Privacy Policy

    Last updated: August 9, 2026

    1. Who this policy covers

    This policy explains how operate1 ("we", "us") handles personal data. operate1 serves businesses worldwide, and depending on where you are, the applicable regime may be the UK or EU GDPR, a United States state privacy statute, or India's Digital Personal Data Protection Act, 2023 (DPDP Act). The policy covers two situations, and the roles differ:

    • Data about our own users (the professionals and teams who sign up for operate1). For this data, we are the data controller (the data fiduciary, in DPDP terms).
    • Data that our users store about their clients (bookings, contact details, session records). For this data, the practice using operate1 is the controller and we act as their data processor, handling the data only on their instructions. If you are a client of a practice that uses operate1, contact that practice first about your data.

    2. What we collect

    • Account data: name, email address, password (stored hashed)
    • Business data: business name, industry, services, availability, branding
    • Payment data: subscription billing details, processed by Razorpay; we do not store card or UPI credentials
    • Client data our users add: names, contact details, bookings, notes, and records their practice keeps
    • Usage data: pages visited, features used, device and browser information, collected through the analytics tools listed in section 7

    3. Purposes and consent

    We process personal data for the purposes you consent to when you sign up, and for the legitimate uses applicable data protection law permits:

    • Providing, maintaining, and improving the Service
    • Processing subscription payments and issuing tax invoices
    • Sending service notices, reminders, and support responses
    • Understanding usage so we can fix and improve the product
    • Meeting legal obligations, including under data protection and tax law

    Consent is requested for a specified purpose, and you may withdraw it at any time with effect for future processing, by adjusting your account settings or writing to us. Withdrawing consent may mean parts of the Service stop working for you. We do not sell personal data, and we do not use client records stored by practices for our own marketing.

    4. Your rights over your data

    Under the regime that applies to you, whether GDPR, a US state statute, or the DPDP Act, you have the right to:

    • Access a summary of the personal data we hold about you and how it has been processed
    • Correction and updating of inaccurate or incomplete data
    • Erasure of your personal data once it is no longer needed for the purpose or a legal retention requirement
    • Grievance redressal through the contact in section 9
    • Nominate another individual to exercise these rights if you are unable to

    You can exercise access, correction, export, and deletion yourself from your account: full data export is at account, data export and account deletion is self-serve. For anything you cannot do in the app, email us and we will respond within the timelines applicable law requires.

    5. Retention

    We keep personal data only as long as it is needed for the purpose it was collected for, or as long as law requires (for example, invoicing records under tax law). When you delete your account, your data is deleted from production systems and then from backups on their rotation schedule, except for the minimal records we must retain by law. Client data stored by a practice follows that practice's retention schedule; we delete it on their instruction or when their account closes.

    6. Security

    Data is encrypted in transit (TLS) and at rest. Every account's data is isolated with row-level security enforced in the database. Access to production systems is restricted and logged. If a personal data breach occurs, we will notify affected users and the relevant authority, which for businesses in India is the Data Protection Board of India, as applicable law requires.

    7. Processors we use

    We share personal data only with the service providers that run the Service, under contracts that limit their use of it:

    • Supabase: database and authentication hosting
    • Vercel: application hosting and delivery
    • Stripe: card payment processing
    • Razorpay: payment processing for businesses in India
    • PostHog: product analytics
    • Google Analytics (via Google Tag Manager): website analytics

    We may also disclose data where law requires it, such as to a court or a government authority acting within its powers.

    8. Cookies

    We use essential cookies for sign-in and preferences; the Service does not work without them. We use analytics cookies (PostHog, Google Analytics) to understand how the site and product are used. You can block or delete cookies in your browser settings; blocking essential cookies will prevent sign-in.

    9. Contact and grievances

    For any grievance, question, or request about your personal data, contact us:
    support@operate1.com
    We acknowledge grievances promptly and aim to resolve them within the period applicable law prescribes. If you are not satisfied with our response, you may escalate to your supervisory authority, which for users in India is the Data Protection Board of India.

    10. Changes to this policy

    We may update this policy as the Service or the law changes. Material changes are notified by email or in the app before they take effect, and the "Last updated" date above reflects the current version.