Privacy Policy

1. Who we are

OPERATIONAL INTELLIGENCE SYSTEMS LLC (“we”, “us”) is a limited liability company registered in Delaware, United States. We operate the Operations Intelligence Platform (“the platform”), a facility operations reporting service sold to building operators and facility-services contractors.

For most data in the platform our customer — the facility operator — decides what is collected and why. We process that data on their behalf and under their instructions. This policy explains what we do in both roles.

2. What we collect

Issue reports

When someone scans a QR code and files a report we collect the zone and site the code identifies, the time of the scan, the issue category and any free-text description entered, and any photograph attached. Reports filed by members of the public can be made anonymously: we never require a name, phone number, email address, or account identity to file a report. A reporter may optionally include their name, or an email address for updates, as described below.

Email updates for service reports

If you optionally provide an email address with a service report, we use it only to send updates about that request — never for marketing, and never for any other report. OIP encrypts the address, keeps it separate from the permanent service record, and removes it from OIP’s reporter-contact store after the final update or within 30 days, whichever comes first. Our email delivery provider processes the address in order to transmit these messages.

Facility personnel data

For employees of our customers who use the platform we hold the name, work email address, work phone number, employer, role and permission level, site and zone assignments, shift schedule, and the record of actions each person takes in the platform — reports acknowledged, work marked complete, and the associated timestamps.

Phone numbers and SMS consent

Where an employee has given written consent to operational SMS, we hold their mobile number, the record of that consent, and the delivery status of messages sent. See the SMS Opt-In Disclosure for the full detail. Message frequency varies based on operational activity. Message and data rates may apply.

Technical and security data

We record authentication events, IP address and browser user-agent at sign-in, and application error diagnostics. This is used to operate and secure the service.

We use only the cookies required to keep a signed-in session and to secure it. We do not use advertising cookies, and we do not track visitors across other websites.

3. Why we use it

• To route a report to the employee responsible for that zone on that shift.
• To notify that employee, including by SMS where they have consented.
• To escalate a report that has not been acknowledged in time.
• To produce the operational and compliance records our customers rely on — who was notified, who responded, and when.
• To authenticate users, secure the service, and investigate misuse.
• To provide support and to meet our legal obligations.

We do not use personal data for advertising, we do not sell it, and we do not use it to build profiles unrelated to facility operations.

4. Who we share it with

We share personal data only with:

• The employing customer. A facility operator sees the data for its own sites and staff, and nothing belonging to any other customer.
• Service providers who run the platform for us — our cloud hosting and database provider, our application hosting provider, our transactional email provider, our SMS telecommunications provider, and our error monitoring provider. Each is bound by contract to process data only on our instructions.
• Authorities, where we are legally compelled, and only to the extent compelled.

We do not sell personal data. We do not share mobile phone numbers or SMS consent with third parties or affiliates for their own marketing or promotional purposes.

5. How long we keep it

• Issue reports and photographs — for the life of the customer account, because they form the operational record the customer relies on.
• Personnel records and zone assignments — for the life of the customer account, or until the customer removes the individual.
• Phone numbers and SMS consent records — while consent stands. After an opt-out we retain the number and the opt-out record for the sole purpose of ensuring no further messages are sent to it.
• Authentication and security logs — up to 12 months.
• Compliance and audit records — see section 7; these are write-once and are retained for the life of the account.

When a customer account is terminated we delete or irreversibly anonymise its data within 90 days, other than records we are required to keep by law or that are covered by section 7. Backups are purged on their own rolling cycle, which completes within a further 90 days.

6. Security

We enforce tenant isolation at the database level so one customer cannot read another’s data, restrict access by role, encrypt data in transit and at rest, and keep an audit trail of access and change. We hold no security certification and we do not claim one; we can describe our controls to a customer on request. Report a suspected vulnerability to security@oipone.com.

7. Your rights, and one honest limit

Depending on where you live you may have the right to access the personal data we hold about you, correct it, request its deletion, object to or restrict how we use it, receive a copy in portable form, and withdraw consent at any time. Withdrawing SMS consent is immediate — reply STOP. Exercising any of these rights costs nothing and we will not treat you differently for it.

The limit: some compliance and audit records in the platform are write-once by design — they cannot be altered or deleted, by us or by anyone, because their value to our customers depends on exactly that. Where a deletion request touches such a record we will tell you which data we cannot remove and why, and we will remove everything else.

If you are an employee of one of our customers, ask your employer first — they control the account. Either way, write to privacy@oipone.com and we will respond within 30 days. If you are not satisfied you may complain to your local data protection authority.

8. Children

The platform is a workplace tool and is not directed to children. We do not knowingly collect personal data from anyone under 16.

9. International transfers

We operate the platform from the United States. If you access it from elsewhere, your data is transferred to and processed in the United States under appropriate contractual safeguards with our service providers.

10. Changes and contact

If we change this policy materially we will update the effective date above and notify account administrators before the change takes effect.

Privacy enquiries and data-subject requests:

OPERATIONAL INTELLIGENCE SYSTEMS LLC
privacy@oipone.com