Privacy Policy

1. Information We Collect

We collect information to provide our Service, respond to inquiries, and improve the user experience.

2. How We Use Your Information

We use collected data to:

• Provide, maintain, and improve our Service
• Respond to inquiries and requests
• Process transactions, manage accounts, and provide support
• Evaluate partnership, media, or employment opportunities
• Communicate updates or insights (if subscribed)
• Analyze usage patterns to improve performance
• Comply with legal obligations and protect our legal rights

We do not sell or rent your personal data to third parties. We do not use your personal information to train machine-learning or foundation models.

3. Legal Bases for Processing (EEA/UK)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under one or more of the following legal bases under the EU/UK GDPR:

• Contract – to provide the Service and perform our agreement with you.
• Legitimate interests – to operate, secure, and improve our Service and communicate with business contacts, provided these interests are not overridden by your rights.
• Consent – for marketing communications and non-essential cookies, where required (you may withdraw consent at any time).
• Legal obligation – to comply with applicable laws, regulations, and lawful requests.

4. Data Transfers and Storage

Personal information relating to your use of the Service is hosted in Canada, in the Amazon Web Services Canada (Central) region (ca-central-1). Some of our service providers may process limited information outside Canada – in particular, content you route to an AI model is transmitted to the applicable model provider through our AI gateway, and certain analytics and payment providers may process data outside Canada. Where we transfer personal data from the EEA or UK to a country without an adequacy decision, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, together with supplementary measures where needed. You may request a copy of the relevant safeguards by contacting us. Opal employs appropriate administrative, technical, and physical safeguards to protect your data from unauthorized access, alteration, or disclosure.

5. Sharing of Information

We may share your information with:

• Trusted vendors, sub-processors, or partners who assist with operations such as hosting, AI model inference, payment processing, analytics, and communications, under contracts that require them to protect the data and use it only for authorized purposes. These currently include Amazon Web Services (cloud hosting, Canada), Vercel (AI gateway / model routing) and the AI model providers accessed through it, Stripe (payment processing), and Google Analytics (website analytics).
• Professional advisors, and parties to a merger, acquisition, financing, or sale of assets.
• Authorities, if required by law, regulation, legal process, or to protect our rights, users, or the public.

6. Your Privacy Rights

Depending on your location, you may have rights to:

• Access, correct, update, or delete your personal information.
• Object to or restrict certain processing, and request portability of your data.
• Withdraw consent to processing where processing is based on consent.
• Lodge a complaint with a supervisory authority (EEA/UK) or the Office of the Privacy Commissioner of Canada.

Additional rights for California residents (CCPA/CPRA)

If you are a California resident, you have the right to: know the categories and specific pieces of personal information we collect, use, and disclose; request deletion or correction of your personal information; and opt out of the "sale" or "sharing" of personal information and of targeted advertising. We do not sell or share personal information as those terms are defined under the CCPA/CPRA. We will not discriminate against you for exercising your rights. You may exercise these rights yourself or through an authorized agent.

To exercise any of these rights, contact us at legal@deployopal.com. We will verify your request and respond within the timeframes required by applicable law. Where Opal processes personal data on behalf of a business customer (as a processor), we will refer your request to that customer.

7. Data Retention

We retain personal information only as long as necessary to fulfill the purposes outlined in this policy, to provide the Service, to comply with our legal, tax, and accounting obligations, and to resolve disputes and enforce our agreements. When personal data is no longer needed, we delete or de-identify it. Retention of Customer Data processed on behalf of business customers is governed by the DPA and the Terms of Use.

8. Links to Third-Party Websites

Our website may contain links to third-party sites. Opal is not responsible for the content, privacy practices, or security of those sites.

9. Children's Privacy

Our Service is intended for business use and is not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to remove it.

10. Changes to This Policy

We may update this Privacy Policy periodically. Updates will be posted on this page with an updated effective date. Material changes will be communicated where required by law. We encourage you to review it regularly.

11. Contact

If you have questions or concerns about this Privacy Policy, or to exercise your privacy rights, please contact us at:

Email: legal@deployopal.com

Opal Technologies, Suite 1100 – 715 5 Ave SW, Calgary, Alberta, T2P 2X6, Canada