Privacy policy
This policy explains what personal data OpsWB collects, why we collect it, who we share it with and what you can do about it. It is written in plain English, and it covers everything we run.
Last updated 1 September 2026
This website
opswb.com - our marketing site, including the contact form and newsletter landing pages.
The OpsWB web app
The software you sign in to at app.opswb.com to run your business.
OpsWB Mobile
Our companion app for iPhone and Android.
Who we are
OpsWB ("we", "us") provides business management software for small businesses. For anything in this policy you can reach us at [email protected].
Our two roles
This is the most important thing to understand about how OpsWB handles data, because we act in two different capacities depending on whose data it is.
We are the "controller"
For data about you as our customer or visitor - your account, your company profile, your billing, your enquiries and how you use our website. We decide how that data is used, and this policy explains it.
We are the "processor"
For the data you put into OpsWB about other people - your customers, your employees, your suppliers. You decide what to collect and why; we only hold and process it on your instructions, under our terms and our data processing agreement.
We do not sell personal data, and we never use the business data in your account to advertise to you or anyone else, or to train third-party AI models.
What we collect
When you use this website
- Contact and access-request forms
- Your name, email address, and optionally your company name, the message you write, and (for app access requests) which phones your team uses and how many people need access.
- Anonymous usage measurement
- The page viewed, the time, the referring site, device type, browser, operating system, preferred language and country. Visits are grouped by a one-way hash of IP address and browser that changes every day - your IP address itself is not stored, and you cannot be identified or followed across days.
- Anti-spam and security
- Your IP address and browser user-agent are recorded with form submissions so we can block abuse.
When you use the OpsWB web app or mobile app
- Your account
- Your name, email address, a securely hashed password, your role and permissions, and - if you turn it on - two-factor authentication details or a registered passkey.
- Your company profile
- Business name, address, logo, VAT and bank details you enter for invoices, and your chosen settings.
- Billing
- Your plan, billing contact and payment history. Card details are entered directly with Stripe and are never stored on our systems.
- Business records you create
- Everything you put into OpsWB - customers, quotes, jobs, invoices, expenses, stock, time entries, shifts, payroll, documents and newsletter lists. This often includes personal data about other people (see "Our two roles" below).
- Security and audit logs
- Sign-in times, IP address, device and browser, and - where auditing is enabled - a record of which records were viewed or changed, and by whom.
- Photos and files
- Images and documents you or your team upload or attach to a job. On mobile this uses your camera or photo library, only at the moment you choose to attach something, and only with the permission you grant your device.
- Diagnostics
- Technical logs and error reports needed to keep the service running and fix faults.
The mobile app asks for device permissions only when a feature needs them - for example the camera when you attach a photo to a job. You can refuse or withdraw any permission in your device settings, and the rest of the app will carry on working.
Why we use it, and our lawful basis
UK GDPR requires us to have a lawful basis for everything we do with personal data. Here is ours.
| What we do | Lawful basis |
|---|---|
| Providing the OpsWB service to you and your team | Performance of our contract with you |
| Taking payment and managing your subscription | Performance of our contract; legal obligation for tax records |
| Replying to enquiries and access requests from this website | Legitimate interests - responding to people who contact us |
| Keeping the service secure, preventing fraud and abuse | Legitimate interests - protecting our service and our customers |
| Understanding which pages of our website are useful | Legitimate interests - improving our site, using anonymised data with no cookies; you can opt out at any time |
| Service messages about your account, security or changes | Performance of our contract |
| Marketing emails about OpsWB | Consent, or legitimate interests where you are an existing customer - you can unsubscribe in every message |
| Meeting our accounting, tax and legal duties | Legal obligation |
Who we share it with
We use a small number of trusted suppliers to run OpsWB. They may only process data on our instructions, under contract, and never for their own purposes.
| Supplier | What for | Where |
|---|---|---|
| Stripe | Card payments, payment links and subscription billing. Card details go straight to Stripe and are never stored by OpsWB. | UK / EU / US |
| Amazon Web Services | Application hosting, database storage and file storage. | UK / EU |
| Amazon SES | Sending service email. Customer newsletters are sent through the customer's own AWS account, not ours. | UK / EU |
| Meta Platforms | Only where a customer connects a Facebook Page or Instagram account to schedule their own posts. | EU / US |
We also share data where we are legally required to - for example with HMRC, or in response to a valid court order - and with professional advisers or a buyer if the business is ever sold, in which case we would tell you first.
Where your data is held
Your OpsWB data is stored on servers in the United Kingdom. Some of our suppliers operate globally, so a limited amount of data may be processed outside the UK. Where that happens we rely on UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses, so your data keeps the same protection it has here.
How long we keep it
| Data | How long |
|---|---|
| Your account and business data in OpsWB | For as long as your subscription is active. After you close your account we delete or anonymise it within 90 days, unless we must keep it for legal reasons. |
| Invoices and records we must keep for tax | Six years, as required by UK law. |
| Enquiries sent through this website | Up to 24 months after our last contact with you. |
| Website usage measurements | 13 months, then deleted automatically. |
| Security and audit logs | Up to 12 months, unless needed longer for an active investigation. |
| Backups | Deleted data may remain in encrypted backups for up to 35 days before being overwritten. |
How we protect it
- Everything is encrypted in transit with HTTPS, and stored encrypted at rest.
- Passwords are stored as one-way hashes - nobody at OpsWB can read them.
- Optional app-based two-factor authentication and passkeys, which you can enforce across your whole company.
- Granular permissions so each team member only sees the sections you allow, on web and mobile alike.
- Login and record-view auditing, so you can see who looked at what and when.
- Access to production systems is limited to staff who need it, and backups are encrypted.
If a breach ever affects your personal data and poses a risk to you, we will tell the ICO within 72 hours and let you know without undue delay.
Your rights
Under UK GDPR you have the following rights over your personal data. They are free to use, and we will respond within one month.
Get a copy
Ask what personal data we hold about you and receive a copy of it.
Correct it
Have inaccurate or incomplete information put right.
Delete it
Ask us to erase your data where we no longer need it.
Restrict or object
Ask us to pause our use of your data, or object to processing based on legitimate interests.
Portability
Receive the data you gave us in a common, machine-readable format.
Withdraw consent
Change your mind at any time where we relied on your consent.
To exercise any of these, email [email protected]. We may need to confirm who you are first.
If a business uses OpsWB to hold data about you
If you received an invoice, quote or newsletter from a business that runs on OpsWB, that business - not us - decides what data it holds about you and why. Please contact them directly to see, correct or delete it, and check their own privacy policy. If you cannot reach them, email us at [email protected] and we will help you get to the right place.
Cookies
This website sets only strictly necessary cookies and measures usage without cookies at all. Our cookie policy lists every cookie and what it does, and you can change your choice at any time.
Children
OpsWB is business software and is not intended for children. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, tell us and we will delete it.
Changes to this policy
We update this policy when what we do changes. The date at the top always shows the current version, and if a change materially affects you we will tell you by email or in the app before it takes effect.
Questions and complaints
Email [email protected] or use our contact page - we would always rather hear from you first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.