Draft status
This privacy policy is a draft for attorney review. Public privacy promises must match the product's actual data collection, storage, sharing and retention behavior.
Data OBRYX may process
Account data may include name, email, organization, role and authentication records.
Workspace data may include projects, tasks, schedules, documents, photos, compliance records, client approvals, material requests, delivery proofs and audit logs.
Operational data may include device, browser, IP-derived security signals, logs, usage events, legal acceptance records and support communications.
Use of data
Data is used to provide the workspace, enforce permissions, secure accounts, support customers, process subscriptions and improve reliability.
Customer project files should not be used for unrelated marketing or model training unless a separate approved policy explicitly permits it.
Vendors
Current planned vendors include Supabase for database/auth/storage, Vercel for hosting, Resend for transactional email using KSP Dominion domains, Stripe for billing when approved, and Tavily for web/search-enabled features when enabled.
Vendor use must remain documented and updated before public launch.
AI and model training
Customer project files, documents, photos and workspace records should not be used to train public or third-party AI models unless a separate approved agreement expressly permits it.
AI vendors, if enabled, must be listed as subprocessors and configured so customer data use matches the public privacy promise and enterprise DPA.
Retention and export
Retention, deletion, export and offboarding windows must be finalized before official launch and app-store submission.
Enterprise retention or DPA terms must be handled through the signed agreement.
Account deletion requests must be supported through an in-app path and a public web request path before App Store or Google Play submission.