Privacy Policy

1. Introduction

OpExCore ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect personal data when you use the OpExCore platform ("Platform").

This policy applies to all users of the Platform, including administrators, managers, and contributors within tenant organisations. We act as a data processor on behalf of your organisation (the data controller) for data entered into the Platform, and as a data controller for account and usage data we collect directly.

2. What Data We Collect

2.1 Account Data

When your organisation's administrator creates your account, we collect:

• Name (first name and last name)
• Email address
• Department assignment
• User role (Contributor, Manager, Admin, Executive)

2.2 Platform Data

Data you and your colleagues enter while using the Platform, including:

• Ideas, actions, projects, and their associated content
• KPI measurements and targets
• Lean tool analyses (5 Whys, Ishikawa, Pareto, VSM, KT Decision Analysis)
• Comments, attachments, and documents
• Report configurations and scheduled report settings

2.3 Usage and Security Data

We automatically collect certain data to operate and secure the Platform:

• Login and logout timestamps
• IP addresses associated with login activity
• Session duration and activity timestamps
• Audit trail records (who changed what and when)
• Failed login attempts and account lockout events

2.4 Organisation Data

Tenant administrators may provide:

• Company name, logo, and brand colours
• Department structures and categories
• Subscription and billing contact details

3. How We Use Your Data

Purpose	Data Used	Legal Basis
Providing the Platform and its features	Account data, platform data	Contract performance
User authentication and session management	Email, password hash, session data	Contract performance
AI-powered features (when enabled)	Relevant platform data for the specific AI request	Contract performance / Legitimate interest
Generating reports and dashboards	Platform data, aggregated metrics	Contract performance
Sending scheduled reports and notifications	Email address, platform data	Contract performance
Security monitoring and audit trail	Login data, IP addresses, activity logs	Legitimate interest
Platform improvement and bug fixing	Aggregated, anonymised usage patterns	Legitimate interest

4. AI Features and Third-Party Data Processing

OpExCore's AI features (AI Executive Reports, AI Action Plan Generator, AI Suggestions) are powered by the Anthropic Claude API. When an AI feature is triggered by a user, the minimum data necessary for that specific request is sent to Anthropic's API for processing. For example, generating an AI Executive Report sends aggregated metrics from your tenant's ideas, actions, and KPIs for the selected date range.

Key protections under the Anthropic commercial API terms:

• Your data is not used to train, fine-tune, or improve Anthropic's AI models — this is a blanket policy for all commercial API usage, with no opt-in or opt-out required.
• API inputs and outputs are automatically deleted from Anthropic's systems within 30 days.
• Anthropic does not sell, share, or distribute your data to third parties.
• These protections are distinct from Anthropic's consumer-facing products (such as Claude.ai Free and Pro accounts), which have separate and different data policies. OpExCore exclusively uses the commercial API.

AI features are optional premium add-ons. If they are not enabled for your tenant, no data is ever sent to Anthropic or any other external AI service. Your organisation's super administrator controls whether AI features are active.

5. Data We Do Not Collect

We want to be clear about what we do not do:

• We do not sell your personal data or your organisation's data to anyone, under any circumstances.
• We do not use tracking cookies, advertising cookies, or third-party analytics trackers.
• We do not profile users for marketing purposes.
• We do not share your data with third parties for their own purposes, except as described in Section 4 (AI features) and Section 6 (hosting infrastructure).

6. Where Your Data Is Stored

All platform data is hosted on dedicated server infrastructure located within the United Kingdom and is subject to UK data protection law. Data is not transferred outside the UK except when AI features are used, in which case the minimum data necessary is processed by Anthropic's API infrastructure under their commercial data processing terms (as described in Section 4).

7. Data Retention

• Platform data: Retained for the duration of your organisation's active subscription, plus 30 days after termination to allow for reactivation or data export.
• Audit trail: Retained for the duration of the subscription. Audit logs are deleted with the tenant's data upon account closure.
• Security logs: Login/logout records and failed attempt logs are retained for 12 months for security monitoring purposes.
• AI processing: Data sent to the Anthropic API is automatically deleted from their systems within 30 days. We do not retain copies of AI-generated outputs beyond what is saved into the Platform by users.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• HTTPS/TLS encryption for all data in transit
• Bcrypt password hashing — we never store plaintext passwords
• Automatic account lockout after 5 failed login attempts
• Session timeout and secure cookie configuration
• Role-based access controls with tenant-scoped data isolation
• Regular server security updates and monitoring

9. Your Rights (UK GDPR)

Under UK data protection law, you have the following rights:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can request correction of inaccurate personal data.
• Right to erasure: You can request deletion of your personal data, subject to legal retention requirements.
• Right to restrict processing: You can request that we limit how we use your data in certain circumstances.
• Right to data portability: You can request your data in a structured, commonly used, machine-readable format.
• Right to object: You can object to processing based on legitimate interest.

To exercise any of these rights, please contact your organisation's administrator in the first instance, or contact us directly at privacy@opexcore.com. We will respond to all requests within 30 days.

10. Cookies

The Platform uses only essential cookies required for the Service to function:

• Session cookie: Maintains your authenticated session while you are logged in. This cookie is deleted when you log out or your session expires.

We do not use advertising cookies, tracking cookies, or third-party analytics cookies. No cookie consent banner is required as we only use strictly necessary cookies.

11. Children's Privacy

The Platform is designed for use by professionals within organisations and is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify tenant administrators via email or an in-platform notification at least 14 days before the changes take effect. The "Last updated" date at the top of this page will be revised accordingly.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us:

• Email: privacy@opexcore.com
• Website: opexcore.com

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.