Privacy Policy

Last updated: 10 October 2026

This policy explains how Tiger Labs HQ, operating the SaaS platform “Opso” (“we”, “us”), handles personal data for the Opso service (“Opso”). We are the data controller for your account and billing data. For the business records you enter into Opso (your clients, cleaners, jobs), you are the controller and we act as your processor. Contact: privacy@opsohq.com.

What we collect

Account data (name, work email, business name, postcode, phone). Billing data (handled by Stripe — we store a Stripe customer/subscription ID, never full card numbers). Usage and device/log data (IP, browser, actions) to run and secure the service. The business content you enter into Opso. On the Pro plan, if you use the AI features: the questions you ask the assistant and its answers, the recordings and transcripts of calls you record or upload, and short voice questions you speak (see “AI features and call recording” below).

Why, and our lawful basis

To provide the service and take payment (contract). To secure, maintain and improve Opso, and for limited B2B communications about the service (legitimate interests). For any marketing to a personal email, only with your consent, which you can withdraw at any time.

Who we share it with

Service providers acting on our instructions: Stripe (payments), our hosting provider, Resend (transactional email), and, for the Pro plan’s AI features only, an AI service provider (China) that receives de-identified text as described below. We do not sell personal data. We disclose data only to those providers, or where legally required.

AI features and call recording (Pro plan)

The Pro plan includes an AI assistant and agent that read your own Opso records to answer questions and draft suggestions (for example a reminder email or a new job). Nothing it drafts is applied or sent until a person at your business approves it.

What leaves Opso. Before any text is sent to the AI service provider, Opso removes the names, phone numbers, email addresses and postcodes it can recognise and replaces them with references (for example “CLIENT_3”); the real values are put back inside Opso, never by the provider. Opso does the arithmetic itself and the provider is told the results. This is automated and cannot recognise everything: an unusual name, or a street address, mentioned in free text or in a recorded call may not be removed.

Call recording. On the Calls page you can record a call through your device’s microphone or upload a recording. Recordings are converted to text by speech recognition running on Opso’s own servers; the audio is not sent to the AI service provider or anyone else. Only the de-identified text is sent, as above. You must tell the people you record that the call is being recorded: Opso asks you to confirm this before each recording and logs that you did. You are the controller of those recordings and we are your processor.

Voice questions. A question you speak to the assistant is turned into text on Opso’s servers and the audio is deleted immediately; the text goes into your message box for you to check before you send it.

Keeping and erasing. Call recordings and transcripts are deleted automatically 180 days after the call, and an administrator can delete any call (recording, transcript and the AI’s working copy) at once. Assistant conversations are deleted after 180 days.

International transfers

Some providers (e.g. Stripe) process data outside the UK. Where they do, transfers are covered by UK adequacy regulations or standard contractual clauses. The AI service provider is located in China, which has no UK adequacy decision, and we do not currently have standard contractual clauses in place with it; for that reason we send it only the de-identified text described above, never audio, contact details or billing data. If you are not comfortable with this, do not use the AI assistant, agent or Calls features: nothing else in Opso depends on them.

Retention

Account and billing data for the life of your account and as long as needed for legal/accounting obligations, then deleted or anonymised. Business content you enter is retained until you delete it or close your account. Call recordings, transcripts and assistant conversations are retained for 180 days (see above).

Your rights

Under UK GDPR you may access, correct, delete, port, restrict, or object to processing of your personal data, and withdraw consent. Email privacy@opsohq.com. You may complain to the ICO (ico.org.uk).

Cookies

We use only essential cookies needed to sign in and run the service; no advertising cookies.

Security

Access controls, encryption in transit, and tenant isolation. No system is perfectly secure; we work to protect your data and will notify you of a qualifying breach as required by law.

Changes

We’ll post updates here and change the “last updated” date. Questions: privacy@opsohq.com.