Legal
Privacy Policy
Last updated 10 September 2026
What we hold, why we hold it, the two places your content leaves our servers, and what you can ask us to do about any of it.
Draft. The technical descriptions below were taken from the source code and are accurate. The legal framing has not been reviewed by a lawyer. 2 placeholders still to settle, marked below.
Who is responsible for what
For the content inside a workspace — messages, documents, tasks, files — your organisation is the data controller and we are the processor. We handle that content on your instructions in order to run the service, and for nothing else.
For the small amount of data we hold about running our own business — your billing contact, your invoices, correspondence with our sales and support — we are the controller.
The controller for your workspace is [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. Privacy questions go to privacy@oprex.net.
What we hold
Account data: a person’s name, work email address, job title, department, avatar, language and theme preference, and their reporting line where your organisation records one.
Workspace content: chat messages and their attachments, voice notes and their transcripts, documents, whiteboards, projects, tasks, test cases, meetings and calendar entries.
Operational records: the audit trail of who did what and when, including the IP address the action came from; sign-in events; delivery and read receipts; and error logs.
Enquiries: if you use the contact form, the chat box on this site, or ask for a trial, we keep your name and email address, your company and phone number where you give them, what you wrote to us, and the IP address and browser the message came from. This is the one part of this policy that applies to people who are not customers and may never be.
Mail is deliberately not on this list. Oprex reads your mailboxes over IMAP and sends over SMTP; the mail itself stays on the mail server you already own, under your own retention rules.
Why we hold it
To provide the service you have asked for, which is the lawful basis for almost everything above.
To keep the service and its customers secure — this is why the audit trail records IP addresses, and why sign-in events are retained.
To bill you, and to answer you when you contact support.
To reply to enquiries from people who are not customers, and — on the terms in the section below — to tell them about Oprex.
We do not sell personal data, we do not use your content for advertising, and we do not use your content to train AI models.
Where your content goes
Most of it goes nowhere. Voice-note transcription and the search index run on our own servers, not on a third party’s. Call audio and video run on our own media server rather than through a conferencing vendor, so a call is not a copy of your meeting sitting with somebody else.
There are two exceptions, and both are named in full on our sub-processor page.
The assistant: when somebody uses Askini, the text of that conversation is sent to Groq, Inc. in the United States to generate a reply. Nothing else in your workspace is sent — only what the person typed and the conversation it belongs to. If your organisation would rather this never happened, tell us and we will disable Askini for your workspace.
Push notifications: to ring a phone, a notification is delivered through Firebase Cloud Messaging, operated by Google. It carries who is calling or messaging and which conversation, so that the device can show the notification.
Where it is stored
Workspace data is stored on our servers at Hostinger International Limited, in Paris, France. Each workspace has a database of its own, kept separate from other customers.
Sub-processors may process data outside that region — Groq and Google are both United States companies. Where personal data leaves the European Union, the transfer relies on the European Commission’s Standard Contractual Clauses.
If you contact us
We hold what you sent so we can answer it, and so that the next person you speak to can see what was already said. A chat you end is emailed to you as a transcript, at the address you gave when you started it.
We may also write to you about Oprex itself — what it does, what has changed, what it costs. Every such message says how to stop receiving them, and you can tell us to stop at any time by replying or writing to privacy@oprex.net. Saying stop has no effect on us answering your question; the two are separate and we will not treat them as a package.
Being straightforward about where this stands: neither the contact form nor the chat box currently asks you to opt in, so if you wrote to us before this policy said any of this, you were asking a question and nothing more. Treat this section as what we will do from the point the forms ask — not as permission granted on your behalf by a page you did not read.
We do not sell these addresses, share them with anyone outside the subprocessors listed below, or use them to advertise anything other than Oprex.
How long we keep it
Workspace content is kept for as long as your workspace exists. Items your people delete go to a trash that they can restore from; whiteboard trash expires on its own timer.
After a subscription or trial ends, content is kept for 30 days so it can be recovered or handed back, then deleted.
Enquiries and chat transcripts are kept while they are open, and after that as a record of what was asked and answered. There is no automatic deletion today, which means a conversation from years ago is still there — ask us and we will remove it.
We should be straightforward about a current limitation: there is no automatic retention policy in the product. Nothing expires because a rule says so, and there is no legal-hold mechanism. If your organisation is subject to retention obligations, raise it with us before you subscribe.
Your rights
Individuals have rights over their personal data, including access, correction, deletion, restriction and portability. Because your organisation is the controller of workspace content, requests from its people should go to your own administrators first — they can see, correct and remove most of it directly inside the workspace.
Where a request needs us, contact privacy@oprex.net and we will respond within 30 days. If you are unhappy with how we handle it, you can complain to Egypt’s Personal Data Protection Centre, established under Law No. 151 of 2020.
There is no self-service export in the product today. A copy of your data is a request to us, and we would rather say that than imply a button that does not exist.
Security
Access inside a workspace is granted by role rather than by exception, every action is written to an audit trail with credentials and message bodies redacted, and suspending somebody revokes their tokens, disconnects their live sessions and locks their mailbox in one action.
Our security page describes these controls.
If you believe you have found a vulnerability, contact security@oprex.net.
Cookies
Oprex uses cookies that are necessary for it to work: one that keeps you signed in, and one that remembers your theme and language so the first paint of a page is already correct.
The public marketing site does not use analytics or advertising cookies. If that ever changes, this section changes with it and a consent banner appears — not the other way round.
Changes
When this policy changes, the date at the top of the page changes with it. If a change materially affects how we handle personal data, we will tell your administrators before it takes effect.