Privacy policy.

Business profile answers you enter (industry, headcount, revenue band, digital footprint, insurance status, claims history), account name and email, waitlist submissions, support tickets, and basic request metadata (IP truncated where logged, user-agent, coarse region). The current product does not connect to accounting, bank, or POS tools. We do not collect biometric or special-category personal data.

To compute your Opal Score, quantify coverage gaps, match protection products, run pilot monitoring updates you request, send transactional email (score ready, invite, support), and operate the service securely (auth, rate limits, audit logs). We never sell or resell your data. We do not use customer profile data to train third-party foundation models.

After sign-in, a short-lived JWT and basic user object are stored in your browser's sessionStorage (cleared when the tab/window closes). This is not a tracking cookie. See also the cookie policy.

Encrypted in transit (TLS). Application data is stored on Google Cloud in asia-southeast1 (Singapore): Cloud Run for the API, Cloud SQL for Postgres, Secret Manager for credentials. The marketing/app frontend is served via Vercel. Backups stay in the same region where configured. Processors we use for the live product include Google Cloud, Vercel, Resend (email), and OpenAI (score/gap narrative generation under our API key — not for model training of your data by us).

Account and score history are kept while your pilot or paid account is active. Waitlist rows are kept until you ask us to delete them or we close the list. Support tickets and audit events are retained for security and ops. You may request deletion; we will erase or anonymise personal data except where we must retain records for legal/security reasons.

Under Singapore's PDPA you may request access, correction, or withdrawal of consent where applicable. Email us; we aim to reply within 30 days. If you are in the EU/UK, GDPR-equivalent access/erasure rights apply to the extent we process your data. This notice is product-honest for the GFH pilot — it is not a substitute for counsel review before scale or incorporation.

Data protection / deletion: hello@tryopal.com. Pre-incorporation operator: Team Titan / OPAL pilot (Singapore-focused).