Privacy policy

Who we are

Josef Volpin, sole trader trading as “Ophanim AI”, registered office at Via C. Beccaria 14, 35125 Padua (PD), Italy, VAT no. 05775320285. You can reach us about anything in this policy by post to Josef Volpin, Ophanim AI, Via C. Beccaria 14, 35125 Padua (PD), Italy.

Two roles

• For the people who use the OS (our clients and their teams), we decide how their account data is used: we are the controller.
• For the people our clients deal with (their leads, the people who comment on their posts or write to their Instagram account), each client decides why and how that data is used, and we process it on their behalf and on their instructions. If you commented on or wrote to a business that uses the OS, that business is the controller of your data, and you can also contact them.
• For our own Instagram accounts, we are the controller of the data of the people who comment on or write to them.

What we collect

• Account data: name, email address, password (stored by our authentication provider, never readable by us), the workspace you belong to, and the settings you choose.
• Work you enter or connect: leads and notes, calls and their outcomes, bookings from a connected calendar tool, call transcripts if you connect a recorder, posts and their published results, and files you upload.
• From a connected Instagram account (only after its owner connects it and only what Instagram’s permissions allow): the account’s id, username, name and profile picture; its posts and their captions and links; the comments under them; the messages it receives and sends; and an access token, which we keep encrypted.
• About people who comment or write to a connected account: their Instagram-scoped id, username and name as Instagram provides them, the text of their comment or message, whether they follow the account when the account owner chose to check it, and an email address only if they type it into the conversation themselves.
• Link clicks: when someone opens a link we sent in a message, the time and the browser type. We do not store IP addresses for these clicks.
• Payments: handled by Stripe. We receive whether a payment succeeded and its amount, never full card details.

The free tools

Anyone can use the Pipeline Leak Finder and the Call Autopsy at app.ophanimai.com/tools, without an account. For them we are the controller.

• Pipeline Leak Finder: the numbers you type are worked out in your browser. If you ask for the fixes, we keep your email and those numbers.
• Call Autopsy: the transcript you paste is sent to Anthropic’s API, which does not use it to train models, to write your report, and we do not store it. We keep your email and the kinds of objection the report found (price, timing and so on), never the words of the call. Please take names and anything private out before you paste; you confirm the transcript is yours to share.
• We use your email to follow up about Ophanim, on the basis of the request you made by giving it. You can ask us to delete it at any time by post to Josef Volpin, Ophanim AI, Via C. Beccaria 14, 35125 Padua (PD), Italy.
• To hold each tool to a few uses a day, we keep a one-way hash of your network address, never the address itself.

Why we use it, and on what basis

• To provide the OS and its features to our clients, under our contract with them (GDPR art. 6(1)(b)).
• To answer people who comment on a post with a keyword, or write to an account, as they asked, and to let the account owner follow up on that conversation, on the account owner’s legitimate interest in responding to people who contacted them (art. 6(1)(f)).
• To keep the service secure, prevent abuse and fix problems, on our legitimate interest (art. 6(1)(f)).
• To keep accounting and tax records, as the law requires (art. 6(1)(c)).

We never message anyone who has not commented on or written to the account first, we follow Instagram’s messaging limits, and we do not sell personal data or use it for advertising.

Artificial intelligence

Some features use AI to draft text, summarise or answer questions inside the OS. The text needed for that is sent to our AI provider, Anthropic, which does not use it to train its models. AI never sends a message to anyone on its own unless the workspace has deliberately switched that on for its Instagram conversations, and a person can always take over.

Who we share it with

Only the providers that run the service for us, each bound to protect the data and use it only for that:

• Supabase (database and sign-in) and Vercel (hosting)
• Inngest (scheduled and background tasks)
• Anthropic (AI features)
• Meta Platforms (Instagram, for the features above)
• Stripe (payments)
• Tools a workspace chooses to connect, such as Calendly, Cal.com, Fathom, Blotato or Apify, for that workspace only

Some of these providers process data outside the European Union, mainly in the United States. Where they do, we rely on the safeguards they offer under the GDPR, such as the European Commission’s Standard Contractual Clauses or the EU-US Data Privacy Framework.

How long we keep it

• Account and workspace data: while the client works with us, then deleted when the workspace is closed.
• Instagram data: while the account stays connected and the workspace uses the feature. When the owner removes our app from Instagram the token is deleted at once; the rest is deleted on request (see below) or when the workspace is closed.
• Accounting records: for as long as Italian law requires.

Your rights

You can ask to see the data we hold about you, to correct it, to delete it, to restrict or object to its use, or to receive it in a portable form. Write to us by post to Josef Volpin, Ophanim AI, Via C. Beccaria 14, 35125 Padua (PD), Italy. If the data came from a business that uses the OS, we will pass your request to them and help them answer it. You also have the right to complain to the Italian data protection authority, the Garante per la protezione dei dati personali.

To have your Instagram data deleted, see Delete your data.

Security

Access tokens and other credentials are encrypted. Each workspace sees only its own data, enforced in the database. Accounts can be protected with two-factor authentication.

Changes

If this policy changes, the date at the top changes with it, and clients are told of anything significant.