Privacy Policy

ofivio.com and the Ofivio platform — Ofivio AEC, Ofivio Business or Ofivio Essentials, whichever your workspace is on, together with the web application, the mobile application and the APIs that serve them are operated by OFIVIO (SMC-PRIVATE) LIMITED, 100/14, Lower Ground, Aijaz Chamber, DHA Main Boulevard, Lahore, Pakistan. For questions about this policy or about your data, write to contact@ofivio.com, telephone +92 300 7512464, or use the Help Desk.

There is an important distinction running through this document:

• For your account and our own site, we are the controller. We decide what to collect and why, and this policy explains it.
• For the business data inside your Workspace — your employees, your clients, your tenants, your suppliers — you are the controller and we are your processor. We hold and process it on your instructions to run the Services for you. We do not decide what you put in, we do not use it for our own purposes, and we do not share it.

Information you give us

• Account details — name, email address, phone number, organisation name, industry, country, and a password (which we store only as a bcrypt hash, never as text).
• Billing details — how you paid (card, Alfalah bank account or Alfa wallet), the order and Bank Alfalah transaction references, the amount and date. Card and account numbers are entered on Bank Alfalah's own page; we do not see, collect or store them.
• Support correspondence — what you write to us, so we can answer it.

Information you put into your Workspace

Projects, tasks, drawings, bills of quantities, invoices, vouchers, employee and payroll records, leases, documents and messages — whatever the product you use is for. This is Your Content. It is stored under your organisation's own identifier and is not visible to any other Workspace.

Information collected automatically

• Technical data — IP address, browser and device type, operating system, and the pages and features you use.
• Security and audit data — sign-in events, and an audit trail of actions taken inside your Workspace (who did what, to what, and when). This exists so you can investigate your own organisation's activity, and so we can investigate abuse.
• Cookies — see section 8 and the Cookie Policy.

We do not buy personal data from data brokers, and we do not build advertising profiles.

We do not sell your personal data. We do not share it between organisations. We do not use your business data for advertising, and we do not use it to train AI models — ours or anyone else's.

The Services include VO, an AI assistant. When you use it, the content needed to answer your request — your question, and the records from your own Workspace that your role is permitted to read — is sent to a language model provider over an API, and the answer is sent back.

Three things are worth being precise about:

• It is sent to answer you and for nothing else. We do not permit our providers to use it for model training, and our agreements with them reflect that. VO does not learn from your data and is not trained on it.
• VO cannot exceed your own permissions. It reads what your role can read. If a record is invisible to you, VO cannot retrieve it, summarise it, or act on it.
• Speech is transient. Where you use voice, audio is processed to produce or interpret speech and is not retained by us afterwards.

The providers are listed on the subprocessors page. If you would prefer no AI processing at all, VO Chat can be left unused, and an Enterprise agreement can disable VO for your Workspace — write to contact@ofivio.com.

The full technical description is on the Security page. In summary:

• Tenant isolation. Every Workspace lives under its own identifier inside one of four top-level stores — individuals, businesses, enterprises, and visitors for trials. Access rules are enforced on the server and in the database itself, so a request for another organisation's data fails regardless of what the client asks for.
• Encryption. TLS in transit; AES-256 at rest, including files.
• Credentials. Passwords are hashed with bcrypt and never stored or logged in readable form. Sessions use signed tokens in httpOnly, secure, sameSite cookies.
• Abuse controls. Rate limits on authentication, uploads, general API traffic and VO; reCAPTCHA on sign-up and sign-in.
• Audit trail. Actions inside a Workspace are logged immutably.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authority without undue delay, with what we know and what we are doing about it.

We use the following providers to run the Services. Each receives only what it needs for its function, under contract, and none of them is permitted to use your data for its own purposes.

Which language model answers a given request depends on the task and on availability. We may add or change providers; where a change materially affects how your data is processed, we will update this page and give notice as described in the Privacy Policy.

We may also disclose data where the law requires it — a valid court order or a lawful request from an authority — or to establish or defend a legal claim. Where we are permitted to tell you, we will.

The platform runs on Google Cloud infrastructure in the us-central1 region, in the United States, and our AI and speech providers process requests in the United States and Europe. If you are outside those places — and most of our customers are — your data will be transferred internationally. Those transfers rely on the providers' standard contractual clauses and equivalent safeguards, and we contract with each provider on that basis.

ofivio.com uses a small number of cookies: to keep you signed in, to remember your interface preferences, and to count visits. It uses no advertising cookies and no cross-site tracking.

Each cookie, what it does and how long it lasts is listed in the Cookie Policy, along with how to control them.

This site and the Ofivio application carry no advertising. No ad script runs on ofivio.com, no advertising cookie is set, and nothing in your Workspace is used to target an advertisement anywhere. We are paid by subscription, which is the whole reason we do not need to be paid by advertising.

We do operate a separate site, ofivio.xyz — Ofivio Briefcase, a set of free public tools — and that site does carry advertising served by Google AdSense. It is a different site with a different purpose, requires no account, and publishes its own privacy policy, cookie policy and terms covering the advertising it shows and the choices you have about it. Using this site does not put you into anything on that one; the two hold no data in common.

Depending on where you live, you have the right to:

• Access — get a copy of the personal data we hold about you.
• Correct — have inaccurate data fixed. Most of it you can edit yourself in your settings.
• Delete — have your data erased, subject to records we are legally required to keep.
• Export — receive your data in a portable format.
• Restrict or object — limit how we process it, or object to processing based on legitimate interests.
• Withdraw consent — at any time, where we relied on consent. Withdrawing it does not undo processing already carried out.
• Complain — to your local data protection authority. We would appreciate the chance to put it right first.

Write to contact@ofivio.com. We will respond within 30 days, and we will verify your identity before acting on a request — an unverified deletion request is itself a security risk.

If your data is in someone else's Workspace — you are an employee, a client or a tenant of a customer of ours — that organisation is the controller and we cannot amend or delete its records on your instruction. Ask them. If you cannot reach them, tell us and we will help you get to the right place.

Two parts of the Ofiverse around Ofivio show information about people to other people, so they are set out on their own here.

OfiPulse: nothing is broadcast unless you choose it

OfiPulse is the live broadcast of Ofiverse. It shows Ofiverse members activity from Ofibe, OfiGrid, OfiVibe, Ofivio and the Ofiverse Products — but only activity a member has chosen to share by pressing Pulse Me on it.

• Consent, one activity at a time. Nothing about you reaches OfiPulse unless you press Pulse Me. That consent is the lawful basis for the broadcast.
• View-only. Members can watch, discover and follow what is broadcast. OfiPulse publishes nothing of its own, and it is separate from OfiNews.
• You can turn it off at any time. Withdrawing your consent stops the broadcast from then on; it cannot undo what members already saw while it was shared.
• An organisation's data stays its own. Pulse an activity from a Workspace only where you are entitled to share it; the organisation remains the controller of its business data (section 1).

OfiGraph: ratings by performance, never by followers

OfiGraph is the rating engine of Ofiverse. It rates professionals and companies on performance — professional rating, company rating, project performance and reputation — and the rating is shown on OfiGrid and across the ecosystem. Follower counts are never a criterion.

• Why. So that people choosing whom to hire or work with can judge the work rather than its popularity. We rely on our legitimate interests, and on yours in being judged on what you actually do.
• Seeing your rating. It shows on your OfiGrid profile, and you can ask us at any time what it is built from.
• Correcting it. If a rating rests on information that is wrong, write to contact@ofivio.com. We will check it, correct the information where it is inaccurate and recalculate, and you may ask for a person to review the result. Your right to object in section 11 applies to it as well.

Children

The Services are business software and are not directed at children. You must be 18 to hold an account (Terms, section 3), and we do not knowingly collect personal data from anyone under 18. If we learn that we have, we delete it. If you believe a child's data has been given to us, tell us at contact@ofivio.com.

Changes to this policy

We may update this policy. The date at the top always shows when it last changed. Where a change materially affects how we handle your personal data, we will give notice by email to your Workspace owner or in the application before it takes effect.

Contact

OFIVIO (SMC-PRIVATE) LIMITED
100/14, Lower Ground, Aijaz Chamber
DHA Main Boulevard, Lahore, Pakistan
+92 300 7512464
contact@ofivio.com
Help Desk