Legal

Privacy Policy

How we handle personal data. Plain-English summary up top, full policy below. Last updated 2026-04-13.

The short version

We're a data controller for the personal data you provide directly (account, contact, contractual data).
We're a data processor for the personal data you load into the platform (your clients' contacts, ticket content, etc.).
Region-based architecture. Account data and platform telemetry live in the region you signed up in. The EU and US regions are live; data provisioned into either region does not leave it. The AP region is on the roadmap. Each region is self-contained.
Sub-processors: Stripe (subscription billing — US, UK adequacy), Cloudflare (edge — global, with regional configuration), Backblaze B2 (object storage — EU and US endpoints, region-matched). Outbound transactional email is handled by our own infrastructure inside the region the tenant lives in. Updated as the platform evolves.
We do not run Google Analytics, Segment, Mixpanel or any other third-party tracking on the marketing site or in the app. Self-hosted Rybbit handles product analytics.
You have the right to access, correct, delete, and export your personal data. Email privacy@opsmerge.cloud.
We respond to data subject requests within UK / EU statutory timelines.

Data controller: Brindleford Technologies Ltd, company number 16871436, registered in England and Wales.

Account data: name, email address, company name, billing information (processed and stored by Stripe — we do not store raw card data).
Service data: telemetry from agents you deploy (hostname, OS version, patch state, performance counters, installed software inventory). This data is collected solely to deliver the monitoring and management features of the Service.
Usage analytics: pageviews, feature usage, error events — collected via our self-hosted Rybbit analytics instance at track.brindleford.co.uk. No third-party analytics vendors are used; no data is shared with Google Analytics, Meta, or any other external analytics service.

We process personal data under the following lawful bases (UK GDPR):

Contract performance — for account data and service data required to deliver the features you have subscribed to.
Legitimate interest — for usage analytics used to improve the product. We have conducted a balancing test and concluded that this interest is not overridden by your rights given the privacy-preserving nature of our self-hosted analytics infrastructure.

OpsMerge runs a region-based architecture. Two regions are live and one is on the roadmap.

EU region: infrastructure inside the European Union, with object storage on an EU endpoint and email delivery via our self-hosted gateway at mx-eu.opsmerge.cloud. Agent telemetry, account data and email traffic for EU-region tenants do not leave the EU.
US region: infrastructure inside the United States, with object storage on a US endpoint and email delivery via our self-hosted gateway at mx-us.opsmerge.cloud. Agent telemetry, account data and email traffic for US-region tenants do not leave the US. Customers signing up with country=United States are provisioned into this region automatically.
AP region: on the roadmap, sequenced after US.

Each region is self-contained and customer data does not cross region boundaries.

Under UK GDPR you have the right to:

To exercise any of these rights, contact privacy@opsmerge.cloud. We will respond within one calendar month.

Account data is retained for the lifetime of your subscription plus 6 years for tax and accounting records.
Agent telemetry data is retained for 13 months by default; you may request earlier deletion.
Usage analytics data is retained for 24 months.

We may update this Privacy Policy. Material changes will be communicated via email before taking effect.

Brindleford Technologies Ltd, company number 16871436 (England and Wales).