Privacy Policy

ofivio.com and the Ofivio platform — the industry edition your workspace is on, together with the web application, the mobile application and the APIs that serve them are operated by OFIVIO (SMC-PRIVATE) LIMITED, Lahore, Pakistan. For questions about this policy or about your data, write to contact@ofivio.com or use the Help Desk.

There is an important distinction running through this document:

• For your account and our own site, we are the controller. We decide what to collect and why, and this policy explains it.
• For the business data inside your Workspace — your employees, your clients, your tenants, your suppliers — you are the controller and we are your processor. We hold and process it on your instructions to run the Services for you. We do not decide what you put in, we do not use it for our own purposes, and we do not share it.

Information you give us

• Account details — name, email address, phone number, organisation name, industry, country, and a password (which we store only as a bcrypt hash, never as text).
• Billing details — the payment method you used, the transaction reference you submit, the amount and date. We do not collect or store card numbers; we do not take card payments at all.
• Support correspondence — what you write to us, so we can answer it.

Information you put into your Workspace

Projects, tasks, drawings, bills of quantities, invoices, vouchers, employee and payroll records, leases, documents and messages — whatever the product you use is for. This is Your Content. It is stored under your organisation's own identifier and is not visible to any other Workspace.

Information collected automatically

• Technical data — IP address, browser and device type, operating system, and the pages and features you use.
• Security and audit data — sign-in events, and an audit trail of actions taken inside your Workspace (who did what, to what, and when). This exists so you can investigate your own organisation's activity, and so we can investigate abuse.
• Cookies — see section 8 and the Cookie Policy.

We do not buy personal data from data brokers, and we do not build advertising profiles.

We do not sell your personal data. We do not share it between organisations. We do not use your business data for advertising, and we do not use it to train AI models — ours or anyone else's.

The Services include VO, an AI assistant. When you use it, the content needed to answer your request — your question, and the records from your own Workspace that your role is permitted to read — is sent to a language model provider over an API, and the answer is sent back.

Three things are worth being precise about:

• It is sent to answer you and for nothing else. We do not permit our providers to use it for model training, and our agreements with them reflect that. VO does not learn from your data and is not trained on it.
• VO cannot exceed your own permissions. It reads what your role can read. If a record is invisible to you, VO cannot retrieve it, summarise it, or act on it.
• Speech is transient. Where you use voice, audio is processed to produce or interpret speech and is not retained by us afterwards.

The providers are listed in section 6. If you would prefer no AI processing at all, the entry VO tier can be left unused, and an Enterprise agreement can disable VO for your Workspace — write to contact@ofivio.com.

The full technical description is on the Security page. In summary:

• Tenant isolation. Every Workspace lives under its own identifier inside one of four top-level stores — individuals, businesses, enterprises, and visitors for trials. Access rules are enforced on the server and in the database itself, so a request for another organisation's data fails regardless of what the client asks for.
• Encryption. TLS in transit; AES-256 at rest, including files.
• Credentials. Passwords are hashed with bcrypt and never stored or logged in readable form. Sessions use signed tokens in httpOnly, secure, sameSite cookies.
• Abuse controls. Rate limits on authentication, uploads, general API traffic and VO; reCAPTCHA on sign-up and sign-in.
• Audit trail. Actions inside a Workspace are logged immutably.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authority without undue delay, with what we know and what we are doing about it.

We use the following providers to run the Services. Each receives only what it needs for its function, under contract, and none of them is permitted to use your data for its own purposes.

Which language model answers a given request depends on the task and on availability. We may add or change providers; where a change materially affects how your data is processed, we will update this page and give notice as described in section 12.

We may also disclose data where the law requires it — a valid court order or a lawful request from an authority — or to establish or defend a legal claim. Where we are permitted to tell you, we will.

The platform runs on Google Cloud infrastructure in the us-central1 region, in the United States, and our AI and speech providers process requests in the United States and Europe. If you are outside those places — and most of our customers are — your data will be transferred internationally. Those transfers rely on the providers' standard contractual clauses and equivalent safeguards, and we contract with each provider on that basis.

ofivio.com uses a small number of cookies: to keep you signed in, to remember your interface preferences, and to count visits. It uses no advertising cookies and no cross-site tracking.

Each cookie, what it does and how long it lasts is listed in the Cookie Policy, along with how to control them.

This site and the Ofivio application carry no advertising. No ad script runs on ofivio.com, no advertising cookie is set, and nothing in your Workspace is used to target an advertisement anywhere. We are paid by subscription, which is the whole reason we do not need to be paid by advertising.

We do operate a separate site, ofivio.xyz — Ofivio Briefcase, a set of free public tools — and that site does carry advertising served by Google AdSense. It is a different site with a different purpose, requires no account, and publishes its own privacy policy, cookie policy and terms covering the advertising it shows and the choices you have about it. Using this site does not put you into anything on that one; the two hold no data in common.

Depending on where you live, you have the right to:

• Access — get a copy of the personal data we hold about you.
• Correct — have inaccurate data fixed. Most of it you can edit yourself in your settings.
• Delete — have your data erased, subject to records we are legally required to keep.
• Export — receive your data in a portable format.
• Restrict or object — limit how we process it, or object to processing based on legitimate interests.
• Withdraw consent — at any time, where we relied on consent. Withdrawing it does not undo processing already carried out.
• Complain — to your local data protection authority. We would appreciate the chance to put it right first.

Write to contact@ofivio.com. We will respond within 30 days, and we will verify your identity before acting on a request — an unverified deletion request is itself a security risk.

If your data is in someone else's Workspace — you are an employee, a client or a tenant of a customer of ours — that organisation is the controller and we cannot amend or delete its records on your instruction. Ask them. If you cannot reach them, tell us and we will help you get to the right place.

Children

The Services are business software and are not directed at children. We do not knowingly collect personal data from anyone under 16. If we learn that we have, we delete it. If you believe a child's data has been given to us, tell us at contact@ofivio.com.

Changes to this policy

We may update this policy. The date at the top always shows when it last changed. Where a change materially affects how we handle your personal data, we will give notice by email to your Workspace owner or in the application before it takes effect.

Contact

OFIVIO (SMC-PRIVATE) LIMITED
Lahore, Pakistan
contact@ofivio.com
Help Desk