1. Who we are
Operentra is provided by Hostings House Solutions, LLC, a New York limited liability company (“we”, “us” or “our”), 800 Guy Lombardo Ave, Freeport, NY 11520, United States. This policy explains how we handle personal data when you visit operentra.com, contact us, create an account, or use the Operentra service (the “Service”).
2. Our two roles
We are the controller of the personal data this policy describes: website visitors, people who contact us, and the account and billing details of our customers' administrators. The employee, candidate and other HR records a customer puts into its workspace are different. For those, the customer — the employer — is the controller and decides what is collected and why, and we process the data on its behalf under our Data Processing Addendum.
3. Information we collect
When you visit our website
- Pages viewed, referring site, browser and device type
- Your approximate country, worked out from your IP address, to suggest your country at sign-up
- Cookies and similar technologies, subject to your choices (section 5)
- A partner referral code, if you arrived through a partner link
When you contact us
- Your name, email address and message, sent through the contact form, live chat or WhatsApp
- Details our chat tool records to help us answer, such as the page you were on
When you create and use an account
- Company name, country, time zone and currency
- Your name, email address and password, stored only as a salted hash
- Sign-in records — time, IP address and browser — kept for security
- Your acceptance of our Terms, and whether you asked for product news
When you pay
- Billing contact, plan and invoice history
- Card details are collected and processed by Stripe; we never receive or store full card numbers
4. How we use it
To run the Service
- Create and manage your account and workspace
- Take payments and send invoices
- Answer support requests
- Send service, security and billing messages
- Prevent fraud and abuse, and keep the Service secure
To improve and promote it
- Understand how our website is used (analytics)
- Measure our advertising (marketing cookies)
- Send product news and offers, only if you asked for them
- Improve the Service using aggregated, de-identified usage information
5. Cookies and your choices
Our website uses four categories of cookies and similar technologies. Only the necessary ones are always on.
Necessary
Make the site work and remember your cookie choices. Always on.
Functional
Power the live chat widget (Gleap).
Analytics
Google Analytics 4, to understand traffic and page performance.
Marketing
The Meta Pixel, to measure our ads, and an ad-attribution cookie.
Referral
If you arrive through a partner link, we store the partner's code for up to 90 days so a later sign-up can be credited. It holds no personal information and is set only with marketing consent.
6. Who we share it with
We do not sell personal data. We share it only as described here.
- Service providers who help us run Operentra: DigitalOcean (hosting, database and file storage), Backblaze (encrypted backups), Mumara (email delivery), Stripe (payments), Anthropic (AI features), Cloudflare (website hosting and security), Gleap (live chat and support), and Google and Meta (website analytics and advertising). Our Data Processing Addendum lists the providers that process workspace data.
- Your organization: administrators of a workspace can see the data in it, including the records of the people who use it.
- When the law requires it: to comply with a legal obligation or valid legal process, or to protect the rights and safety of our users, the public or us.
- Business transfers: if our business, or part of it, is reorganized, merged or sold, personal data may transfer to the successor, which must honor this policy.
7. AI features
Some features, such as scoring and recommendations in Performance, use artificial intelligence. When a workspace has them switched on, the data needed is sent to our AI provider, Anthropic, to produce the result. Neither we nor Anthropic use it to train AI models. Workspace administrators can switch AI scoring off.
8. How we protect it
Technical measures
- Encryption in transit with TLS
- Passwords stored as salted bcrypt hashes, with lockout after repeated failed sign-ins
- Two-factor authentication available to every user
- AES-256 encryption of fingerprint templates, integration credentials and backups
- Encrypted backups taken every day
Access controls
- Each customer's data kept separate from every other customer's
- Role-based permissions in every workspace, set by its administrators
- Staff access to a workspace only for support, investigation or security, and logged
- Customers notified without undue delay of a breach affecting their data
9. How long we keep it
Workspace and account data
- Kept while your subscription is active
- Kept for at least 90 days after a workspace becomes read-only, then deleted after email notice
- Encrypted backups destroyed within a limited period after that, normally up to 90 days
- When a workspace is deleted, each person who used it may be offered a personal account holding their own employment record and profile details; it is deleted if they decline or do not accept in time
Other records
- Invoices and billing records: as long as tax and accounting law requires
- Support conversations: as long as needed to help you and keep a record of what we agreed
- Website analytics: under the retention settings of our analytics provider
- Marketing preferences: until you change them, and a record of an unsubscribe for as long as we need to honor it
10. International transfers
We are based in the United States, and the Service is hosted there. If you use Operentra from another country, your personal data is transferred to and processed in the United States. Where the law of the European Economic Area, the United Kingdom or Switzerland requires a transfer mechanism, we use the European Commission's Standard Contractual Clauses, with the UK and Swiss adaptations, as set out in our Data Processing Addendum.
11. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, receive a copy, restrict or object to how we use it, and withdraw consent you have given. Residents of US states with privacy laws, such as California, can also ask what we collect and why, and opt out of the sale or sharing of personal information. We will not treat you differently for exercising these rights.
- To make a request, use the contact form at operentra.com/contact. We may need to verify your identity first.
- We respond within the time the applicable law allows.
- For data held in an employer's workspace, we will refer your request to that employer (section 2).
- You may complain to your local data protection authority. We would appreciate the chance to resolve your concern first.
12. Children
Operentra is a business service and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes and contact
We may update this policy. The date at the top shows when it last changed, and we will email account administrators about material changes before they take effect.