon develops, our integrations or service providers change, or legal and regulatory requirements evolve.

The current version will be published on the Opiexon website with a Last updated date.

Where a change materially affects how we process personal data, we will take reasonable steps to bring that change to the attention of affected users where appropriate.

Minor administrative, formatting or clarification changes may be made without requiring users to expressly accept a new version.

26. Contact us

For questions about this Privacy Policy, our processing of personal data or your data protection rights, contact:

Email: info@opiexon.co.uk