Privacy Policy
Last updated: 26 September 2026
OpsRead turns your store, shipping and support data into daily, weekly and monthly operations reports. This policy explains what data we handle, why, where it goes and how long we keep it. It is written for the person who runs operations at your brand. If something here is unclear, write to us at opsread@gmail.com.
Contents
- Who we are
- Our two roles
- Data about you and your team
- Data about your customers
- How we use AI
- How long we keep data
- Privacy requests and uninstalling
- If you are a shopper
- Your rights
- Who else handles data
- Data stored outside India
- Cookies
- How we protect data
- If something goes wrong
- Children
- Grievance Officer
- Changes to this policy
1. Who we are
OpsRead is operated by OPSREAD, India.
We connect to your order management system, your support system and your logistics provider. From what they send us, we build reports on orders, despatch, delivery and support tickets. We email a report to the people you choose, at the time each of them chooses.
2. Our two roles
We handle two kinds of personal data, and our responsibility is different for each.
| Data about you and your team | Data about your customers | |
|---|---|---|
| Whose data | The people who sign up and receive reports | The shoppers who order from your store and write to your support team |
| Our role under India's Digital Personal Data Protection Act, 2023 | Data Fiduciary. We decide why and how it is used. | Data Processor. You are the Data Fiduciary. We process it only on your instructions, to produce your reports. |
| Covered in | Section 3 | Section 4 |
We do not sell either kind of data. We do not use your customers' data for our own purposes, to contact them, or to build profiles across stores.
3. Data about you and your team
When you sign up
- Your name and work email address. We do not accept free email providers.
- Your job title.
- Your company name, sector and monthly order volume.
- A password. We store only a one-way hash of it (scrypt), never the password itself.
When you use OpsRead
- Report recipients. The email addresses you add in Settings, whether each is switched on, and which reports each receives (daily, weekly, monthly) at what time.
- Sign-in sessions. For each signed-in session we store the IP address and browser details. We use these to keep you signed in and to detect a stolen session.
- Audit log. Settings → Audit log records who did what in your workspace: sign-ins, failed sign-ins, password changes, connecting or disconnecting a source, changing recipients, and resetting the workspace. Each entry keeps the person's email address, the time, and the IP address and device used. Entries never contain passwords, tokens, or your customers' details.
- Security emails. When your password changes, we email you the time and a rough device description, such as "Chrome on Windows".
- Connection credentials. The access tokens that let us receive data from your order management system, support system and logistics provider. Depending on the connection, this can include an OAuth client ID and secret you enter. All of these are encrypted.
- Billing. Subscriptions are handled by our payment provider. Your card or UPI details go straight to the provider and never reach our servers. We store the billing contact's name, email address, phone number and billing address, your GSTIN, and your subscription ID, plan and status.
Why we use it: to create and secure your account, deliver your reports, show you what happened in your workspace, and bill you. We use your email address to send you service emails: codes, security alerts, reports, and notices about privacy requests from your customers. We do not send marketing emails from this data.
4. Data about your customers
We only receive what your connected tools send us. Your tools send us an update when something changes, such as an order, shipment or support ticket being created or updated.
Access we request. We ask each tool for the narrowest access that lets us build your reports, and read-only where the tool allows it. Some tools only offer broader permissions than we need. We use that access only to read the data described below and to set up or remove the one webhook OpsRead uses to receive updates. Some tools give us no access at all: you paste our webhook address into their dashboard, and we cannot see the account.
What we keep in our database
- Orders: order ID, order date, status and number of items, plus the customer's ID in your system, email address and phone number.
- Shipments: shipment ID, courier name, AWB (tracking) number, dispatch date, tracking status, expected and actual delivery dates, failed-delivery (NDR) count, and whether it returned to origin.
- Support tickets: ticket ID, status, tags, and the times it was raised, first answered and resolved, plus the requester's ID, email address and phone number.
What arrives but is not kept in our database. Each update arrives in full and can include the customer's name, billing and shipping address, products and prices, the ticket subject, description and comment text, and courier hub scan locations. It stays only in our processing queue (see section 6).
Linking tickets to orders. Support tickets and orders share no common ID. We link a ticket to the order it is about by matching the requester's email and phone number to your orders. We store the link and how it was made. This is how a report can say, for example, "3 delivery-delay tickets on orders past despatch SLA".
What we do not keep: shoppers' names, postal addresses, the products they bought, order values, or the text of their support conversations. None of these are stored in our database.
5. How we use AI
Each report includes a short written summary. It is produced by a third-party AI provider through its API.
What the model receives, per report:
- the report's date range;
- for each row: the business stage, the metric name (for example "Orders Placed" or "WISMO Tickets"), its value, and its percentage change from the previous period;
- a breakdown line made of counts and courier names only, for example "4 on Delhivery · 2 on Blue Dart".
What the model never receives: your store or company name, your name or email address, or any shopper's name, email, phone, address, order ID, AWB number, or ticket text.
What the model does: it turns numbers we have already calculated into readable sentences. Every number, comparison and breakdown is calculated by our own code before the model is called. The model does not analyse your data and makes no decisions. Nothing it writes changes your data.
Training: under the provider's API terms, data sent through the API is not used to train its models. The provider does not retain these requests.
The AI provider is a subprocessor (section 10) and processes data in the United States (section 11).
6. How long we keep data
| Data | How long we keep it |
|---|---|
| Raw data in the processing queue (full orders, support ticket events, logistics tracking events) | Deleted automatically 7 days after it is processed, or 30 days after processing finally fails. If processing is interrupted, a record can stay longer. We review and clear those at least every 30 days. |
| Sign-up and password-reset codes | Valid 10 minutes, deleted within a day of expiring. |
| Sign-in sessions (with IP and browser details) | Up to 90 days. Deleted once expired, or 30 days after you sign out. |
| "Secure your account" links | Valid 24 hours. Deleted once expired, or 30 days after use. |
| Orders, shipments, tickets and reports | For as long as your account and the connection are active. |
| When you disconnect a source | At once: we delete its access tokens, erase customer IDs, email addresses and phone numbers from everything received through it, clear AWB numbers from its shipments, and delete all of its raw data in the queue. Order, ticket and report totals stay, so your history still adds up. This cannot be undone. |
| When you reset your workspace (Settings → Workspace Admin) | All orders, shipments, tickets, reports and queued raw data are deleted at once. Connections, users and the audit log stay. |
| When you uninstall OpsRead from your order management system | See section 7. The store's data is erased within 30 days. |
| When you delete your account | You can delete your account from Settings → Workspace Admin. Your data is then kept for 90 days, and during that time you can ask us to restore the workspace by writing to opsread@gmail.com. After 90 days it is permanently deleted. |
| Audit log | For the life of your account. |
7. Privacy requests and uninstalling
Shopify, the order management system we connect to today, sends every app three kinds of privacy request. OpsRead handles all three. None of the other tools we connect to send these requests. Below, "your order management system" means Shopify.
A shopper asks for their data (customers/data_request).
- The next morning, at 10:00 IST, we gather everything we hold about that shopper in your workspace: their orders and shipments, linked support tickets, and the raw order data still in our queue.
- We put it in one file and store it privately with our file storage provider.
- We email your workspace owners a download link.
- You send the file to the shopper. Under the platform's rules the store answers its customer.
The link works for 30 days and then the file is deleted. Anyone with the link can download the file, so send the file itself, not the email.
A shopper asks to be erased (customers/redact). 25 days after your order management system tells us (its deadline is 30 days), we:
- remove the shopper's email address, phone number and customer ID from their orders and support tickets;
- clear AWB numbers from their shipments;
- delete the raw order data and raw support ticket data about them.
The orders stay without any personal details, so your report totals do not change. We email your owners when the request arrives, a reminder before it runs, and a confirmation after.
You uninstall OpsRead from your order management system.
- At once: we delete the store's access token, stop receiving its data, and email your workspace owners.
- Your order management system then sends a store-erasure request (
shop/redact), usually 48 hours after uninstall. 25 days after receiving it, we delete every order and shipment from that store, its raw data, and the stored connection. Support tickets stay but lose their link to those orders. Reports stay, because they hold totals only. - If you reinstall before the erasure runs, it is cancelled for your workspace. If we had already told your owners about the erasure, we tell them it is cancelled.
Uninstalling from your order management system affects only its data. To remove support or logistics data, disconnect that source (section 6).
8. If you are a shopper
If you bought from a store that uses OpsRead, that store controls your data. OpsRead processes it only on the store's behalf. Please send your request to the store. It can reach us, and the store's order management system passes your data and erasure requests to us automatically. If you contact us directly, we will tell the store and help it respond. We cannot act on a shopper's request without the store's instruction, because we cannot verify who you are against the store's records.
9. Your rights
Under the Digital Personal Data Protection Act, 2023, you (the people who use OpsRead) have the right to:
- Access: get a summary of the personal data we hold about you and how we use it.
- Correction and completion: fix data that is wrong or incomplete.
- Erasure: have your data deleted when it is no longer needed for the service, subject to section 6.
- Withdraw consent: stop using OpsRead and have your account deleted. Withdrawing does not affect processing that already happened.
- Nominate: name someone to exercise these rights for you if you die or become unable to.
- Grievance redressal: complain to our Grievance Officer (section 16). If you are not satisfied with the answer, you can complain to the Data Protection Board of India.
To use any of these rights, write to opsread@gmail.com from the email address on your account.
10. Who else handles data
| Company | What it does for us | What it receives | Where |
|---|---|---|---|
| Hosting provider | Hosts our servers and database. | Everything described in this policy | India |
| File storage provider | Stores customer data export files privately until their download link expires | The customer data export file, deleted when its download link expires | Asia-Pacific (APAC) |
| Email provider | Sends our emails | Recipient email addresses, your company name, sign-in codes, security alerts (time and device), report summaries and report links, and privacy-request notices with export download links. Not the export file itself. | Asia-Pacific (APAC) |
| AI provider | Writes the report summary (section 5) | Report numbers, metric names and courier names only | United States |
| Payment provider | Handles subscriptions and payments | Your billing and payment details, which you enter directly with the provider | India |
Your order management system, support system and logistics provider are your tools. They send us data you have authorised, and we send them only what is needed to set up or remove that connection.
11. Data stored outside India
Our servers and database are in India. Three providers process some data outside India:
- Our AI provider (United States) receives only the report figures described in section 5. It receives no personal data.
- Our email provider (Tokyo, Japan) delivers our emails, so it handles recipient addresses and email content.
- Our file storage provider (Asia-Pacific region) holds customer data export files (section 7) until their download link expires. These files contain personal data of your customers.
We do not transfer personal data to any country the Government of India restricts under the DPDP Act.
12. Cookies
The OpsRead app uses four cookies. All are strictly necessary, set only by us, hidden from page scripts (httpOnly), and sent only over secure connections.
| Cookie | Purpose | Lasts |
|---|---|---|
access_token | Keeps you signed in | 15 minutes |
refresh_token | Renews your sign-in without re-entering your password | Up to 30 days of inactivity, 90 days at most |
signup_token | Carries your verified email between sign-up steps | 15 minutes |
password_reset_token | Carries your verified email between password-reset steps | 15 minutes |
The app uses no analytics, advertising or tracking cookies, loads no third-party scripts, and stores nothing in your browser's local storage.
13. How we protect data
- Connection credentials are encrypted with AES-256.
- Passwords are stored as scrypt hashes. Session, recovery and export links are stored only as SHA-256 hashes.
- Every database query is restricted to your workspace at the data layer. A query without a workspace is refused rather than run.
- Where a connected tool provides a signature with its data, we check it before we accept the data.
- Sign-in, codes and password resets are rate-limited per email address and per IP address.
14. If something goes wrong
If a personal data breach affects your data, we will:
- tell your workspace owners as soon as reasonably practicable, saying what happened, what data was involved, what we are doing, and what you should do;
- report it to the Data Protection Board of India as the DPDP Act requires;
- give you what you need to inform your own customers where their data is involved.
15. Children
OpsRead is a business service. Accounts are for people acting for a business, and you must be 18 or older to create one. We do not knowingly collect personal data from children for our own purposes. Your customers' data reaches us only as your processor. If your store sells to minors, you are responsible for the consent the DPDP Act requires for that data.
16. Grievance Officer
Ashhar Zubair, Grievance Officer, OPSREAD
Email: opsread@gmail.com
We aim to reply within 1–2 business days. Most issues are resolved within 5–7 business days; complex ones can take longer. These are our working targets, not guaranteed deadlines.
17. Changes to this policy
When we change this policy, we update the date at the top. If a change affects how we use your data, we will email your workspace owners before it takes effect.