Effective date: 2026-10-18
This notice explains how Ophiry handles personal data.
Who we are
Ophiry is operated by Andre Geha, Baabda, Lebanon ("we", "us"). For any privacy question or request, write to privacy@ophiry.com.
Two roles
- Controller: for the data we need to run our relationship with our customers and their users: account, billing, support and security data. This notice covers that data.
- Processor: for the documents and content our customers upload to their workspaces (Customer Data). We process it only on our customer's instructions, under our Data Processing Agreement. If you are a reader or user of a customer's workspace, that customer is responsible for that data; please contact them first.
What we collect, why, and on what basis
| Data | Why | Legal basis |
|---|---|---|
| Name, work email, organisation, role, language | Create and manage your account and workspace | Performance of our contract |
| Sign-in and security data (session cookies, IP address, device and browser data, sign-in times) | Keep accounts secure, prevent abuse and fraud | Legitimate interest in security |
| Activity in the application (audit log of changes, usage counts, AI usage measured in tokens) | Enforce plan limits, troubleshoot, secure the Service, bill correctly | Performance of contract; legitimate interest |
| Billing data (plan, billing country, invoices) | Sell and invoice subscriptions | Performance of contract; legal obligations |
| Support messages | Answer your requests | Performance of contract; legitimate interest |
| Service emails (trial reminders, payment notices, notifications) | Operate the subscription and the Service | Performance of contract |
We do not sell personal data, we do not use it for advertising, and we do not use Customer Data to train AI models.
Payments: Paddle
Our order process is conducted by our online reseller Paddle.com, the Merchant of Record for all our orders. Paddle collects and processes payment details (card or other payment method, billing address and tax information) as an independent controller under its own privacy notice. We never see or store your full card details. Paddle shares with us the information needed to manage your subscription (such as your email, country, plan and payment status).
Who receives personal data
We share personal data only with service providers that help us run the Service, under contracts that protect it:
| Recipient | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the application and its database | Germany (EU) |
| Paddle.com Market Ltd | Reseller and Merchant of Record: payments, invoices, taxes | United Kingdom |
| Resend, Inc. | Sending service emails | United States |
| Cloudflare, Inc. | Domain name and email routing services | United States / global |
| AI model providers (Anthropic, PBC; OpenAI, L.L.C.; Google LLC) | Processing text to generate and answer from knowledge bases, under terms that exclude training on it | United States |
We may also disclose personal data where required by law, to protect our rights, or to a successor if the Service is transferred.
International transfers
The Service is hosted in the European Union. Some recipients are located outside your country, including in the United States and the United Kingdom. Where data protection law requires it, transfers rely on adequacy decisions or on standard contractual clauses or equivalent safeguards offered by the recipient.
How long we keep it
- Account and workspace data: for as long as the account or workspace exists.
- After a subscription ends, the workspace becomes read-only and may be disabled. We delete it on request, or when we close it after review.
- Billing records: as long as required by tax and accounting law.
- Security logs: for as long as needed to secure the Service, then deleted or anonymised.
Security
We protect personal data with appropriate technical and organisational measures. These include encryption in transit, access control, isolation between customer workspaces enforced by the database, encryption of stored API keys, audit logging and regular backups. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify you and the authorities as the law requires.
Your rights
Depending on the law that applies to you (including the EU/UK General Data Protection Regulation and Lebanese Law No. 81/2018 on electronic transactions and personal data), you may have the right to:
- access your personal data and receive a copy of it;
- have it corrected, deleted or restricted;
- object to processing based on legitimate interest;
- receive it in a portable format;
- withdraw any consent you gave.
To exercise these rights, write to privacy@ophiry.com. We may need to verify your identity. You may also complain to your data protection authority.
Cookies
We use only cookies that are strictly necessary to run the Service: a session cookie to keep you signed in, and preferences such as language and theme. We do not use advertising or tracking cookies. During checkout, Paddle may set its own cookies under its own notice.
Changes
We may update this notice and will publish the new version here with a new effective date. For material changes we will inform customers' administrators.
Contact
Andre Geha, trading as Ophiry · Baabda, Lebanon · privacy@ophiry.com