Privacy Policy

Impry OS ("we", "us", "our") is dedicated to safeguarding the privacy and security of your personal data. This Privacy Policy details our data collection practices when you visit our website, register for an account, and utilize the Impry OS software platform.

Under the European Union General Data Protection Regulation (GDPR) and UK Data Protection Act:

• Impry OS as Data Controller: We are the Data Controller for your account details, billing transactions, and technical telemetry collected to provide our service.
• Impry OS as Data Processor: For any client records, project scopes, or client contact info you store in your workspace, you are the Data Controller and Impry OS acts as your Data Processor.

We collect information in the following categories:

We process personal data based on the following lawful bases:

• Contractual Performance: Processing required to maintain your account, authenticate sessions, generate invoices, send reminders, and deliver the Impry OS service.
• Legitimate Interests: Improving platform performance, detecting fraudulent activity, preventing system abuse, and securing our multi-tenant architecture.
• Legal Obligations: Compliance with statutory tax reporting, financial accounting, and valid law enforcement inquiries.
• Consent: Where you explicitly opt in to optional marketing communications or specialized beta features (which you may withdraw at any time).

We use the personal information collected to:

• Authenticate and maintain secure multi-device sessions via Better Auth.
• Calculate monthly revenue metrics, at-risk project alerts, and follow-up inbox items.
• Deliver transactional emails, project updates, and client invoice notices via Resend.
• Generate public read-only scope URLs and invoice documents for your clients.
• Process subscription upgrades, renewals, and feature gate entitlements.
• Provide technical support and diagnose system performance bottlenecks.

We do not sell personal data. We share data only with vetted third-party service providers ("Sub-Processors") strictly necessary to operate Impry OS:

Your information may be transferred to and maintained on servers located outside of your state, province, or country. Where personal data originates in the European Economic Area (EEA) or UK and is transferred to jurisdictions without an adequacy decision, we implement standard contractual clauses (SCCs) approved by the European Commission to ensure equivalent data protection safeguards.

We retain personal data for as long as your workspace account remains active or as required to fulfill legal, accounting, and tax compliance obligations.

When you delete your account via the Workspace Settings (Danger Zone), our system permanently removes your active user sessions, workspace memberships, and customer records from our primary production databases within thirty (30) days.

Depending on your location (e.g., GDPR, UK DPA, CCPA/CPRA), you have the following legal rights:

• Right to Access: Request a copy of all personal data held about you.
• Right to Rectification: Correct inaccurate or incomplete account and profile records.
• Right to Erasure ("Right to be Forgotten"): Request complete deletion of your personal data.
• Right to Data Portability: Export your clients, projects, and invoices into standard machine-readable formats (CSV/JSON).
• Right to Restrict or Object to Processing: Object to processing based on legitimate interests.
• California Privacy Rights (CCPA/CPRA): We confirm that Impry OS does not sell personal information or share it for cross-context behavioral advertising.

To exercise any of these rights, email our Data Protection Officer at privacy@impryos.com. We respond to all verified requests within thirty (30) days.

We implement industry-standard technical and organizational measures to safeguard personal data, including:

• Full TLS 1.3 encryption across all web traffic and API endpoints.
• AES-256 database-level encryption at rest.
• Row-Level Security (RLS) ensuring strict workspace isolation.
• Argon2id and Bcrypt password hashing algorithms via Better Auth.
• Multi-device session revocation triggers in settings.

Our Service is not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from minors. If we discover that a minor has provided us with personal information, we will take immediate steps to delete such data from our servers.

For any questions, data subject access requests, or privacy concerns, please contact: