1. Who We Are and What This Policy Covers
OpsCompanion, Inc. (“OpsCompanion,” “we,” “us,” or “our”), a Delaware corporation located at 211 N Broadway, One Metropolitan Square, Saint Louis, Missouri 63102, provides Standpipe, software that helps organizations govern and secure their use of artificial intelligence (“AI”) applications and agents. This Privacy Policy describes how we collect, use, disclose, and protect personal information when we decide how and why that information is processed, including when you:
(a) visit opscompanion.ai or another website that links to this Privacy Policy (the “Website”);
(b) communicate with us, attend our events, or receive our marketing communications;
(c) act as a business contact of one of our customers, prospective customers, partners, or vendors;
(d) administer or use an account for the Cloud Console; or
(e) participate in an Assessment.
Defined terms. Capitalized terms used but not defined in this Privacy Policy have the meanings that the Standpipe Terms of Service at [https://opscompanion.ai/terms-of-service] (the “Terms”) give them.
What this Privacy Policy does not cover. Our business customers deploy the Software on Endpoints they own, control, or are authorized to monitor. Customers determine the purposes and configuration of the inspection performed by the Software and are responsible for providing legally required notices and obtaining applicable consents. Customer Data is governed by our agreements with customers, including our Data Processing Addendum, and by the customers' own privacy notices. If your employer or another organization has deployed Standpipe on a device you use, please direct questions and requests concerning Customer Data to that organization. Section 4 explains what the Software processes locally and what information may be transmitted to OpsCompanion.
2. Personal Information We Collect
Information you provide to us.
(a) Contact and professional information, such as your name, email address, telephone number, company, and job title.
(b) Account information for the Cloud Console, such as administrator names, email addresses, and single sign-on identifiers.
(c) Billing information, such as billing contacts, billing address, and subscription and invoice records. Our payment processor, Stripe, collects and processes payment card information, and we do not receive or store full payment card numbers.
(d) Assessment enrollment information, such as your name and email address, your organization’s industry and business type, its number of devices, its concerns about AI use, and the operating systems and devices it uses.
(e) Communications, such as support requests, feedback, survey responses, and the content of your messages to us.
Information we collect automatically on the Website and Desktop Application. When you visit the Website or use our Desktop Application, we and our service providers may automatically collect information about your device and interactions, including browser type, operating system, Internet Protocol (IP) address, approximate location derived from your IP address, referring websites, pages visited, application usage, and diagnostic information. We use analytics and, where enabled, session recording technologies to understand how users interact with the Website and Desktop Application, improve functionality, and identify technical issues. Session recordings may capture interactions such as mouse movements, clicks, scrolling, navigation, and form interactions, depending on the configuration of those technologies. Section 6 describes these technologies and your available choices.
Information from the Services that we use for our own purposes. We collect and use account, subscription, and licensing information, including customer account identifiers and the number of active Endpoints, to administer accounts, manage subscriptions, and process billing. We may also use Cloud Console access and authentication records to maintain the security and integrity of our systems. In accordance with Section 9.3 of the Terms, we may derive aggregated and de-identified Usage Data from Service Data to operate, secure, maintain, and improve our products and services and prepare aggregated industry reports. Usage Data does not identify any Customer, Authorized User, Endpoint User, or Endpoint, and we do not attempt to re-identify it.
Information from other sources. We may receive personal information from identity and authentication providers when you access the Cloud Console, from referral and business partners who introduce you to us, from customers who designate individuals as account administrators, and from publicly available sources, such as company websites and professional directories.
3. How We Use Personal Information
We use personal information to:
(a) provide, operate, and maintain the Website and the Services, manage accounts, and process payments and billing;
(b) provide support and respond to your requests;
(c) conduct Assessments and follow up with participating organizations;
(d) send you service communications, such as security notices, product updates, and notices of changes to our terms;
(e) send you information about our products and events, which you may opt out of receiving at any time;
(f) understand and improve the Website and the Services, including through analytics and session replay, and develop new features using de-identified data;
(g) secure our systems, detect and prevent fraud and abuse, and enforce our agreements;
(h) comply with law, respond to legal process, and establish, exercise, or defend legal claims; and
(i) carry out any other purpose with your consent or at your direction.
We do not use Customer Data to train, fine-tune, or otherwise modify any AI or machine-learning model, except Feedback Submissions that a customer authorizes for that purpose under Section 9.4(b) of the Terms. We maintain and use de-identified information only in de-identified form and do not attempt to re-identify it, except as law permits to test our de-identification processes.
4. How Standpipe Handles Data
The Software runs on Endpoints that customers own, control, or are authorized to monitor. The Software identifies traffic directed to Third-Party AI Services, decrypts and inspects that traffic locally, and enforces customer-configured Policies to allow, warn, log, redact, mask, or block content. Traffic that the Software does not classify as directed to a Third-Party AI Service is not decrypted.
The Software inspects prompts, responses, files, and other Endpoint Content locally. The Software is configured not to transmit this content to OpsCompanion or its service providers, except for customer-submitted Feedback Submissions and content incidentally captured in crash or diagnostic data. We may also view Endpoint Content during customer-initiated Support sessions. Content received through diagnostics or viewed during Support is used solely to diagnose and correct reported issues, and any copies received are deleted within ninety (90) days. Customers may separately authorize the use of Feedback Submissions to evaluate and improve detection rules and models under Section 9.4(b) of the Terms.
The Software transmits Service Data to the Cloud Console or to Customer-Designated Destinations, where configured. Service Data may include device and user identifiers, AI services accessed, account types, timestamps, Policy matches, detection categories, enforcement actions, software versions, and diagnostic information. Routine Service Data excludes prompt and response bodies, file and message contents, underlying sensitive data values, and customer-specific file paths, URL paths, and resource locations. Authorized Users can review Service Data, including activity attributed to individual Endpoint Users. We process Service Data on the customer's behalf under our agreements with them.
5. How We Disclose Personal Information
We disclose personal information to:
(a) service providers that perform services for us under contracts that limit their use of the information, including providers of hosting, payment processing, Website analytics and session replay, email and productivity software, customer relationship management, support ticketing, crash reporting, software licensing, and performance monitoring;
(b) your organization, if you are an administrator or user of an account that your organization controls;
(c) referral and consulting partners that introduced you to us or with which you ask us to work;
(d) professional advisors, such as lawyers, accountants, auditors, and insurers;
(e) government authorities and other persons when we believe in good faith that disclosure is required by law or legal process, or is necessary to protect the rights, property, or safety of OpsCompanion, our customers, or others;
(f) parties to a corporate transaction, such as a financing, merger, acquisition, or sale of assets, or in bankruptcy, subject to confidentiality obligations; and
(g) other persons with your consent or at your direction.
We do not sell personal information, we do not share personal information for cross-context behavioral advertising, and we do not process personal information for targeted advertising, as those terms are defined in the privacy laws of the states of the United States.
6. Cookies, Analytics, and Session Replay
We and our service providers use cookies, local storage, email pixels, and similar technologies to operate the Website, remember preferences, analyze usage, measure email engagement, and record sessions where enabled. Where required by law, we obtain consent before using non-essential technologies. You can manage your preferences through the Website's Cookie Settings or your browser settings. Our Cookie Policy, https://opscompanion.ai/cookie-policy, provides further details.
Do Not Track and Global Privacy Control. Because no common industry standard exists for responding to “Do Not Track” signals from web browsers, the Website does not respond to them. We treat a Global Privacy Control signal from your browser as a request to opt out of any sale or sharing of your personal information for the browser that sends it, although we do not sell or share personal information. We do not permit third parties other than our service providers to collect personal information about your online activities over time and across different websites through the Website.
7. Retention
We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, considering the nature and sensitivity of the information, our contractual and legal obligations, and the need to resolve disputes and enforce our agreements. For example, we retain Assessment notes and business contact information for up to one (1) year after the Assessment ends; account and billing records for the life of the account and thereafter for seven (7) years to meet tax and accounting obligations; and Website session recordings for thirty (30) days. Our agreements with customers govern the retention of Customer Data.
8. Security
We maintain administrative, technical, and physical safeguards designed to protect personal information, and an independent auditor examines our security controls under the System and Organization Controls (SOC) 2 framework. No method of transmission or storage is completely secure, and we cannot guarantee the security of personal information.
9. Your Rights and Choices
Marketing. You may opt out of marketing emails by using the unsubscribe link in any marketing email or by contacting us under Section 13. We will continue to send you service communications.
Requests concerning your personal information. Subject to verification of your identity and to the exceptions that law permits, you may ask us to (a) confirm whether we process your personal information and give you access to it; (b) correct inaccurate personal information; (c) delete your personal information; and (d) provide you a copy of your personal information in a portable format. We honor these requests from individuals in every state of the United States, whether or not the law of your state requires us to do so. Because we do not sell or share personal information, process it for targeted advertising, or use it for profiling that produces legal or similarly significant effects, we have no such processing for you to opt out of.
How to make a request. Email us at privacy@opscompanion.ai or write to us at the address in Section 13. We will ask you for information to verify your identity, such as your name and the email address associated with your account, and we will use that information only for verification. You may designate an authorized agent to make a request on your behalf by giving the agent written permission, and we may ask you to confirm the agent’s authority directly with us. We will respond within forty-five (45) days after receiving your request, and may extend that period once by an additional forty-five (45) days when reasonably necessary, in which case we will tell you the reason for the extension.
Appeals. If we decline to act on your request, we will explain why. You may appeal our decision by emailing privacy@opscompanion.ai with the subject line “Privacy Request Appeal” within a reasonable time after our decision. We will respond to your appeal within forty-five (45) days after receiving it. If we deny your appeal, you may contact the attorney general of your state.
No discrimination. We will not discriminate against you for exercising any of these rights.
Requests concerning Customer Data. If you make a request concerning Customer Data, we will refer you to the customer that controls that data and assist the customer as our agreement with the customer requires.
10. Children
The Website and the Services are intended for businesses and are not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from children under the age of thirteen (13). If we learn that we have collected personal information from a child under thirteen (13), we will delete it.
11. Individuals Outside the United States
We are located in the United States and process personal information in the United States. If the European Union General Data Protection Regulation or the United Kingdom General Data Protection Regulation applies to our processing of your personal information, OpsCompanion is the controller of that information, and we rely on the following legal bases: performance of a contract to which you are a party; our legitimate interests in providing the Services to the organization you represent, in operating, securing, and improving the Website and the Services, and in communicating with business contacts, which we balance against your rights; your consent, where law requires consent, including for non-essential cookies and for certain marketing communications; and compliance with our legal obligations. You may have rights to access, rectify, erase, restrict, and object to the processing of your personal information, to data portability, to withdraw consent at any time without affecting the lawfulness of prior processing, and to lodge a complaint with a supervisory authority. Where law requires, we transfer personal information to the United States under safeguards such as the European Commission’s standard contractual clauses.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post each update on the Website with a new effective date. If we make a material change, we will notify you by email to the address associated with your account or by a prominent notice on the Website before the change takes effect.
13. Contact Us
If you have questions about this Privacy Policy or our privacy practices, please contact us at privacy@opscompanion.ai or OpsCompanion, Inc., Attention: Privacy, 211 N Broadway, One Metropolitan Square, Saint Louis, Missouri 63102.