1. Introduction

This Privacy Policy describes how OpStack Pro collects, uses, stores, and protects Users' personal data. We comply with Argentina's data protection law (Law 25.326) and adopt international best practices.

2. Data we collect

2.1 Account data

Full name
Email address
Password (encrypted)
Profile photo (optional)
Organization information

2.2 Usage data

Queries submitted to AI agents
Documents uploaded to the knowledge base
Conversation history
Settings and preferences
Usage metadata (date, time, features used)

2.3 Technical data

IP address
Browser and device type
Operating system
Session cookies (essential)

3. How we use your data

We use personal data to:

Provide the Service: Process queries, maintain conversations, manage documents
Authentication and security: Verify identity and prevent unauthorized access
Product improvements: Analyze usage patterns to improve features
Communications: Send important service notifications
Legal compliance: Respond to lawful requests when necessary

4. Legal basis for processing

We process personal data based on:

Contract performance: To provide the requested Service
Consent: When you grant explicit permission
Legitimate interest: To improve the Service and prevent fraud
Legal obligation: When required by law

5. Sharing data with third parties

OpStack Pro does not sell personal data. We share data only with:

5.1 Service providers

Supabase: Database and authentication (cloud hosting)
Netlify: Web hosting and delivery
Google Cloud Run: Backend service runtime
Email providers: Transactional communications and support

All providers are bound by confidentiality agreements and process data only under our instructions.

5.2 API integrations

When you connect external services available in the Platform, credentials are stored encrypted and only used for queries you explicitly authorize.

6. International transfers

Some service providers operate servers outside Argentina (primarily the United States and the European Union). We apply appropriate safeguards through standard contractual clauses and additional security measures.

7. Data security

We implement technical and organizational measures to protect your data:

Encryption in transit (HTTPS/TLS)
Encryption at rest for sensitive data
Passwords hashed with secure algorithms
Role-based access control
Periodic security audits

8. Data retention

We retain personal data while your account is active. If you cancel or delete your account, we will delete or anonymize your data unless we are legally required to retain it.

9. User rights

You may exercise your rights of access, rectification, update, and deletion under Law 25.326. To request this, email contact@opstack.pro.

For the full account/data deletion procedure, identity verification, expected timelines, and data export options, see our Data Deletion Policy.

10. Minors

The Service is not intended for children under 13. Users between 13 and 17 require consent from a legal guardian.

11. Changes to this policy

We may update this Policy for legal, technical, or operational reasons. Changes will be published on this page and, if relevant, notified in the Platform.

12. Data breach notification

In the event of a personal data breach that is likely to pose a risk to the rights and freedoms of users, we will notify affected individuals and relevant authorities within 72 hours of becoming aware of the incident, in accordance with applicable legal requirements.

Our breach response procedure includes: immediate containment and assessment, forensic investigation, user notification with remediation steps, and post-incident review to prevent recurrence.

Users will be notified via the email address registered to their account. Notifications will include a description of the nature of the breach, contact details for our data protection representative, and recommended mitigation measures.