Privacy policy

1. Who this policy covers

This policy applies to two kinds of users: the businesses ("workspaces") that sign up for OPleo, and the employees those workspaces invite into the employee self-service portal. Each workspace's data is isolated from every other workspace; employees can only see records tied to their own employer.

2. Information we collect

We collect the following, depending on how you use OPleo:

• Account information: name, email address, and password (stored as a salted hash, never in plain text).
• Business and invoice data: customer names, addresses, NTN and tax details, invoice line items, amounts, and payment status, entered by your workspace.
• Employee records: name, contact details, employee code, role, salary and leave policy fields, and the portal email an employee uses to sign in — entered by the workspace administrator.
• Attendance data: check-in and check-out timestamps, sourced from biometric device syncs, USB imports, or the employee portal's remote clock-in. For biometric devices, OPleo stores the device-assigned user ID or PIN and punch timestamps it reports — it does not store fingerprint or facial biometric templates, which stay on the physical device.
• Documents: files employees or administrators upload to an employee's record (for example, ID copies or certificates).
• Usage data: basic, aggregated analytics about how the product is used, collected via Vercel Analytics.

3. How we use this information

We use collected information to:

• Operate the invoicing, attendance, payroll, and employee portal features you use.
• Calculate payroll and leave balances from attendance and workspace policy settings.
• Secure your account, detect abuse, and maintain the reliability of the service.
• Respond to support requests sent through the contact page.

4. Sharing of information

We do not sell personal data. We share information only where it is necessary to provide the service:

• With your own attendance hardware: cloud-push and ADMS-capable devices sync directly with no local software required, and legacy devices without cloud support may use a local connector on your network that you control.
• With infrastructure providers who host the database, application, and analytics on our behalf, under contracts that restrict their use of your data to providing that infrastructure.
• Where required to comply with a legal obligation or valid request from a competent authority.

5. Data retention

Business and employee records are retained for as long as your workspace is active. Attendance history is available through the employee portal for the most recent 90 days, and remains accessible to administrators for as long as it is retained in the workspace. If a workspace is closed, associated data is deleted or anonymized within a reasonable period, except where we are required to retain records for tax or legal purposes.

6. Security

Passwords are hashed, not stored in plain text. Device bridge and enrollment tokens are stored as hashes, never in reverse-readable form. Every workspace's data — invoices, employees, attendance, documents — is scoped to that workspace at the database level, so one company's data is not reachable from another company's account. No method of transmission or storage is perfectly secure, and we can't guarantee absolute security.

7. Cookies and analytics

OPleo uses session cookies required to keep you signed in, and Vercel Analytics to understand aggregate, anonymized product usage. We do not use third-party advertising trackers.

8. Your rights

You can ask us to access, correct, or delete personal information we hold about you by writing to us using the contact page. Where information is entered by your employer (for example, employee records), some requests may need to go through your workspace administrator, since they control that data.

9. Children

OPleo is a business tool and is not directed at, or intended for use by, children. We do not knowingly collect personal information from anyone under the age of 18.

10. Changes to this policy

We may update this policy as the product changes. If we make material changes, we'll update the date at the top of this page.

11. Contact

Questions about this policy can be sent to hello@bridgehomies.com, or through the contact page.