Privacy Policy
Effective date: [Insert effective date before publication]
1. Introduction
This Privacy Policy describes how OPRYXA processes information when you use its prospecting and campaign-monitoring application. It applies to the OPRYXA website and application.
2. Information We Collect
When you register, OPRYXA collects your name, email address, and password. Passwords are stored as bcrypt hashes. The application also stores your account identifier, selected plan, role, timezone, email-verification status, notification preferences, onboarding responses (service, industries, and locations), account status, and account timestamps.
OPRYXA records usage and activity needed to operate the product, including sign-up, search, campaign creation, saved-lead, export, opportunity-view, plan-upgrade, and subscription-cancellation events. It also records per-period usage such as searches, businesses processed, scans run, website analyses, and web-discovery calls.
3. Account and Authentication Data
To provide sign-in and account security, OPRYXA processes login email addresses, failed-login attempt records, authentication-session identifiers, hashed refresh tokens, session creation, expiry, and last-use times, IP address, and user-agent information. Email-verification and password-reset records contain a hashed token, user identifier, creation time, expiry time, and used status.
OPRYXA uses authentication cookies for access and refresh tokens, as well as a CSRF cookie used with a request header to protect state-changing requests. The access and refresh cookies are marked httpOnly, secure, and SameSite=None; the CSRF cookie must be readable by the application so it can be sent in the header.
4. Lead and Business Data
When you search or run a campaign, OPRYXA processes the category, markets, filters, campaign rules, and scan frequency you provide. It stores search history and campaign workflow records, including campaign names, locations, filters, schedules, scan outcomes, and related opportunity records.
OPRYXA may store Place IDs and business names, markets, website-status classifications, opportunity signals and evidence, and derived website-analysis results. Saved leads can include business name, market, pipeline status, notes, tags, follow-up date, list, campaign association, opportunity association, and timestamps. Outreach activity can include the outreach type, notes, and occurrence time. Lists and saved filter presets are also stored when created.
Search and campaign scans obtain business information from Google Places when configured, or OpenStreetMap-based services as a fallback. Google business details displayed for a saved lead are fetched live using the Place ID. OPRYXA excludes Google address, phone, rating, review-count, map URL, and website fields from its CSV exports.
5. How We Use Information
OPRYXA uses information to create and secure accounts, verify email addresses, reset passwords, provide searches and campaign monitoring, maintain lead workflows, enforce plan limits, generate exports, operate billing, deliver in-app and email notifications, and administer the service.
Website-analysis features request business website URLs and inspect their public responses for signals such as reachability, redirects, contact methods, booking indicators, and social links. If you use the optional outreach-draft feature, OPRYXA sends the business name, selected service, and opportunity signals in a prompt to its configured AI integration to generate a draft.
6. Payments and Subscriptions
Paid subscriptions use Razorpay. When you start a subscription, OPRYXA sends Razorpay the selected plan and a note containing your OPRYXA user identifier and selected plan. The checkout is loaded from Razorpay and is prefilled with your name and email address. OPRYXA stores subscription and payment-event metadata, including Razorpay subscription, plan, customer, and payment identifiers, subscription status and dates, and plan information. The current implementation does not store card details.
7. Third-Party Services
OPRYXA uses third-party services when their configuration is enabled: Google Places API for business discovery and live place details; Nominatim and Overpass/OpenStreetMap services as a discovery fallback; Tavily for website discovery and entity resolution; Razorpay for subscriptions and payment checkout; and Resend for transactional email. If Resend is not configured, the application can send email through an Emergent-managed email service. The optional outreach-draft feature uses an Emergent LLM integration configured with an OpenAI model.
The frontend also loads font resources from Google Fonts. These providers process requests made to their services under their own terms and privacy notices.
8. Cookies and Similar Technologies
OPRYXA uses the authentication and CSRF cookies described above for session management and request protection. The frontend also initializes PostHog product analytics at https://ap.emergent.sh. Its current configuration captures page views and page interactions and enables session recording; the inspected browser stores a PostHog identifier in local storage and a browser cookie. The reviewed frontend does not provide an analytics consent prompt or opt-out control.
9. Analytics and Data Sharing
OPRYXA stores the product activity events and usage records described in this policy in its application database. The frontend also sends product analytics to the configured PostHog service. Funnel events sent directly by the application contain the event name only. The configured PostHog client additionally enables page-view capture, autocapture, and session recording; those features can send interaction and session data. This implementation does not specify PostHog retention settings or provide an analytics consent prompt or opt-out control. Review the applicable consent requirements and PostHog project privacy settings before publication.
OPRYXA sends information to the providers identified above when required for the feature you use, including search inputs to discovery providers, business information used for Tavily website discovery, website URLs to the websites being analyzed, email recipient and message content to the configured email provider, payment and subscription information to Razorpay, and outreach-draft prompt content to the configured AI integration. OPRYXA also makes information available to authorized administrators: administrators can view user account data excluding password hashes, current-period usage, subscription records, campaigns, saved-lead counts, aggregated metrics, campaign health, provider-failure counts, and audit-log entries for administrative changes.
10. Data Security
The implementation includes bcrypt password hashing, hashed verification, reset, and refresh tokens, signed JWTs, session revocation and refresh-token rotation, CSRF checks for cookie-authenticated state-changing requests, IP-based and user-based rate limiting, role checks for administrator routes, user-scoped database queries for application records, and API security headers. These measures help protect information but do not guarantee absolute security.
11. Data Retention
The implementation automatically expires rate-limit records when their reset time is reached, authentication sessions when they expire, password-reset tokens when they expire, email-verification tokens 24 hours after expiry, and search-result snapshots seven days after creation. Individual searches, campaigns, leads, notes, lists, and filter presets can be deleted through available application actions.
No general retention period is specified in the implementation for account records, search-history entries, campaigns, saved leads, opportunities, notifications, analytics events, billing records, administrative records, or provider-failure records.
12. Data Deletion and Your Choices
You can update your name, timezone, notification preferences, and password in the application. You can delete individual search-history entries, campaigns, saved leads, notes, lists, and filter presets. Eligible users can export lead-workflow data as CSV.
The reviewed implementation does not provide an account-deletion feature or specify an account-deletion request process. Account-deletion instructions and a privacy contact must be finalized before this policy is published.
13. Children's Privacy
OPRYXA is a business prospecting application. The implementation does not include age-verification or parental-consent features, and it is not designed for children.
14. International Data Transfers
The implementation does not specify where OPRYXA data is hosted or where its providers process data. Use of the third-party services listed above may involve processing in locations determined by those providers.
15. Changes to This Privacy Policy
OPRYXA may update this Privacy Policy by posting an updated version on this page and revising the effective date.
16. Contact Information
Privacy contact details have not been specified in the implementation. Insert an approved privacy contact method before publication.