Privacy Policy

Operate is a self-hosted AI SRE distributed as a container image and operated by Jalan Technology Consulting Pvt Ltd, registered at 2 R 12, RC Vyas colony, Bhilwara - 311001, Rajasthan ("Operate", "we", "us"). This policy applies to the operatex.dev website, the account and billing dashboard, and the telemetry the Operate container sends back to us.

Operate is distributed as a self-hosted Docker image. Your investigations, logs, repositories, databases, and operational data stay inside your own infrastructure and are not received or processed on our servers. Our hosted website and account portal exist only for licensing, billing, authentication, metering telemetry, and account management.

For privacy questions or requests, contact developer@operatex.dev. For all other matters, contact developer@operatex.dev.

This policy covers:

• information you give us when you create an account and pay for the service;
• usage telemetry the Operate container reports for metering and billing;
• technical information collected when you visit operatex.dev.

This policy does not cover:

• data processed by the Operate container inside your own infrastructure, which remains under your control and your own privacy notices;
• third-party services you connect Operate to, which are governed by their own privacy policies.

Account and authentication information

When you register we collect your email address, a hashed password credential, your company name, and any App IDs issued to your account. We do not store your password in plain text.

Billing information

We collect the billing details you enter — legal or trading name, billing address, country, and where applicable a tax identification number such as a GSTIN. Card details are collected and stored by our payment processor; we do not receive or store full card numbers. We retain payment references, invoice records, amounts, and payment status.

Usage telemetry

The Operate container reports metering events to us so we can bill accurately. Each event contains an App ID, token counts, the model name, the agent type, and a duration. It does not contain your logs, your database records, your source code, or the content of an investigation.

Infrastructure and integration credentials

Credentials for your own systems and connected services are configured in your deployment and are held in your infrastructure. Where you explicitly authorise a hosted integration from your account (for example connecting a code host so Operate can open a draft pull request), we store the resulting installation identifier and a hashed installation secret needed to operate that integration.

Customer-provided data

Data you or your users submit directly into our website or dashboard — support messages, form content, correspondence — is collected as submitted.

Website and technical metadata

Our hosting and infrastructure providers process standard request metadata, including IP address, user agent, timestamps, and requested paths, for delivery, availability, and abuse prevention.

Operate can be connected to services you already run, such as chat platforms and code hosts. Where you enable an integration:

• the integration operates with the permissions you grant it, and integration adapters used for investigation are read-only;
• the only write action Operate performs is opening a draft pull request that a person must review and merge;
• message content, channel content, and repository content exchanged through an integration are processed within your deployment and are not transmitted to us as part of telemetry.

If a Microsoft Teams or Slack application is used, the identifiers and tokens required by that platform are handled as described under "Infrastructure and integration credentials".

We use the information described above to:

1. create, authenticate, and secure your account;
2. meter usage, calculate credit consumption, and issue invoices;
3. process payments, renewals, and refunds through our payment processor;
4. send service communications such as low-balance, renewal, and invoice emails;
5. provide support and respond to your requests;
6. monitor availability, detect abuse, and investigate security incidents;
7. meet our legal, tax, and accounting obligations.

We do not sell personal information and we do not use your data to train models we make available to other customers.

Where data protection law requires a legal basis (for example under the UK GDPR or EU GDPR), we rely on:

• Performance of a contract — to provide the service, meter usage, and bill you.
• Legitimate interests — to secure the service, prevent abuse, and improve reliability.
• Legal obligation — to keep tax and accounting records.
• Consent — where we ask for it, and which you may withdraw at any time.

Where a regime other than those named above applies to you, we process personal data in line with the requirements of that regime.

We do not use third-party subprocessors to process customer investigation data, because those workloads remain inside your own infrastructure and never reach our systems.

We do use third-party providers strictly for business operations such as payment processing, metering telemetry, website hosting, and email delivery. Those providers do not process customer investigation workloads, and each handles data only on our instructions and only as needed to deliver its function.

We share information only:

• with the service providers described above;
• where you direct us to, such as when you enable an integration;
• where required by law, regulation, legal process, or an enforceable governmental request;
• to establish, exercise, or defend legal claims, or to protect the rights and safety of our users and the public;
• in connection with a merger, acquisition, or asset sale, subject to this policy continuing to apply.

Our providers may process information in countries other than your own. Where personal data is transferred across borders, we rely on an appropriate transfer mechanism recognised under applicable law.

We are established in India, and the operational providers we use may process account, billing, and telemetry data outside your country. Customer investigation data is not transferred, because it never leaves your infrastructure.

Account, billing, telemetry, and related records are currently retained indefinitely. We have not yet established a formal retention schedule, and this policy may be updated when we do. Invoice and payment records are in any case retained for the statutory period applicable to us.

You may request deletion of your account by contacting developer@operatex.dev. We will delete or anonymise personal data we hold, except records we are required to keep. Data held inside your own infrastructure is deleted by you.

Measures we apply to the data we hold include:

• encryption in transit for all connections to our services;
• encryption at rest for our managed database and object storage;
• row-level access rules so account data is only readable by that account;
• secrets and API keys held in server-side environment configuration, never exposed to the browser;
• signature verification on inbound payment webhooks;
• logging of privileged and administrative operations.

No system is perfectly secure. We cannot guarantee absolute security, and this section does not create a warranty. Suspected vulnerabilities and security incidents can be reported to developer@operatex.dev, and we will notify affected account holders of an incident that affects their data without undue delay.

Because Operate runs in your infrastructure, you are responsible for:

1. securing the environment in which the container runs;
2. managing the credentials and permissions you give the container;
3. keeping your App IDs confidential and rotating them if exposed;
4. providing your own privacy notices and legal bases for the data your deployment processes;
5. controlling who in your organisation can access the Operate account and dashboard.

Our marketing pages are static and do not require cookies to render. The account dashboard uses local browser storage strictly to keep you signed in; this is essential to the service and cannot be disabled while you remain logged in.

We do not use advertising cookies, and we do not sell or share browsing information with advertising networks.

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• request erasure;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with your supervisory authority.

To exercise a right, email developer@operatex.dev. We may need to verify your identity before acting. We will respond within the period required by applicable law.

Operate is a business product intended primarily for organisations and professional users, and it is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact developer@operatex.dev and we will delete it.

We may update this policy as the service or the law changes. When we do, we will revise the effective and last-updated dates at the top of this page. Material changes will be communicated to account holders by email or in-product notice before they take effect.

Privacy enquiries and requests: developer@operatex.dev.

General enquiries: developer@operatex.dev.

Postal address: Jalan Technology Consulting Pvt. Ltd., 2 R 12, RC Vyas Colony, Bhilwara - 311001, Rajasthan, India.

If you are not satisfied with our response, you may complain to the data protection authority in your jurisdiction.