Privacy, in plain sight.

1. Who we are

Opergent is operated by Paywoke Sarl, a company incorporated in Luxembourg (RCS Luxembourg). Our registered address is Luxembourg, Grand Duchy of Luxembourg.

For the purposes of the General Data Protection Regulation (GDPR) (EU) 2016/679, Paywoke Sarl is the data controller for personal data processed through the Opergent platform.

Contact: hello@opergent.io

2. What data we collect

2.1 Waitlist and account data

• Email address (when you join the waitlist or create an account)
• Name (when provided during onboarding)
• IP address and browser user agent (collected automatically for security)
• Referral source (how you found Opergent)

2.2 Social media account data

When you connect a social media account (for example LinkedIn or Instagram — the platforms available for connection are shown in-product), we receive and store:

• OAuth access tokens and refresh tokens (encrypted at rest)
• Account identifiers, display names and profile information
• Publishing permissions granted by you

2.3 Content and brand data

• Brand voice descriptions and tone preferences you provide
• Content briefs, prompts and instructions you submit
• Photos, videos and documents you upload for AI processing
• AI-generated content created on your behalf

2.4 Usage data

• Pages visited and features used within the platform
• Content approval and rejection actions
• Publishing schedules and posting history
• Error logs and performance data

2.5 Cookies and tracking

We use essential cookies only to maintain your session and preferences. With your consent, we may use analytics cookies to understand how the platform is used. We do not use advertising cookies or sell data to advertisers.

3. How we use your data

• To operate and deliver the Opergent platform and its features
• To generate AI content on your behalf using third-party AI services
• To publish content to your connected social media accounts when you instruct us to
• To communicate with you about your account, updates and beta programme
• To improve the platform based on usage patterns
• To comply with legal obligations and resolve disputes
• To prevent fraud, abuse and security threats

Legal bases (GDPR Article 6)

• Contract performance — processing necessary to deliver the service you signed up for
• Legitimate interests — security monitoring, fraud prevention, product improvement
• Consent — analytics cookies, marketing communications
• Legal obligation — compliance with applicable laws

4. Third-party processors

To deliver the Opergent service, we share data with the following third-party processors. All are bound by data processing agreements and appropriate safeguards.

Kling (video generation) is used only for Opergent's own brand-film production on a company-held account and processes no customer data; it is therefore not a sub-processor of your personal data.

For transfers of personal data outside the European Economic Area (EEA), we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission, or on the processor's adequacy decision where applicable.

5. AI-generated content

Content generated by Opergent using AI tools (Claude, Google Vertex AI, OpenAI, ElevenLabs) is produced on your behalf based on your instructions and brand voice settings. You are responsible for reviewing all AI-generated content before it is published.

You retain ownership of content you create and upload. AI-generated content produced from your briefs and brand voice is assigned to you upon creation, subject to the terms of the underlying AI service providers.

6. Data retention

• Waitlist data — retained until you request deletion or the product launches
• Account data — retained for the duration of your account plus 90 days after deletion
• Generated content — retained for 12 months after creation, or until you delete it
• OAuth tokens — deleted on account closure and on request
• Usage logs — retained for 90 days for security and debugging purposes

7. Your rights under GDPR

As a data subject under GDPR, you have the following rights:

To exercise any of these rights — including erasure or a machine-readable export of your data — email hello@opergent.io. We fulfil such requests within 30 days.

Luxembourg supervisory authority: Commission Nationale pour la Protection des Données (CNPD)

8. Data security

• All data is encrypted in transit using TLS 1.2 or higher
• OAuth tokens and secrets are encrypted at rest
• The application runs on Vercel with data stored in Supabase; the opergent.io marketing site is served via Cloudflare's European (WEUR) region
• Access to personal data is restricted to authorised personnel only
• We conduct regular security reviews of our infrastructure and third-party integrations

In the event of a data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay.

9. Children's privacy

Opergent is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at hello@opergent.io and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email (if you have an account) or by posting a prominent notice on our website. The "last updated" date at the top of this page reflects the most recent revision.

Continued use of Opergent after changes are posted constitutes acceptance of the updated policy.