OpCycle Back to the page

Legal

Privacy Policy

Last updated 2026-08-27

This is what we collect, what we do with it, and what we never do with it.

Who we are

OpCycle is operated by OpCycle, Inc., a Delaware corporation. This policy covers the OpCycle website and the OpCycle application. Write to us at hello@opcycle.ai with any question about it.

Two kinds of data, and why the difference matters

Data about you as a user of OpCycle. Your name, your email address, how you sign in, what your subscription is. We decide how this is handled, and this policy is our account of it.

The business data you connect. The records we pull from your store, your ledger, and your warehouse system so the platform can plan against them. This one is yours, and we only ever hold it on your behalf. We act on your instructions with it. If it contains information about a person, for example the name and shipping address on a consumer order, you are the controller of that information and we are your processor. Our Data Processing Addendum sets out that relationship in full, and it applies automatically.

What we collect

Account details. Your name, your email address, and how you sign in. If you sign in through a third-party sign-in provider, we receive your name, your email address, and the account identifier that provider gives us. If you sign in with a password, we never store the password itself.

Your business data. When you connect a system to OpCycle, we pull the records that connection authorizes: orders, inventory, shipments, invoices, bills, costs, customers, products, pricing, suppliers, bills of materials, and formulations. You can also upload records to us directly, for example a spreadsheet of historical sales or a price list. We store all of it so the platform can read it, reconcile it, and plan against it.

The credentials for a connected system. So we can keep pulling from it. We hold these encrypted, and we use them for nothing but that connection.

Billing details. When you pay for a subscription, payment runs through our payment processor, which handles the card. We never see or store card numbers. What we keep is the subscription state: the plan, whether it is active, and the invoice history.

Demo requests. When you ask for a demo on our website we record the email address you typed, which form you used, and the technical details of the request itself, meaning your browser's user agent and the network address it came from. We keep those last two to review abuse.

Support conversations. When you write to us, we keep the message and our reply, so the next person who helps you knows what happened.

How our website and product get used. Pages visited, features used, how you arrived at our site, what device and browser you are on, and your approximate location from your network address. We use this to understand what is working, to fix what is not, and to measure our marketing. It is described under cookies and analytics below.

Operational logs. We keep operational logs: which data pull ran, what it fetched, what failed and why. These make the platform supportable and let you see your own integration errors.

What we do with it

We use this data to provide the service, and for nothing else. That means keeping your connected systems in sync, computing your forecasts and plans, showing you your own numbers, billing your subscription, sending the transactional email the product needs to send, keeping the platform secure, supporting you when something breaks, and meeting our legal obligations.

What we do not do

These commitments bind OpCycle and every company under common ownership or control with us.

We do measure how our website and our product are used, which is described under cookies and analytics below. That measurement never touches your business data. It sees which pages and features get used. It does not see your orders, your inventory, your costs, your customers, your pricing, your formulations, or your plans.

Aggregated and de-identified data

We may create aggregated and de-identified data from platform activity and use it to operate, secure, and improve the service. It must not identify you, must not identify any individual, must not reveal your data, and must not be capable of being traced back to you. It is never your raw records, never your formulations, recipes, bills of materials, customer lists, or pricing, and it is never disclosed in any form that identifies a customer.

If we ever offer a feature that compares your performance against other businesses, taking part will be your choice, and it will be off until you turn it on.

Where AI fits

Parts of the platform write summaries, explanations, and briefings from your data using large language models hosted by third-party providers. Your data is sent to generate that text and for no other purpose. It is not used to train anyone's models, and our providers are contractually bound to that. Output is generated automatically and can be wrong, so it is information for your decision and never the decision itself.

How we protect your data

Your data and the credentials you give us for a connected system are protected with industry standard encryption, in transit and at rest. We keep a written information security program, we separate your data from other customers' data, access inside OpCycle is limited by role to the people who need it to run the service, and we take regular backups.

If we become aware that someone has gained unauthorized access to your data, we will tell you without undue delay and in any event within seventy-two hours, with what we know and what we have done about it.

Service providers

We share your data only with service providers that help us operate OpCycle. Each one is bound to use it only to provide the service to you, and never for its own purposes.

A current list of these providers, with names and locations, is available on request. We will tell you before we add or replace one that processes personal data, and you can object.

We will also disclose data where the law compels it, and we will give you notice first wherever we are legally allowed to. If OpCycle is ever acquired or merged, your data may transfer as part of that business, and this policy continues to apply to it until we tell you otherwise.

How long we keep your data

We keep your data for as long as your account is open, because the account is what it is for. You can export it at any time.

When your account ends, we make your data available for export for thirty days, then delete it from our systems within thirty days. Backup copies are removed on their own schedule after that, and stay protected until they are.

Operational logs are kept for up to twelve months. Records we need for tax, accounting, or other legal obligations are kept for as long as the law requires.

Your rights

Write to hello@opcycle.ai to see the data we hold about you, to correct it, to get a copy of it in a portable form, or to have it deleted. Ask us to disconnect an integration and we stop pulling from it. We will not treat you differently for exercising any of these rights.

Depending on where you live, you may also have the right to object to or restrict certain processing, and to complain to your data protection authority. If you are in the EU or the UK, our legal bases for handling data about you as a user are performing our contract with you, our legitimate interest in operating and securing the platform, meeting our legal obligations, and your consent where we ask for it.

If your information reached us inside a customer's business data, for example because you bought something from a brand that uses OpCycle, we hold it for that brand and not for ourselves. Ask them, and we will help them answer you.

Cookies and analytics

Three kinds of cookie, and you control two of them.

Essential. The cookie that keeps you signed in, and the ones that keep the service secure. Without these the product does not work, so they are always on.

Analytics. Cookies and similar technologies that show us how our website and our product are used: which pages people land on, which features get used, where people get stuck. Some of these are set by analytics providers working on our behalf, under contracts that let them use the data only to provide the measurement to us.

Marketing. Cookies and pixels that let us measure our advertising and reach people who have visited our site. These are set by advertising platforms.

Your control. Where the law requires your consent, we ask before setting anything beyond the essential cookies, and you can change your choice at any time through the cookie controls on our site.

The line that does not move. Analytics and marketing cover our website and how the product is used. They never carry your business data. No orders, no inventory, no costs, no customer lists, no pricing, no formulations, no plans. Nothing a customer connects to OpCycle is ever sent to an analytics or advertising provider.

California. Some advertising cookies may count as sharing personal information for cross-context behavioral advertising under California law. You can turn them off through the cookie controls on our site, and we do not sell personal information for money.

Do Not Track. There is no agreed standard for how a site should answer that signal, so we do not respond to it. Use the cookie controls instead.

International transfers

We operate from the United States, and your data is processed there. Where we handle personal data protected by EU or UK law and move it somewhere without an adequacy decision, we rely on the Standard Contractual Clauses, and the UK International Data Transfer Addendum where it applies. Both are incorporated into our Data Processing Addendum.

Minors

OpCycle is a tool for running a business, and it is not directed at anyone under 18. We do not knowingly collect data from anyone under that age. If we learn that we hold a minor's data, we delete it.

Changes to this policy

If this policy changes we post the new version here and move the date at the top. If a change matters to how we handle your data, we will tell you through the service or by email.

Contact

OpCycle, Inc. Questions, requests, and complaints all go to hello@opcycle.ai, and a person reads them.

See also our Terms of Service and our Data Processing Addendum.