Privacy, in plain sight.

1. Who we are

Opergent is operated by Paywoke Sarl, a company incorporated in Luxembourg (RCS Luxembourg). Our registered address is Luxembourg, Grand Duchy of Luxembourg.

For the purposes of the General Data Protection Regulation (GDPR) (EU) 2016/679, Paywoke Sarl is the data controller for personal data processed through the Opergent platform.

Contact: hello@opergent.io

2. What data we collect

2.1 Waitlist and account data

• Email address (when you join the waitlist or create an account)
• Name (when provided during onboarding)
• IP address and browser user agent (collected automatically for security)
• Referral source (how you found Opergent)

2.2 Social media account data

When you connect your social media accounts (Instagram, TikTok, LinkedIn, X/Twitter, Facebook), we receive and store:

• OAuth access tokens and refresh tokens (encrypted at rest)
• Account identifiers, display names and profile information
• Publishing permissions granted by you

2.3 Content and brand data

• Brand voice descriptions and tone preferences you provide
• Content briefs, prompts and instructions you submit
• Photos, videos and documents you upload for AI processing
• Voice recordings you upload for voice cloning
• AI-generated content created on your behalf

2.4 Usage data

• Pages visited and features used within the platform
• Content approval and rejection actions
• Publishing schedules and posting history
• Error logs and performance data

2.5 Cookies and tracking

We use essential cookies only to maintain your session and preferences. With your consent, we may use analytics cookies to understand how the platform is used. We do not use advertising cookies or sell data to advertisers.

3. How we use your data

• To operate and deliver the Opergent platform and its features
• To generate AI content on your behalf using third-party AI services
• To publish content to your connected social media accounts when you instruct us to
• To communicate with you about your account, updates and beta programme
• To improve the platform based on usage patterns
• To comply with legal obligations and resolve disputes
• To prevent fraud, abuse and security threats

Legal bases (GDPR Article 6)

• Contract performance — processing necessary to deliver the service you signed up for
• Legitimate interests — security monitoring, fraud prevention, product improvement
• Consent — analytics cookies, marketing communications
• Legal obligation — compliance with applicable laws

4. Third-party processors

To deliver the Opergent service, we share data with the following third-party processors. All are bound by data processing agreements and appropriate safeguards.

For transfers of personal data outside the European Economic Area (EEA), we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission, or on the processor's adequacy decision where applicable.

5. Voice cloning and biometric data

If you use our voice cloning feature powered by ElevenLabs, you will upload audio recordings of your voice. This constitutes biometric data under GDPR and applicable laws.

• Voice recordings are used solely to create a personalised voice model for generating your audio content
• We process this data only with your explicit consent
• You may withdraw consent and request deletion of your voice model at any time
• Voice data is shared with ElevenLabs under their data processing agreement
• We do not use your voice data for any purpose other than generating content you explicitly request

6. AI-generated content

Content generated by Opergent using AI tools (Claude, Runway, HeyGen, ElevenLabs) is produced on your behalf based on your instructions and brand voice settings. You are responsible for reviewing all AI-generated content before it is published.

You retain ownership of content you create and upload. AI-generated content produced from your briefs and brand voice is assigned to you upon creation, subject to the terms of the underlying AI service providers.

7. Data retention

• Waitlist data — retained until you request deletion or the product launches
• Account data — retained for the duration of your account plus 90 days after deletion
• Generated content — retained for 12 months after creation, or until you delete it
• OAuth tokens — deleted immediately upon account disconnection or deletion
• Voice recordings — deleted upon your request or within 30 days of account closure
• Usage logs — retained for 90 days for security and debugging purposes

8. Your rights under GDPR

As a data subject under GDPR, you have the following rights:

To exercise any of these rights, email hello@opergent.io. We will respond within 30 days.

Luxembourg supervisory authority: Commission Nationale pour la Protection des Données (CNPD)

9. Data security

• All data is encrypted in transit using TLS 1.2 or higher
• OAuth tokens and secrets are encrypted at rest
• Platform infrastructure runs on Cloudflare's European (WEUR) region
• Access to personal data is restricted to authorised personnel only
• We conduct regular security reviews of our infrastructure and third-party integrations

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay.

10. Children's privacy

Opergent is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@opergent.io and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email (if you have an account) or by posting a prominent notice on our website. The "last updated" date at the top of this page reflects the most recent revision.

Continued use of Opergent after changes are posted constitutes acceptance of the updated policy.