Legal transparency

Privacy Policy

Version 1.1

Privacy Policy

Version 1.1

Effective date: as displayed in the product when you accept this Policy

1. Introduction

This Privacy Policy explains how Opcilo Solutions (“Opcilo”, “we”, “us”), a registered trade name of Hoshaimy Technologies Inc., an Alberta corporation with its registered office in Calgary, Alberta, T1Y 5K3, Canada, under Canadian Business Number 793535048, collects, uses, discloses, and protects personal data in connection with the Opcilo platform, websites, and related services (the “Service”). For privacy questions, contact privacy@opcilo.com, or our data protection contact at dpo@opcilo.com.

2. Scope and roles

This Policy applies to individuals who create accounts, join workspaces, visit our websites or verification pages, or whose personal data appears in Customer Content processed on the Service.

Where an Organization customer determines the purposes and means of processing Customer Content, that Organization is the controller of that content and its own privacy notice may also apply. In that case, Opcilo acts as a processor under the Data Processing Addendum to the extent applicable.

3. Personal data we collect

Depending on how you use the Service, we may process:

Account and identity data, such as name, email address, authentication identifiers issued by our identity provider, organization or workspace membership, and role.

Legal profile and consent records, such as the country you confirm for legal documents, the document versions you accept, acceptance time, method, IP address, and display language.

Billing and subscription data, such as plan, invoices, and payment status. Payment card details are handled by our payment processor; we do not store full card numbers.

Technical and usage data, such as IP address, device and browser information, approximate location derived from IP address, security logs, feature usage, and cookie preference choices.

Customer Content you upload or generate, including documents, invoices, seals, verification metadata, messages, and related files.

Support correspondence you send to us.

4. Why we process personal data

We process personal data to:

provide, maintain, secure, and improve the Service;

authenticate users and administer workspaces;

record, evidence, and enforce legal acceptances;

bill and collect fees;

detect, investigate, and prevent abuse or security incidents;

send service-related communications; and

comply with legal obligations.

Depending on your location, the legal basis may include performance of a contract, legitimate interests (such as securing and improving the Service), consent (for example, non-essential cookies), or a legal obligation.

5. Cookies and similar technologies

Necessary cookies and similar technologies support sign-in, security, language, and theme preferences. Analytics and marketing technologies are used only if you opt in through the cookie preference controls. Further detail is set out in the Cookie Policy.

6. Disclosures

We may disclose personal data to:

service providers and subprocessors that host, store, send messages, authenticate users, process payments, or provide monitoring, under appropriate contracts. A current list of subprocessors is available at https://opcilo.com/legal/subprocessors;

Organization administrators, for activity within their workspace;

professional advisers and competent authorities, where required by law or to protect rights, safety, or the Service; and

a successor entity in connection with a corporate transaction, subject to appropriate safeguards.

We do not sell personal data, and we do not “share” personal data for cross-context behavioral advertising as those terms are defined under applicable law.

7. International processing and data location

The Service is operated using cloud infrastructure provided by our hosting subprocessors (for example, Microsoft Azure). Personal data may be hosted and processed in one or more regions, and may be processed in countries other than the country where you are located. Where a cross-border transfer requires a safeguard under applicable law, we implement an appropriate mechanism, such as European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, an adequacy determination, or the transfer conditions of an applicable data protection law, together with appropriate security measures. You may request more information about the location of processing and the safeguards in place by contacting privacy@opcilo.com.

8. Retention

We retain personal data only as long as needed for the purposes described in this Policy, and then delete or anonymize it. Indicative periods are:

Account and profile data: for the life of your account, then deleted or anonymized within a commercially reasonable period after account closure.

Legal consent records: retained as audit evidence for the period required by applicable law after the related account activity, typically several years.

Billing and tax records: retained for the period required by tax and accounting law in the relevant jurisdiction (commonly up to ten years).

Customer Content: retained according to product settings, plan rules, and your deletion requests, subject to legal holds and time-limited residual copies in secure backups that are overwritten on a rolling basis.

Security and audit logs: retained for a limited period appropriate to security and reliability needs.

9. Security

We apply access controls, encryption in transit, and operational security practices appropriate to the Service. Please report suspected security issues to security@opcilo.com or through the channels published by Opcilo.

10. Your rights

Subject to applicable law—including laws applicable in Gulf Cooperation Council states, the European Union and United Kingdom, the United States, Canada, and other jurisdictions where you reside—you may have rights to request access, correction, deletion, restriction, portability, or objection, and to withdraw consent where processing is based on consent. Region-specific rights and how to exercise them, where applicable, are described in the regional section below. To exercise a right, contact privacy@opcilo.com; we will respond within the period required by applicable law and will not discriminate against you for exercising a right.

If your data appears in Customer Content controlled by an Organization, please contact that Organization’s administrator in the first instance. You may also have the right to lodge a complaint with a competent supervisory authority where available.

11. Children

The Service is not directed to children under sixteen (16), or under a higher age if required by local law. We do not knowingly create accounts for children.

12. Automated processing

Core sealing features do not make decisions producing legal or similarly significant effects about you solely by automated means without meaningful human involvement. We may use automated processing for security, fraud prevention, and reliability.

13. Changes

We may update this Policy from time to time. Material changes may require renewed acceptance or will be communicated as configured when the updated version is published.

14. Contact

For privacy inquiries, contact privacy@opcilo.com or our data protection contact at dpo@opcilo.com, or use the support or contact channels published on the Opcilo website or in the product.