Privacy Policy

Version 1.0 · Effective 24 September 2026

This policy explains what personal data OPI Project Management LLC (“OPI-PM”, “we”, “us”) collects when you visit opi-pm.com or use the OPI-PM construction project management service, why we use it, who we share it with, and the choices and rights you have.

1. Who we are

OPI-PM is operated by OPI Project Management LLC, 312 W 2nd St, Unit #A8515, Casper, WY 82601, United States. For any privacy question, including using your rights, email privacy@opi-pm.com.

2. Our role: your data and your company's data

We are responsible (the “controller”) for the personal data we use to run our own business: accounts and sign-in, billing, support, security, our website, and sales and marketing.

What a company puts into OPI-PM about its projects belongs to that company, our customer. That includes details about its staff, workers, subcontractors, clients and site visitors, timesheets and pay rates, daily logs, photos, documents and health and safety reports. For this data the customer is the controller and we process it on its behalf, under our agreement with it. If your information is in a customer's account and you want to see, correct or delete it, please contact that company. If you contact us instead, we'll pass your request on and help them respond.

3. Personal data we collect

Information you give us

• Account and profile: name, email address, password (stored only in scrambled, hashed form by our sign-in provider), job title, phone number and country.
• Company and billing: company name, size, country, currency and address, and your plan and billing history. Card details go straight to Stripe; we never see or store your full card number.
• Invitations: names, email addresses, roles and job titles of the people you invite, including client and subcontractor contacts.
• Project content: anything you or your team enter or upload (see section 2). This can include health and safety reports that describe injuries or illness, worker pay rates and timesheets, and photos. Photos keep any details your device adds to them, such as when and where they were taken.
• Demo requests: your name, work email, phone number, job title, company details and what you tell us about your needs. If you book a call, Calendly receives the details you enter to schedule it.
• Support and feedback: what you send us. In-app feedback also records the page you were on, your browser type and your screen size.

Information collected automatically

• Sign-in and security records: when you sign in, the time, your IP address and browser details. We also record who viewed or changed documents and other records, for security and audit.
• Product usage: which features are used, such as creating a project, linked to your account.
• Location: if you set a project's location from your device, we store the project's coordinates. Weather and map features send those coordinates, and your IP address, from your browser to the weather and map providers in section 6.
• Email engagement: our emails can record when they are opened and which links are clicked.
• Website analytics and ad measurement: only with your consent. See Cookies.

Information from other sources

• Your employer, or a company you work with, when it invites you or adds your details to its account.
• For sales and marketing: business contact details from public professional sources, such as company websites and LinkedIn, and from people who refer you to us.
• Stripe, which tells us whether payments succeed.

4. How we use it, and our legal basis

You don't have to give us personal data, but we need your name, email address and company details to create an account, and payment details for a paid plan.

We don't make decisions with legal or similarly significant effects on you based only on automated processing. Details read from invoices are suggestions for you to review.

We don't sell personal data.

5. Who can see your data

• Your company: people in your company's account see information according to their roles. Clients and subcontractors a company invites see only what that company shares with them.
• Our team: a small number of OPI-PM staff can access accounts when needed to provide support, keep the service secure and fix problems.
• Service providers: the companies in section 6, which process data for us under contract.
• Legal and safety: authorities or others, where the law requires it or to protect people's rights, property or safety.
• Business changes: a buyer or successor if OPI-PM is sold or reorganised. This policy would continue to apply to your data.

6. Service providers

7. International transfers

Our database, file storage and servers are in the United States (California), and most of our providers process data in the United States; some also process it in other countries. So your data leaves your country, whether you are in Trinidad and Tobago, Barbados, Jamaica or elsewhere. We use established providers that commit by contract to keep data secure and use it only to provide their services to us, and we give them only what they need. Where the law allows, we also rely on the transfer being needed to provide the service you asked for. Email privacy@opi-pm.com for details of the safeguards for a particular provider.

8. How long we keep it

• Account, company and project data: while the account is open. When a company closes its account, we delete its data within 90 days, except records the law requires us to keep.
• People removed from a company's account: their access ends. Their name stays on records they created, which belong to the company.
• Billing and payment records: 7 years, for tax and accounting.
• IP addresses and browser details in sign-in and access records: 12 months.
• Product usage records: 24 months.
• Unfinished sign-ups: 30 days.
• Sales contacts and demo requests: while there is a realistic prospect of working together, or until you ask us to delete them. If you opt out of marketing, we keep your email address on a do-not-contact list so that we can respect your choice.
• Website analytics: Google Analytics keeps data for 14 months. Microsoft Clarity keeps session recordings for 30 days and heatmaps for up to 13 months.
• Backups: deleted data can stay in encrypted backups for up to 30 days before it is overwritten.

9. Your rights

Depending on where you live, including under the data protection laws of Barbados and Jamaica, you can ask us to:

• give you a copy of your personal data and information about how we use it;
• correct data that is wrong or incomplete;
• delete your data;
• restrict how we use it while a concern is resolved;
• stop using it, including stopping direct marketing at any time;
• give you data you provided in a portable format, or send it to another company;
• withdraw consent you gave, without affecting what we did before.

You can update your profile in the app's Settings, and a company administrator can close the company's account there. For anything else, email privacy@opi-pm.com. We may need to confirm your identity first. We reply within one month, free of charge. If a request is complex we may need longer, as the law allows, and we will tell you why. For data a customer controls, see section 2.

You can also complain to a data protection regulator, such as the Data Protection Commissioner in Barbados, the Office of the Information Commissioner in Jamaica, or the regulator where you live. We'd appreciate the chance to deal with your concern first.

10. Marketing emails

Every marketing email we send has an unsubscribe link, and you can also reply or email privacy@opi-pm.com to stop them. We act on opt-outs promptly, and always within 10 business days. Emails about your account, such as security and billing notices, aren't marketing, and you'll still get them while you have an account.

11. Cookies and similar technologies

We use strictly necessary cookies and browser storage for sign-in and security. Analytics and marketing tags load only if you agree, only on our public website and sign-up pages, and never inside the OPI-PM app. If your browser sends a Global Privacy Control signal, marketing tags stay off. You can change your choice at any time in Cookie settings.

When you reach the scheduling step of a demo request, Calendly's scheduler loads and may set its own cookies; Calendly's privacy notice applies to them.

12. Security

We encrypt data in transit and at rest, limit access to the people and systems that need it, and keep each company's data separate with database access rules. No system is perfectly secure. If a security incident affects your personal data, we will tell you and the relevant authorities as the law requires.

13. Children

OPI-PM is a business service for people aged 18 and over. We don't knowingly collect personal data from children. If you think a child has given us personal data, contact us and we'll delete it.

14. Changes to this policy

We'll post changes here with a new effective date. If a change is significant, we'll tell account holders by email or in the app before it takes effect.

15. Contact us

Email privacy@opi-pm.com or write to OPI Project Management LLC, 312 W 2nd St, Unit #A8515, Casper, WY 82601, United States.