Privacy Policy
Last updated: 8 September 2026
We set no cookies until you sign in, load no third-party scripts, and run no analytics. There is no tracking to opt out of and no consent banner, because there is nothing to consent to. Everything below describes data you give us deliberately by using the product.
1. Who is responsible
Antypas Ventures is the data controller for personal data processed by Opterva. For any question about this policy, or to exercise any right below, write to support@opterva.com.
2. What we hold, and why
- Your name and email address
- To create your account, identify you to your teammates, and send you service email. Necessary to perform our contract with you.
- Your password
- Stored only as a scrypt hash. We never hold the password itself and cannot recover it — only reset it.
- Session records
- A hashed session identifier, your IP address, your browser's user-agent string, and when the session was last active. Needed to keep you signed in and to let you see and revoke your own sessions. Our legitimate interest in securing accounts.
- Activity trail
- Who changed what, when, and from which IP address. This is append-only and cannot be edited. Needed to give you an auditable record of your own workspace and to investigate misuse. Our legitimate interest in security and accountability.
- Workspace and membership
- Which organisations you belong to and your role in each. Necessary to perform our contract.
- Your product and campaign content
- What you enter about the products you are launching. Necessary to provide the service.
- Invitations
- The email address of anyone you invite, so we can send them the invitation.
3. What we do not do
We do not sell personal data. We do not use your content to train models. We do not run advertising, profiling or automated decision-making that produces legal or similarly significant effects. We do not share your content with the destinations in our registry — if something is submitted to a destination, you submit it.
4. Who processes it for us
- DigitalOcean
- Hosting and encrypted offsite backups. Servers and backup storage are in Amsterdam, in the EU.
- Resend
- Delivery of service email — address verification, password resets and invitations. Receives the recipient address and the message.
- Let's Encrypt
- Issues the certificate securing this site. Receives no personal data.
These are our only processors. There are no analytics, advertising, session-replay or customer-messaging services in the product.
5. How long we keep it
- Account data
- For as long as your account exists. On deletion it is removed after a short grace period during which you can cancel the request.
- Security-relevant activity records
- 400 days, then automatically redacted.
- Routine activity records
- 90 days, then automatically redacted.
- Sessions, invitations and reset tokens
- Expire automatically and are removed by the database when they do.
- Backups
- Encrypted offsite copies are kept for 30 days and then deleted. A deletion you request will persist in backups until those copies age out.
Redaction is not deletion of the record: the fact that something happened is kept for the integrity of the audit trail, while the personal detail inside it is removed.
6. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format.
Two of those are built into the product and need no request: you can export everything we hold about your workspace as a structured file, and you can delete your account yourself, from account settings, with an impact summary shown before you confirm. For anything else, write to support@opterva.com.
If you are in the UK or the EU and think we have handled your data badly, you can complain to your national data protection authority. We would rather you told us first.
Two of those are built into the product and need no request: you can export everything we hold about your workspace as a structured file, and you can delete your account yourself, from account settings, with an impact summary shown before you confirm. For anything else, write to support@opterva.com.
If you are in the UK or the EU and think we have handled your data badly, you can complain to your national data protection authority. We would rather you told us first.
7. Security
Traffic is encrypted in transit. Passwords are hashed with scrypt at the parameters OWASP recommends. The database is not reachable from the internet. Access to customer data by our staff is recorded in your own activity trail before it happens, so you can see it. Backups are encrypted and stored separately from the server they protect.
No system is perfectly secure. If we ever suffer a breach affecting your personal data, we will tell you and the relevant authority as the law requires.
No system is perfectly secure. If we ever suffer a breach affecting your personal data, we will tell you and the relevant authority as the law requires.
8. International transfers
Our servers and backups are in the EU. Service email is delivered by a processor that may handle it outside the EU under standard contractual clauses.
9. Children
Opterva is a business tool and is not intended for anyone under 16. We do not knowingly collect their data.
10. Changes
If we change how we use personal data we will update this page and, where the change materially affects you, tell you directly. The date at the top always reflects the current version.