Privacy Policy

Operax is a business-to-business service. Our customers are the businesses that create an account, and the users are the people they invite. A customer decides which of its own systems to connect and which of its customers’ data flows through Operax; for that data the customer is the controller and Operax processes it on the customer’s instructions. Where this policy says you, it means a customer or one of its users.

Account data. Your name, work email, password (stored as a salted hash, never in the clear), role, two-step-verification secret and backup codes, theme and notification preferences, and the invitations you send. You sign in to Operax with your email address and password.

Business profile. What you tell us about the business — name, locations, services, service area, technicians, capacity, hours, brand kit (logos, colours, taglines) — and what the AI infers from it and from your website into the business model and its knowledge memory.

Connected-platform data. When you connect Google Ads, Meta ads, Google Business Profile, Google Search Console, CallRail, Twilio, an email provider or a revenue source, we store the OAuth tokens or API credentials needed to act on your behalf and pull the data those platforms expose to that access: campaigns, ad groups or ad sets, ads, keywords, search terms, spend and performance metrics, business locations, reviews and posts, the searches your website appears for, leads from your lead forms, call logs and SMS logs, and revenue figures. Sections 9 and 10 list exactly what we read from Google and Meta and what we send them. Credentials are encrypted at rest with Fernet (symmetric authenticated encryption) using a key held outside the database, and are decrypted only at the moment a connector uses them. Pictures and videos from your connected ad accounts, and pictures found on your website, are copied into your Operax media library so they keep working after the platforms’ links expire; location data is removed from photos, and website pictures are only used in ads after you confirm they are yours. When you approve an ad that uses a picture or video from your media library, Operax uploads that file to your own Meta ad account. Undoing the upload stops Operax using it for new ads; nothing is deleted from your Meta account.

Store orders. For a store, Operax keeps a customer’s email and phone only as one-way hashes, used to recognise a returning customer; it never stores them in the clear, and it keeps the page an order arrived on without the rest of its web address.

Competitors’ ads. To show you competitors’ ads, Operax sends a competitor’s name, website or Facebook Page id, never your customers’ data, to public ad libraries: Meta’s Ad Library, Google’s Ads Transparency Center through SerpApi, and ScrapeCreators only if switched on. Their public answers, with any access key removed, may be reused for up to 20 hours for anyone watching the same competitor. Competitor ads are kept for analysis only and are never republished.

Leads, calls and appointments. The people who contact your business through the channels you connect: name, phone number, email, message, source and attribution touches (including the ad-click identifier of the ad they came from), consent answers, lead status and value; call records including caller number, duration, outcome and — where your call-tracking provider records them — call recordings and transcripts; and appointments with their address and time. You are responsible for any notice your callers are owed about recording. When you switch on the chat on a landing page Operax serves for you, it keeps what each visitor typed and the AI assistant’s replies, the notice they were shown before they could type (that they are chatting with an AI assistant and that the chat is saved), and their network address and browser as evidence of that notice; a phone number or email they type becomes a lead. When you connect CallRail, Operax reads up to 25 months of call history for the CallRail companies you choose as this business’s, and checks whether their tracking numbers tell callers that calls are recorded; old calls are never texted, routed or sent to AI review without your approval. Records your own systems send to an inbound endpoint are kept as received on that endpoint’s deliveries list, so you can see what arrived and what was applied; deleting the endpoint deletes them.

Usage and audit data. Every decision the AI proposes, its reasoning, who approved or rejected it and when, every action executed and its result, credit consumption, sign-ins and security events, and technical logs (IP address, browser, request identifiers) kept for security and debugging.

Billing data. Your plan, subscription status, invoices and credit purchases. Card details are entered on and stored by Stripe; we hold only Stripe’s identifiers and the last four digits Stripe shows us.

Operax processes information about the people who contact or are marketed to by your business (leads, callers, review authors, message recipients) only to run the Service for you: to attribute and follow up leads, to draft replies and messages you or your autonomy settings approve, and to report results. Every outbound message carries an unsubscribe route, and an opt-out is recorded as a suppression that the Service will not message again. If one of your customers asks you about their data, we will help you answer.

The AI agents that propose and carry out work are large language models run by third-party providers. To do a task, Operax assembles a prompt from the relevant slice of your data — for example a review and your brand voice to draft a reply, or campaign metrics and your guardrails to propose a budget change — and sends it to the provider over an encrypted API connection. The providers we use are Anthropic and OpenAI, and Deepgram for some call recordings. Under their API terms, data sent this way is not used to train their models. Prompts and responses may be retained by a provider briefly for abuse monitoring under its own policy. Operax does not train any AI model on your data.

Which provider does each job:

• Proposing changes to your ads, budgets, bids, keywords and campaigns, reviewing those proposals, and the monthly deep review of a larger account's whole history: Anthropic. When Anthropic is unavailable: they stop; they never switch provider.
• Drafts (review replies, posts, messages, ad copy and content), SEO audits, the owner’s summary report, your account manager’s written answers to you and lighter analysis: Anthropic. When Anthropic is unavailable: OpenAI.
• Lead scoring, building and updating your business profile, finding themes in your reviews, keyword research, tagging your ads and media, checking your photos and videos before they can run in an ad (these never go to the fallback), and choosing which saved notes answer a question: Anthropic. When Anthropic is unavailable: OpenAI.
• Reading call transcripts for call review: Anthropic. When Anthropic is unavailable: OpenAI, when your call settings page names it.
• Answering visitors in the chat on your landing pages, only from facts you confirmed, and passing their details to you: Anthropic. When Anthropic is unavailable: OpenAI.
• Turning call recordings into text for call review: OpenAI. When OpenAI is unavailable: Deepgram, for recordings too long for OpenAI, when it is switched on; Deepgram instead of OpenAI when your call settings page names it.
• Indexing the AI’s saved notes so they can be searched: OpenAI. When OpenAI is unavailable: the notes are searched by their words instead, and Anthropic picks the ones that answer the question.
• Generating images for your creative: OpenAI. When OpenAI is unavailable: the picture is not made and its credits are refunded.

Which provider receives what:

• Anthropic handles the AI agents, the drafts and the reading jobs, apart from the OpenAI uses below. The agents read data from the accounts you connect: your ad accounts’ campaigns, ad groups or ad sets, ads, keywords, search terms, budgets, conversion actions, change history and performance metrics; your Google Business Profile reviews (the text, the star rating and the reviewer’s display name); and, from Search Console, the searches your website appears for and its positions. The reading jobs are: lead scoring, which sends the message a lead wrote with your business name, the lead’s source and the service they asked about, but not the lead’s name, phone number or email address; building your business profile from the text of your website and your onboarding answers, and the analysis agent that keeps it current, which can read what Operax has learned about your business (your campaigns, with their names, statuses, objectives and daily budgets, and the keywords they target, with their match types and quality scores; the searches your website ranks for; and your Google reviews); expanding keyword research from seed terms and your services; tagging the words of your ads and media library items with their angle, offer and hook so they can be filtered; choosing which of the AI’s saved notes answer a question when OpenAI is not switched on; and, at most once a week and only after 5 new reviews, reading your Google review text and star ratings to find what customers praise and complain about: the reviewer’s name is removed (and masked where the text repeats it), and phone numbers and email addresses are masked. Other names a review mentions are not removed; the model is told never to repeat them.
• OpenAI, when Anthropic is unavailable. The drafts (review replies, posts, messages, ad copy and content), SEO audits, the owner’s summary report, the reading jobs above, and the agents that write copy, do lighter analysis or keep your business profile current then send the same request to OpenAI, with the same data, which for those agents can include your campaigns and their results, the campaigns your leads came from with their lead and revenue counts, your keywords and your Google reviews. The agents that propose budget, bidding, keyword, ad and campaign changes (including the one that drafts ad copy changes), and the reviewer that checks proposals, never switch provider: they stop instead.
• OpenAI, always, for these things: indexing the short notes kept in the AI’s memory so they can be searched, which include the notes the agents save and summaries worked out from your Google reviews (such as the average rating and the words customers mention most); generating images for your creative; and turning call recordings into text for call review, unless your call settings page names Deepgram.
• Call review, only after your business agrees to it on its call settings page. Operax sends the recordings and transcripts of your calls to the AI providers that page names to turn them into text and to work out whether each call was a real new customer, whether it was booked and, if not, why not. Today OpenAI or Deepgram turns recordings into text and Anthropic reads the text, with OpenAI reading it when Anthropic is unavailable; the page names the providers in force when you agree. A second Anthropic model reads some of the same transcripts so we can check it against the first before ever relying on it; what it says is stored for that comparison only and is never used to change a lead, a report or what we tell Google or Meta. Phone numbers, emails and card numbers are removed before AI review; other details may remain. Recordings too long for our main transcription provider are turned into text by Deepgram, when it is switched on; the statement you agree to on the call settings page names it.
• The monthly deep review, for larger accounts. Once a month (once a quarter for mid-size accounts) Anthropic reads your account’s whole history (campaigns, spend and results by month, the changes Operax made and how they turned out, and how many leads became customers; counts only, never your customers’ names, phone numbers or emails) and writes a review with recommendations. It runs on Claude Opus 5.5. Only if your account’s owner or an admin agreed in the console, and only once Operax’s own tests show it gives better advice, it runs on Claude Fable 5.1 instead, a model whose prompts and answers Anthropic keeps for up to 30 days and which cannot be used under zero data retention. It never switches to another provider.
• Operax’s AI agents are told what Operax knows about your business, such as your services, area, hours and confirmed numbers, with where each came from; never your customers’ names, phone numbers or emails.
• The free account audit uses no AI model: it is calculated by Operax’s own code.

AI outputs are proposals and drafts. The console records who or what approved each action, so there is always an audit trail from a change on a platform back to the decision and the data it was based on. If we change which provider handles which kind of task, we will update this section first.

Your own systems are not our sub-processors. When you switch on handing new leads to your CRM, each new lead and booking (the person’s name, phone number, email, address, what they asked for, the time window they booked and how they found you) is added to the system you chose (Jobber, Housecall Pro or ServiceTitan) through your own connection; when you add a webhook, the same is sent, signed, to the address you gave, with the other events you chose for it (a lead moving along your pipeline names the lead). Leads Operax learned of from those systems are never sent back to them. A person you ask us to erase must be erased there by you as well.

Account and business data, campaign structure, daily performance metrics, decisions and audit records are kept for as long as your account exists, unless the account owner chooses a retention period (Your account, How long your records are kept). Then, every night, a customer record with no activity for that long is deleted: the lead with its calls, jobs, messages and chats; and daily performance older than that (never younger than 25 months) is kept as monthly totals. A shorter period starts 7 days after it is set. Records under a legal hold are never deleted, and a business that advertises housing keeps its leads and its fair-housing log for at least three years. The raw copies of the webhooks we receive are deleted after 30 days. Some synced advertising data is deleted automatically by a weekly job: search-term, segment, call and change-history records after 400 days, Google Ads click records (used to match leads to the clicks they came from) after 100 days, and delivery-window records after 35 days. Closed findings are deleted after 180 days unless a decision relied on them. Call recordings stay with your call-tracking provider, under its retention, and Operax never stores a recording itself; it keeps a link to each recording and the call’s details with the call record for as long as your account exists. A call’s transcript and the AI’s notes on it are deleted after the number of days your business sets on its call settings page (90 unless you change it, between 30 and 395); the verdict on each call (a real customer or not, booked or not, and why) is kept. A landing-page chat’s words, and the network address and browser kept with it, are deleted after the same number of days; the lead it became is kept.

Disconnecting a platform deletes the access token we stored for it and, for Google and Meta, asks the platform to revoke our access (section 8 says when it does not). What was already synced from it is kept, so that reconnecting restores your history, until you ask us to delete it. When Google or Meta refuses a token we hold because it has been revoked or has expired, we delete that token instead of keeping it until you disconnect. Removing a user deactivates that user’s sign-in. When a subscription ends, the account’s data is kept, apart from the automatic deletions above, until the account owner closes the account or asks us to delete it. When the account is closed (section 8), we delete all of its data 30 days later and email the owner a deletion certificate, except for invoices, which the payment provider keeps as tax records, and records the law requires us to keep; deleted records can remain in encrypted backups for the time the certificate states.

When an agency or a client ends their account, Operax disconnects every linked account at once and deletes the business’s data, files and signed documents 30 days later; a fair-housing compliance log is kept for the three years the law requires. When a customer asks to be erased, Operax removes or anonymises them across the business’s records, takes them off the audience lists Operax made on Google and Meta, and keeps only their phone number or email on a do-not-contact list.

Traffic between your browser and Operax is encrypted with TLS, and plain HTTP is redirected to HTTPS; Operax’s calls to Google, Meta, the AI providers and the other services in section 5 are made over TLS too. OAuth tokens and the other secrets we hold for you (API keys, webhook signing secrets and two-step-verification secrets) are encrypted at rest as described in section 2, under a key kept in the server environment and never stored in the database.

Access inside the product is role-based: billing is limited to the account owner, managing members to the owner and admins, and viewers and analysts can read but not change anything. Your sign-ins and security events are recorded in a log you can see in the console, and every action the AI proposes or carries out records who approved it and when. Users can turn on two-step verification, and sign-in is rate-limited and locks after repeated failures.

Playing a call’s recording or reading its transcript needs a manager’s role or collaborate access to that business; every play and every read is recorded, and the business’s principal and the agency’s staff can see who listened. Operax never downloads or stores call audio for playback: the player is sent to the call-tracking provider’s own address. Leak reports are visible only to people who can see that business; they name callers who rang twice by a masked number (area code and last two digits) and quote at most five call ids as examples.

When your agency shares a report link, the page shows your business name and its totals only: no caller or customer names, phone numbers or email addresses. A search people typed is named only when many callers typed it, and anything in it that looks like a phone number, email or web address is replaced. The link stops working when it expires (30 days unless set otherwise, at most 90) or the moment it is revoked.

Administrative access to the servers, the database and the admin area is limited to the operator of Operax, who uses it only to run and secure the Service, to comply with the law, or at your request. No system is perfectly secure; if we learn of a breach affecting your data we will tell you without undue delay.

You can see and change most account and business data in the console. The account owner can export everything we hold for the account (every business’s records, what Operax changed and why, and the account’s own records, in a documented format) and close the account, which deletes it and its data after a 30-day grace period, from Your account in the console. To ask what we hold, or to have us do either for you, email the support address shown in your account from the account owner’s address; we answer within 30 days. Deleting an account or a business deletes its connections, the tokens stored for them and the data synced from them.

Disconnecting. You can disconnect any platform at any time from the Integrations page. Disconnecting deletes the access token Operax stored for it and asks Google or Meta to revoke Operax’s access; the data already synced stays until you ask us to delete it. Google withdraws access for a whole Google login at once, and Meta for a whole Facebook login, so Operax does not ask for the revocation while another connection still depends on it: for Google, while any other Google connection in Operax still holds a token, whatever its state and including one in another customer’s account, because Operax does not record which Google login made a connection (so once another customer uses Google, the request is usually not sent); for Meta, while another Operax connection that may use the same Facebook login still holds one. You can also remove Operax’s access yourself at any time: for Google at myaccount.google.com/permissions, after which Operax’s next request to Google fails, the token we stored is deleted and the connection is shown as needing to be reconnected; and for Meta in Facebook under Settings, then Business integrations, after which Facebook tells Operax, which disconnects the connection and deletes the token, as the next paragraph describes.

If you remove Operax in your Facebook settings, Facebook tells Operax, and Operax disconnects every Meta connection made with your Facebook login and deletes the Meta access tokens it holds for it. If you also ask Facebook for your data to be deleted, Facebook sends Operax a data-deletion request (to /api/v1/integrations/meta/data-deletion/). Operax then does the same, and also deletes your Facebook user id, the lists of Pages, ad accounts and datasets your login could see, and the record of the permissions you granted. It gives Facebook a confirmation code and a link where you can check the status of the request. The campaigns, results and leads already synced from the ad account and Page the business chose are the business’s own records and are kept; the account owner can have them deleted by emailing us as described above.

Depending on where you are, you may also have rights to correct or restrict processing and to complain to a data-protection authority; we will not treat you differently for exercising them.

This section applies to the information Operax receives from Google APIs when you connect a Google account (“Google user data”). Operax’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What we access, and why:

• Google Ads (https://www.googleapis.com/auth/adwords). The Google Ads accounts your Google login can reach, so you can choose one; for the account you choose, its campaigns, ad groups, ads, keywords, search terms, budgets, conversion actions, change history, performance metrics and ad-click identifiers. We use them to show you the audit and reports, to match your leads to the clicks they came from, and to draft the changes you review. A change is sent to Google only on a connection you have switched to managed, and only after you approve it or within the automatic limits you set.
• Google’s Data Manager API (https://www.googleapis.com/auth/datamanager), asked for separately and only when you turn on revenue feedback or customer-list matching. For revenue feedback we send Google each closed job that came from a Google ad click, as an offline conversion: the click identifier, the time, the job value and currency, a transaction id and the consent status the person gave. No email address or phone number is sent with it. For customer-list matching we upload your customers’ email addresses and phone numbers, hashed with SHA-256, to a list in your own Google Ads account, and only after the business’s customer-data attestation has been recorded in Operax. A person in the EEA, the UK or Switzerland, or one whose location we cannot tell, is included only with their consent, and anyone who opted out of ad audiences is never added to a list. For a store that turns on order uploads, we send Google each order that came from a Google ad click, valued at what the store kept on it (its contribution), never at what the shopper paid: the click identifier, the time, that value and currency, a transaction id and whether it was the shopper’s first order. No email address or phone number is sent, and nothing at all for a store in the EEA, the UK or Switzerland, because store orders do not yet carry the shopper’s advertising consent. From this API we keep only the identifiers and request statuses Google returns.
• Google Merchant Center (https://www.googleapis.com/auth/content), asked for separately and only when a store connects Merchant Center. The Merchant Center accounts your Google login can reach, so you can choose one; for the account you choose, its products, their approval status and issues, and their custom labels, to show you which products can run in Shopping ads and to build the listing groups of the campaigns you approve. Only if you turn it on, Operax writes each product’s margin tier (high, mid, low or unknown) into one custom label, through a supplemental data source it creates in your account and removes again when you turn it off. Operax never changes your product data itself.
• Google Business Profile (https://www.googleapis.com/auth/business.manage). The accounts and locations your Google login can reach, and the reviews of the locations that are your business’s (the text, the star rating and the reviewer’s display name), so you can read and answer them in Operax. Operax recognises your business’s locations by a Google place ID on file for your business or one of its locations or, failing that, by name and address (or by name alone, when only one location has your business’s name, not counting words such as LLC or Inc, and there is no address to compare), and never asks for the reviews of any other location your login reaches. We also publish the review replies you approve, and compare your location’s name, address and phone number with directory listings. Operax also reads your own Google Business Profile listing (its categories, opening and special hours, service area, description, services and prices, phone, website and coordinates) and its rating and review count, to pre-fill the business profile you confirm. Code, not an AI model, reads the listing; the details Operax keeps then become part of the company profile its AI agents read when they plan your marketing (Anthropic, with OpenAI as the fallback). Review text goes to the AI providers only as section 4 describes.
• Google Search Console (https://www.googleapis.com/auth/webmasters.readonly). The properties your Google login can access and, for the one that matches your business’s website, the searches it appears for, its position and the page that ranked, which fill the SEO keyword and ranking screens; and, for your site’s own pages, Google’s index status of each (whether it is indexed, when Google last crawled it, the canonical it chose) and the sitemaps submitted for it, which fill the SEO Technical screen. Nothing is submitted or changed in Search Console. Clicks and impressions are not stored, except for the searches that contain your business’s name, as section 18 describes.
• Google Analytics (https://www.googleapis.com/auth/analytics.edit), only if you connect it to have Operax set up Google Analytics 4, where that option is offered. The Analytics accounts and properties your Google login can access, each property’s web streams and its links to Google Ads accounts, which Operax reads to find the property that measures your website; and, after you approve the plan, the property, web stream and Google Ads link Operax creates for you (and removes again if you ask). Apart from the daily report totals section 18 lists (with https://www.googleapis.com/auth/analytics.readonly, asked for separately), Operax reads no visitor or report data from Google Analytics.

How we use it. Only to provide and improve the features you see in Operax and that are described above. We do not use Google user data to serve advertisements, including retargeting, personalised or interest-based advertising; we do not sell it; we do not transfer it to data brokers or information resellers; we do not use it to determine creditworthiness or for lending; and we do not use it to develop, improve or train generalised AI or machine-learning models. The AI providers in section 4 process it only to answer Operax’s requests, and under their API terms they do not train their models on it. Data from one customer’s Google account is never used for another customer.

Who it is shared with. Only as needed to provide those features: the AI providers named in section 4; DataForSEO, which receives keyword and search text, such as a Google Ads keyword an agent checks or a Search Console query you track, to look up live search rankings (and, once the local grid is switched on, your top search queries with map points across your service area, to look up Google Maps results there), and no personal data; our hosting provider; and Mailgun when a notification you receive by email mentions it (for example, a new review). Beyond that, only to comply with the law (section 11), or as part of a merger, acquisition or sale of assets, after telling you.

Who can read it. No person at Operax reads your Google user data unless you have asked us to (for example, to look at a specific campaign in a support request), it is necessary for security (such as investigating abuse), it is needed to comply with the law, or it has been aggregated and anonymised for internal operations.

Storage, retention and deletion. Google tokens are stored encrypted, as section 2 describes. Data read from Google is kept in Operax’s database for the periods in section 6. Disconnecting a Google channel deletes the token we stored and asks Google to revoke Operax’s access, unless another Google connection in Operax, in any customer’s account, still holds a token (section 8 explains why), and you can remove Operax’s access at any time at myaccount.google.com/permissions. To have the data itself deleted, see section 8.

What we access when you connect Meta, and why:

• A read-only connection asks only for ads_read. We read the ad accounts you can reach, so you can choose one, and for that account its campaigns, ad sets, ads and their creatives, performance results, minimum budgets, datasets (pixels) with their recent event counts, custom audiences (their names, types, rules and approximate sizes) and the account’s activity history (each change, when it was made and the id of who or what made it), to show you the audit and reports and to draft proposals.
• A managed connection is a second Meta sign-in that you start. It adds ads_management to apply the changes you approve, and pages_show_list, pages_read_engagement, pages_manage_ads, pages_manage_metadata and leads_retrieval to find the Facebook Page your ads use, sign it up for lead notifications, and retrieve the leads people submit through your Facebook and Instagram lead forms: the answers they give on the form, usually their name, email address and phone number, which arrive in your lead inbox. Page access tokens are requested when needed and not stored.
• The Conversions API. For leads that came from your Meta ads, on a managed connection, we tell Meta when a lead is qualified and the value of a job you closed, identified by the lead’s email address and phone number hashed with SHA-256, or by the Meta lead id, so that Meta’s ad delivery learns which leads became customers. Customer lists, if you use them, are uploaded to Meta hashed in the same way and only after the business’s customer-data attestation has been recorded in Operax. For a store that turns on order events, we send Meta each recent order as a purchase valued at what the store kept on it (its contribution), never at what the shopper paid: the products’ catalog ids, that value and currency, an order id and the Meta click identifier, for orders that came from a Meta ad. No email address, phone number, name or address is sent, and nothing at all for a store in the EEA, the UK or Switzerland, because store orders do not yet carry the shopper’s advertising consent.
• Meta catalogs (catalog_management and business_management), asked for separately on the managed connection and only when a store connects its catalog. The product catalogs your Meta business owns or was given, so you can choose one; for the catalog you choose, its products, their review and stock status and the datasets that feed it, to build the catalog ads you approve. Operax creates product sets in that catalog, one for each group of margin tiers an ad set sells, keeps them to those tiers and deletes them again when the campaign is undone. Operax never changes your products themselves.

Withdrawing lead access. Switching a managed connection back to read-only, choosing a different Page, or disconnecting asks Meta to stop sending Operax that Page’s leads, unless another Operax connection still receives them. From the switch back to read-only onwards, Operax stores no leads for that connection, even if Meta still sends them. Operax does not post to your Facebook Page or Instagram account and does not reply to comments there: it does not ask Meta for the permissions that would need.

We use Meta data only to provide these features to the business that connected it. We do not sell it and we do not use it to train AI models. We share it only with the sub-processors in section 5 that these features need (the AI providers, our hosting provider, and Mailgun or Twilio when the Service emails or texts a lead or notifies your users), or where the law requires (section 11). Leads from your Meta lead forms are never included in the customer lists Operax uploads to Google. It is kept for the periods in section 6. Section 8 explains how to disconnect, how to remove Operax in your Facebook settings, and how to have the data deleted.

If a court, a law-enforcement agency or another public authority asks us for data about you or your customers, we disclose it only when the law requires us to. We review every request to check that it is lawful and valid, ask for it to be narrowed when it asks for more than it legally needs, disclose only the minimum it requires, and tell the affected customer before disclosing, unless the law forbids us to.

The console does not use tracking cookies and does not load third-party analytics or advertising trackers. It keeps your session tokens (JWTs) in the browser’s localStorage so you stay signed in, together with your theme, selected business and sidebar preference. Signing out clears the tokens; you can also clear them by clearing site data.

Pages the Service hosts for your business set the first-party cookies below, each only in the case stated. Review-request links and unsubscribe pages set none. A visitor can delete any of them at any time by clearing the site’s data in their browser.

• opx_dni, kept for 24 hours. A random token that names the phone number the page shows this visitor. We keep only a hash of it, never the token. So a visitor who arrived from an ad is shown a phone number of their own for the visit, and a call on that number is credited to the ad they clicked and to the version of the page they saw. Only on a landing page, only for a visitor who arrived from a paid ad (an ad click id or a paid campaign tag), and only while number insertion is on. Never when the browser sends Global Privacy Control. For a business in the European Economic Area, the United Kingdom or Switzerland, only after the visitor accepts on the page’s consent banner. The number it names is released 30 minutes after the visitor’s last activity on the page.
• opx_vid, kept for 90 days. A random visitor id, and nothing else. So a returning visitor sees the same version of a page while the business tests two or more versions of it, and the result counts each visitor once. Only on a landing page with a running test. Never when the browser sends Global Privacy Control. Where the visitor is in the European Economic Area, the United Kingdom or Switzerland, only after they accept on the page’s consent banner; where the visitor is comes from the country our network reports for the connection, or else is taken to be the business’s country, and when neither is known the cookie is not set. Without it the test stores nothing on the device and counts each page view on its own.
• opx_consent, kept for 180 days. The visitor’s answer on the page’s consent banner: granted or denied. So the visitor is not asked again on the business’s pages, and so number insertion and page tests follow the answer they gave. Only once the visitor answers the banner, which a page shows only where it asks first. The page keeps the same answer in the browser’s local storage.
• csrftoken, kept for 52 weeks. A random security token. So the Service can check that a form sent to the page was sent from the page itself, which protects visitors from cross-site request forgery. On a page that shows a form: a landing page’s lead or booking form, and the pages where your customers make their privacy choices or a privacy request. It is set for every visitor shown a form, because the form cannot be sent safely without it.

Microsoft Clarity. Only on the landing pages of a business that connected its own Microsoft Clarity project and turned Clarity on for those pages, and never for a health-care or financial-services business. Never when the browser sends Global Privacy Control. By default every visitor is asked first, and Clarity loads only after they accept; Clarity is then told that analytics storage is granted and advertising storage is denied. Where a page shows a one-line notice instead of asking, which it never does in the European Economic Area, the United Kingdom or Switzerland, Clarity loads with the notice. The page keeps the visitor’s answer in the browser’s local storage. Clarity’s script is Microsoft’s and sets Microsoft’s own cookies; Microsoft’s Clarity documentation lists each one and how long it is kept. For example, _clck keeps Clarity’s visitor id for the site, for up to one year and _clsk joins the page views of one visit into one recording, for one day.

We send transactional email you cannot opt out of while you have an account: verification, password resets, invitations, security alerts, billing notices and the notifications you enabled. We may also send product news; every such email has an unsubscribe link, and you can opt out in Settings.

Operax is not directed at anyone under 18 and we do not knowingly collect their data. If you believe a minor has created an account, tell us and we will remove it.

Your data is stored with our hosting provider and processed by the sub-processors in section 5, some of which operate in countries other than yours. Section 5 states, for each one, where it processes data and the safeguard relied on for a transfer.

Where personal data from the European Economic Area, the United Kingdom, Switzerland or Brazil is transferred to a country without an adequacy decision, our data processing agreement (section 18) incorporates the standard contractual clauses that apply: the European Commission’s clauses (Module Two, or Module Three where you act for your own clients), with the UK International Data Transfer Addendum and the Swiss adaptations, and the Brazilian data protection authority’s clauses. Where we have appointed a representative in the European Union or the United Kingdom, section 17 and Annex I of that agreement name them.

We will update this policy when the Service changes in a way that affects it. Material changes are announced to account owners by email or in the console before they take effect. The date at the top is the current version.

Privacy questions and requests go to the support address shown in your account. The operator’s legal name and postal address are shown on your invoices.

To show the demand that reaches your business without ads beside what the ads buy, and to measure honestly how much the ads add, Operax reads the following daily totals from Google, only for the Google accounts you connect and only once each read is switched on for your account. They are Google user data under section 9.

• Google Search Console (https://www.googleapis.com/auth/webmasters.readonly). For the searches that contain your business’s name (its name, its website’s name and the brand terms you protect), the number of clicks on your free listing, how often it was shown (impressions) and its average position, per day and per search. To show how many people find you by name without an ad, beside the clicks your brand ads buy, and to measure, with a brand holdout you approve, how many of those paid clicks would have come anyway. Clicks and impressions for any other search are not stored; they are read only to rank the searches you appear for and are dropped with Google’s answer. Deleted after 400 days.
• Google Analytics 4 (https://www.googleapis.com/auth/analytics.readonly). For the Google Analytics 4 property that measures your website, the number of sessions, engaged sessions and key events per day for each default channel group (for example organic search, paid search, direct, referral and AI assistants). To show the demand your website receives without ads beside what the ads buy, and to check that a key event imported into Google Ads does not count again an enquiry already uploaded to Google Ads from your own records. No visitor-level data, user identifier, IP address or event parameter is read; only daily totals. Deleted after 400 days.
• Google Analytics 4 (https://www.googleapis.com/auth/analytics.readonly). For the same property, the number of sessions, engaged sessions and key events per day for the landing pages that received the most sessions (the page path only, without its query string). To show which pages people arrive on and stay, so that the ads and the pages suggested for them are judged on the same visits. No visitor-level data, user identifier, IP address or query string is read; only daily totals per page path. Deleted after 400 days.

When Operax processes personal data for you, such as your leads, calls, messages and customer records, it acts as your processor. Our data processing agreement sets out the terms of that processing: it covers what GDPR Article 28 requires, incorporates the transfer clauses described in section 15, and carries the California service-provider terms and riders for Brazil’s LGPD and Canada’s privacy laws. Its annexes describe the processing for the features you use, the security measures, and the sub-processors in section 5.

The account owner can read it, and accept it once it is offered for signature, in the console under Settings, Data processing. Larger customers can ask for a countersigned copy. To read it before you sign up, write to the address in section 17.