OpenPlex Privacy Policy

Version 1.0, effective [DD Month 2026] Published at: https://openplex.io/privacy

1. Who we are

OpenPlex is an HR management service provided by Odren Ltd ("Odren", "we", "us", "our"), a private limited company incorporated in England and Wales under company number 15944303, with registered office at 7 Manchester Square, London, W1U 3PQ, United Kingdom.

• Privacy enquiries and requests: privacy@openplex.io
• General support: support@openplex.io

This Privacy Policy applies to:

• the public website at https://openplex.io (the "Website");
• the OpenPlex application at https://app.openplex.io (the "Application"), together the "Service";
• our communications with customers, prospective customers, users and partners.

OpenPlex is a product owned and operated by Odren Ltd. Organisations using OpenPlex, including pilot customers, are customers of Odren and do not own or operate the Service.

2. Our role and the role of your organisation

OpenPlex is used by organisations (each a "Customer") to manage their own workforce in separate company workspaces. Two different roles apply.

If you use OpenPlex because your employer or another organisation has invited you, that organisation is responsible for its HR processing, including the legal basis, the information it requires from you, who can see it and how long it is kept. Its own employee privacy notice explains this. Please contact that organisation first about your HR records. If you contact us, we will forward your request to the relevant Customer where appropriate and lawful.

3. Information we process

3.1 Account and access information (Odren as controller)

• name, email address and, where provided, profile image;
• unique account and authentication identifiers, including identifiers supplied by Google or Apple if you use their sign-in;
• invitations, company voucher or invitation codes used, workspace memberships, roles and permissions;
• account preferences, including notification preferences.

We receive this information from you, from the organisation that invites you, or from the identity provider you choose.

3.2 Security and technical information (Odren as controller)

• IP address, browser type, device and operating system information;
• sign-in events, session information, access timestamps;
• audit records of actions performed in the Service and error and diagnostic logs.

3.3 Subscription and billing information (Odren as controller)

• Customer organisation name, billing contact, billing address and tax identifiers;
• plans, add-ons, voucher redemptions, referral or promoter attribution;
• invoices, payment status and payment references.

Card and other payment details are entered directly into the payment interface of Stripe and are processed by Stripe. Odren does not receive or store full card numbers. Never send card details through support messages.

3.4 Support and communications (Odren as controller)

• the content of messages you send to us, contact form submissions and our replies;
• records of service, security and billing notices sent to you.

3.5 Customer HR information (Odren as processor)

Depending on how the Customer configures and uses its workspace, this may include employment and contact details, job title, team and manager, employment dates, documents, leave requests and balances, onboarding and offboarding tasks, development goals and evidence, review contributions and HR support requests.

HR records may contain special category or sensitive data, such as health information connected to absences. Customers are responsible for limiting uploads to what is necessary, establishing the required legal basis and conditions, and restricting access appropriately.

4. Why we use information and our legal bases

This section applies to processing for which Odren is controller. For HR records processed on behalf of a Customer, the Customer determines the purposes and the legal basis.

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms. You can ask us for more information about that assessment.

We do not sell personal information. We do not use HR records processed for Customers for our own purposes, for advertising, or to train general-purpose artificial intelligence models.

Information you must provide. We need sufficient identity and account information to authenticate you and grant access, and billing information to complete a paid subscription. Without it, the relevant account or transaction cannot be completed. Your organisation decides which HR fields it requires from you.

Swiss law. Where the Swiss Federal Act on Data Protection (FADP) applies, we process personal data in accordance with its processing principles, and the information in this Policy is provided in accordance with Article 19 FADP.

5. Signing in with Google or Apple

5.1 Google sign-in

If you choose "Sign in with Google", OpenPlex requests only the basic sign-in permissions openid, email and profile. Google then shares with us:

• your Google account identifier;
• your email address and whether it is verified;
• your name and, if available, your profile image URL.

We use this Google user data only to authenticate you, to link your Google sign-in to your OpenPlex account and invitation, to display your name in the Service, and to protect access to your account. Authentication is managed by our provider Supabase, which stores this identity and profile information as part of your account record.

OpenPlex does not request access to Gmail, Google Drive, Google Calendar, Google Contacts or any other Google service, and does not read, store or modify content in your Google account. We do not use Google access tokens to call Google services beyond completing sign-in.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy. Google user data is not sold, not used for advertising, not used to build user profiles for unrelated purposes, and not disclosed to third parties except as necessary to provide the Service (including to the service providers listed in section 7), to comply with law, to protect security, or with your consent. Odren personnel do not access Google user data except where necessary for security, support you have requested, or legal compliance.

If we ever wish to request additional Google permissions or use Google user data for a new purpose, we will update this Policy and ask for your consent within Google's authorisation process before doing so.

5.2 Apple sign-in

If you choose "Sign in with Apple", Apple shares the information you authorise, which is a unique identifier and email address and may include your name. If you choose to hide your email address, Apple provides a private relay address. We use this information for the same purposes described for Google sign-in.

5.3 Disconnecting Google or Apple

You can remove OpenPlex's access at any time:

• Google: go to Google Account, Third-party apps and services, select OpenPlex and choose "Delete all connections you have with OpenPlex".
• Apple: on your Apple device go to Settings, your name, Sign-In and Security (or Password and Security), Sign in with Apple, select OpenPlex and choose "Stop Using Apple ID"; or use account.apple.com.

Disconnecting Google or Apple stops that sign-in method. It does not delete your OpenPlex account and does not delete HR records held by your organisation. To keep using OpenPlex, you may need another sign-in method, which your workspace administrator or our support team can help with.

6. Cookies and similar technologies

6.1 Application

The Application uses only cookies and browser storage that are strictly necessary to sign you in, keep your session active, protect against unauthorised access and remember essential settings. These include the authentication session cookies set by Supabase (named in the form sb-…-auth-token), which remain for the duration of your session and are refreshed while you remain signed in. Strictly necessary cookies do not require consent, but you can block them in your browser; the Application will not work without them.

6.2 Website

The Website does not use advertising cookies. [If analytics or other non-essential technologies are added to the Website, list them here and implement a consent banner before activation.]

A detailed cookie inventory is available on request from privacy@openplex.io.

7. Who receives information

Within your organisation. Authorised users of a Customer workspace can see information according to the roles and permissions set by the Customer. Odren operators see company-level administrative metadata (for example plan, billing state and module configuration) and do not have routine access to employee records. Odren staff access HR records only where strictly necessary to provide support requested by the Customer, to address a security incident, or to comply with law.

Service providers. We use the following providers, which process personal information on our behalf under written agreements:

Backups are stored in a Cloudflare account administered under a written agreement between Odren and Ephelia, which acts solely as an infrastructure provider to Odren and has no right to use the data for its own purposes. [Confirm that this agreement is in place.]

Stripe acts as an independent controller for certain processing, such as fraud prevention and compliance with financial regulation; see the Stripe Privacy Policy. Google and Apple act as independent controllers when you use their sign-in services; see the Google Privacy Policy and Apple Privacy Policy.

A current list of subprocessors is available to Customers on request and is incorporated by reference in our Data Processing Agreement. We will give Customers notice of new subprocessors as set out in that agreement.

Other disclosures. We may disclose information where required by law, court order or a competent authority; to protect the rights, safety or security of users, Customers, Odren or others; to our professional advisers under duties of confidentiality; or to a buyer or successor in connection with a merger, acquisition, reorganisation or sale of assets, subject to equivalent protection of the information.

8. International transfers

Odren is based in the United Kingdom. Some of our providers process information in the United States or other countries. Where information is transferred from the UK, the EEA or Switzerland to a country that is not recognised as providing adequate protection, we rely on appropriate safeguards, namely:

• the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, where the recipient is certified; or
• the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum and the adaptations required for Swiss transfers.

You can request a copy of the relevant safeguards from privacy@openplex.io.

9. How long we keep information

Customer HR records are retained according to the Customer's instructions and retention rules, any applicable legal holds and the Customer's agreement with Odren. Closing an individual's access or the end of employment does not, by itself, delete HR records the employer must keep. After a Customer's subscription ends, HR records are deleted as described in the OpenPlex Terms of Service.

Backups. Encrypted backups are kept on a rolling basis for approximately 35 days, with at least the last three verified copies retained. Where a backup fails verification, or a legal hold applies, retention may be extended; in any event, backups are not retained beyond 90 days except under a documented legal hold. Deleted data may remain in backups until they expire. If a backup is ever restored, previously applied deletion instructions are re-applied before the restored data is put back into use.

10. Deleting your OpenPlex account

To request deletion of your OpenPlex account and the account information we hold as controller:

1. Email privacy@openplex.io from the email address linked to your account, with the subject "Account deletion request", stating the workspace(s) you belong to. [If an in-app deletion option is introduced, add it here.]
2. We will confirm receipt and may ask for proportionate information to verify your identity.
3. We will complete the request within one month (30 days for requests under Swiss law), and tell you if an extension or legal exception applies.

Deleting your account removes your sign-in, your profile and your workspace memberships. HR records about you that are held by an employer are controlled by that employer. We will notify the relevant Customer of your request, and the Customer will decide whether those records must be retained under its legal obligations. Workspace administrators can also remove your access at any time.

11. Your rights

Depending on the law that applies to you (including the UK GDPR, the EU GDPR and the Swiss FADP), you may have the right to:

• access your personal information and receive a copy;
• correct inaccurate or incomplete information;
• request erasure;
• restrict or object to processing, including processing based on legitimate interests;
• receive information you provided in a portable format;
• withdraw consent where processing is based on consent, without affecting earlier processing.

To exercise a right concerning Odren's own processing, contact privacy@openplex.io. For HR records, contact your organisation; if you write to us, we will forward your request to it and assist it as its processor. These rights are subject to legal exceptions, and we may need to verify your identity.

We respond within one month under the UK and EU GDPR, extendable by up to two further months for complex requests, and generally within 30 days and free of charge under Swiss law. We will explain any permitted delay or restriction.

You may lodge a complaint with a supervisory authority, in particular the UK Information Commissioner's Office, the Swiss Federal Data Protection and Information Commissioner, or the data protection authority of your EEA country of residence or work. We would appreciate the opportunity to address your concern first.

[EU representative under Article 27 GDPR: name and contact, if appointed. Swiss representative under Article 14 FADP: name and contact, if required.]

12. Automated decision-making

OpenPlex does not make decisions based solely on automated processing that produce legal or similarly significant effects for employees or users. Reviews, approvals and other HR decisions are made by people within the Customer organisation, which remains responsible for them.

13. Security

We apply technical and organisational measures appropriate to the nature of the information, including encryption in transit, encryption of backups, separation of company workspaces, role-based access controls enforced on the server and in the database, restricted and logged operator access, and regular verified backups. No online service can guarantee absolute security. If you suspect unauthorised access to your account, contact support@openplex.io immediately.

Where a personal data breach affects HR records, we notify the affected Customer without undue delay so that it can meet its own obligations.

14. Children

OpenPlex is a business service and is not intended for children. Customers must not use it to process information about children except where lawful and necessary for employment purposes, such as apprentices or emergency contacts.

15. Changes to this Policy

We will publish any update on this page with a new version number and effective date. If changes are material, we will inform users in the Application or by email before they take effect. Where a change requires your consent, including any new use of Google user data, we will ask for it before applying the change.

16. Contact

Odren Ltd, 7 Manchester Square, London, W1U 3PQ, United Kingdom Company number 15944303 (England and Wales) Privacy: privacy@openplex.io Support: support@openplex.io