Privacy Policy

Who we are

Opis App Hub is a strategic intelligence suite operated as a sole trader business based in the United Kingdom. For the purposes of UK GDPR we are the data controller for the personal data described in this policy.

For any privacy question, or to exercise any of the rights described below, contact support@opis-app-hub.com. We aim to respond within five working days and are required to respond within one month.

What we collect

Account and authentication. Your email address and an encrypted representation of your password, handled by our authentication provider. We never see your password in readable form.

Subscription state. Your plan tier, subscription status, trial start and conversion dates, and an identifier linking your account to your payment record.

Content you create. The inputs you submit, the analyses and results generated from them, saved workflows, brand presets, colour palettes and any files you upload. This content belongs to you; we store it so you can return to it.

Your AI provider keys. If you supply your own API key, it is encrypted before it is stored and decrypted only at the moment it is needed to run your request. We keep an access log recording when a key was used, so that unexpected use is detectable.

Usage records. A record of analyses run against the platform key, used to enforce fair-use limits. Once you are on a paid plan your work runs on your own key, so these records generally stop accruing.

A payment card fingerprint. When you start a trial, our payment provider gives us a one-way fingerprint of the card. We store that fingerprint to prevent the same card being used for repeated free trials. It is not the card number, it cannot be reversed into one, and we never receive or store your full card details.

When you contact us

If you use a contact form, we receive your name, your email address, the category you chose and whatever you write. If you are signed in, we also attach your email address, whether you are on a trial or a paid subscription, and your language setting, so that we do not have to ask you for them.

Messages are sent to our support mailbox and are not stored in the application. They stay in that mailbox, where they are kept for as long as we need them to handle your query and to keep a record of what was agreed.

You can attach screenshots to a message from inside your account. Images are resized in your browser before they are sent, which also removes embedded data such as the location tags a phone adds to photographs — we never receive it. Please be aware that a screenshot may show information about your own customers, and only attach what you are willing for us to see.

Uploaded logos are publicly readable

Brand logos you upload are stored in a public storage bucket so that they can be embedded in reports and shared documents. Anyone who has the file URL can view that image, even without an Opis account.

The URLs are not listed or indexed anywhere, but you should treat an uploaded logo as publicly accessible rather than private, and should not upload anything confidential as a brand asset.

What happens when you run an analysis

When you run an app, the text you submit and the instructions we build around it are sent to an AI provider for processing, and search queries may be sent to a search provider to gather evidence.

On a paid plan this happens using your own API key, under your own agreement with that provider. Your relationship with them is direct: their terms and privacy policy govern what they do with the content, and any charges are billed by them to you. We do not add a margin to that cost.

Do not paste information into an analysis that you are not permitted to share with a third-party AI provider.

Why we are allowed to process it

• To perform our contract with you — providing the service, your account, and the analyses you ask for.
• To meet legal obligations — retaining financial records for the periods UK tax law requires.
• For our legitimate interests — keeping the service secure, preventing repeated abuse of free trials, and diagnosing faults. We consider these limited and proportionate, and you may object at any time.

Who else processes your data

We use a small number of established providers. Each processes data only to deliver its part of the service:

• Supabase — database, authentication and file storage, hosted in the EU.
• Vercel — application hosting and content delivery.
• Stripe — payment processing. Stripe handles card details directly; we never receive them.
• Google — the Gemini AI models used to generate analyses and content.
• Tavily — web search used to gather evidence for grounded analyses.
• Microsoft — the mailbox behind our support address.
• Resend — delivery of service emails such as sending a report to a destination you choose.
• Sentry — error monitoring. When a payment, a cancellation or an account deletion fails, Sentry receives the technical error and the account identifier it concerns, so that we can find the problem and put it right. It does not receive your email address, your analyses, or your AI provider key.
• Google Analytics and Google Ads — only if you agree to them on the cookie banner. They receive the pages you view on this site, general location and device information, and whether your visit followed one of our adverts. They are never given your email address, your account identifier, or anything you write into an app. If you decline, neither is loaded and neither receives anything at all.

Some of these providers are based outside the UK, principally in the United States. Where data is transferred internationally it is done under the safeguards those providers offer, such as standard contractual clauses. We do not sell your data, and we do not share it for advertising.

Cookies and tracking

Two kinds of cookie are strictly necessary and are always set: a session cookie that keeps you signed in, and a preference cookie remembering your chosen interface language. These cannot be switched off without breaking the service, so no consent is asked for them.

Beyond those, we use Google Analytics and Google Ads to understand which pages people find useful and which adverts bring people here — and only if you agree. They are not loaded, and their cookies are not set, unless you press the accept button on the cookie banner. Closing the banner, ignoring it, or continuing to browse does not count as agreement.

If you decline, nothing about the site changes: every feature works exactly the same. If you agree, Google Analytics tells us how many people visited a page and roughly where in the world they were, and Google Ads is told when a visit came from one of our adverts so we can tell which advertising is worth paying for. Neither is used to identify you, and we do not connect either to your account.

You can change your mind at any time by clearing this site’s data in your browser, which removes the stored choice and shows the banner again. Withdrawing agreement is meant to be as easy as giving it.

Your answer itself is stored in your browser’s local storage rather than in a cookie — setting a cookie to record that someone refused cookies would be a poor way to respect the refusal.

We use no advertising pixels and no session recording. An earlier version of this page promised that consent controls would be in place before any analytics was loaded, rather than switching it on quietly and describing it afterwards. That is what happened.

How long we keep it

Account data and the content you create are kept while your account is open, so that your saved work remains available to you.

Records of payments and invoices are kept for six years after the end of the relevant tax year, because UK law requires it.

Card fingerprints used for trial-abuse prevention are kept for as long as that control remains necessary.

Two technical logs are kept for twelve months and then deleted automatically: a record of which app each account ran and when, used for quotas and billing questions, and a record of when a stored AI provider credential was read, kept so that any unexpected access can be investigated. Neither contains the content of your work.

Deleting your account

You can delete your account yourself, from Settings. Because deletion is immediate and cannot be undone, being signed in is not enough on its own: we email a confirmation link to the address on the account, and nothing is deleted until you open that link and press the button on the page. The link lasts one hour and can be used once.

Confirming deletes your account and everything saved in it straight away, cancels any active subscription so that you are not charged again, and removes any files you uploaded. If you would rather we did it for you, email support@opis-app-hub.com from the address on your account and we will do it and confirm when it is done. You do not have to give a reason.

Financial records we are legally required to retain are the exception, and we will tell you what has been kept and why.

The one-way card fingerprint described above is also kept after deletion, on its own and no longer linked to you or to any account. Without that, deleting an account would double as a way of obtaining a second free trial.

Your rights

Under UK GDPR you have the right to ask for a copy of your data, to have inaccurate data corrected, to have your data erased, to restrict or object to how we use it, and to receive it in a portable format. You will never be charged or penalised for exercising these rights.

Email support@opis-app-hub.com to make any of these requests. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first so we can put it right.

How we protect it

Traffic is encrypted in transit. Database access is restricted per-account at the database level, so one account cannot read another account’s rows. AI provider keys are encrypted at rest with a versioned scheme that allows the encryption key to be rotated without exposing stored credentials.

No system is perfectly secure. If a breach affecting your personal data occurs, we will notify the Information Commissioner’s Office within 72 hours where required, and tell you directly where there is a high risk to you.

Changes to this policy

If we change how we handle your data, we will update this page and change the date at the top. Where a change materially affects you — new tracking technology, a new category of data, or a new purpose — we will tell you rather than rely on you noticing.