Privacy Policy

This policy covers the data used to request and deliver Opus Solutions project services: custom websites, online stores, landing pages, mobile applications and graduation projects. This includes project requests, conversations and materials you supply. You can submit and follow a project request without creating an account.

We collect only what is necessary to provide, secure and improve the service you requested.

Your data is used only for the following purposes:

• To understand, quote, build and deliver the work or service you asked for.
• To communicate with you about your project, and to provide support.
• To send service-related notifications, such as updates and replies in your project conversation.
• To issue invoices and keep the accounting and tax records we are required to keep.
• To detect and prevent fraud, abuse and unauthorised use.
• To improve the quality and reliability of what we offer, through aggregated and anonymised analytics.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes. We do not use your data for advertising, profiling, or automated decision-making that affects your legal rights.

Opus Solutions uses only strictly necessary cookies. These include:

• Session cookies: to maintain your authenticated session when accessing your project while signed in.
• CSRF cookies: to protect against cross-site request forgery attacks.
• Project access cookie: a strictly necessary cookie that lets you return to a project request you submitted without signing in. It is described in A2.

We do not use advertising cookies, tracking cookies, analytics cookies, or any third-party cookies for marketing purposes. You can control cookie settings through your browser, but disabling necessary cookies may prevent parts of the site from functioning correctly.

When you submit the project request form, we collect exactly what the form asks for:

• Your name, as you type it.
• Your preferred contact method (email or WhatsApp) and the contact details you give for it.
• Your project brief: the idea for the website or application, the main outcome you need it to achieve, the features you selected, the approximate budget range you selected, and any deadline you mentioned.
• The messages you and we exchange afterwards in that request conversation.

Why: to understand what you are asking for, to prepare a quote, and to talk to you about it. We do not use a project request for anything else, and we do not add you to a marketing list because of it.

Encryption: your name, your contact details and every message in the conversation are encrypted at rest before they are stored. A one-way hash is used to find your own request without exposing the underlying identifier. Nobody browsing the database sees your brief or your phone number in plain text.

Notification to us: when you submit a request or send a message, our system sends the owner a private alert through an external notification service. The alert contains only your first name as you typed it and a shortened reference number. Your brief, contact details and messages are not included in that alert.

Retention: a project request and its conversation are kept while the request is open and while any resulting project is running. After that, they are kept only as long as we need them for support, accounting and legal obligations, and are then deleted. You may ask us to delete a project request earlier, subject to those obligations.

You can submit a project request as a guest, without signing in. So that you can come back to your own conversation, we set a strictly necessary cookie named opus_project_access on your browser.

• It holds a randomly generated access token for the request you created — nothing else. It contains no name, no contact details and no project content.
• It is HTTP-only, so page scripts cannot read it, and it is sent over HTTPS in production.
• It expires after 90 days, or when you clear your browser cookies. Clearing it means you can no longer open that conversation from that browser, so keep the confirmation we send you.

If you are signed in when you submit a request, the request is linked to that account instead, so you can reach it from any browser.

To build a project we usually need material from you: text and images, product data, brand assets, business details, and access to systems such as hosting, a domain registrar, a payment gateway, analytics or app store accounts.

• We use that material only to build, test and deliver the agreed work.
• We hold it only for as long as the project and its support window need it.
• We ask you to issue us accounts of your own rather than share your personal passwords, so that you can revoke our access at handover. Please revoke it once the project is complete.
• You can ask us to return or delete project material at any time after handover.

If the material you give us contains other people’s personal data — for example a customer list you want imported — you remain responsible for having a lawful basis to share it with us, and we process it only on your instructions for that project.

If you contact us on WhatsApp or through a project conversation, we may retain a record of that communication for support, quality assurance and record-keeping purposes.

Opus Solutions relies on the following third-party services to operate. Each has its own privacy policy and data processing terms, which we encourage you to review.

• Supabase — database and storage for encrypted project request records. Privacy Policy

Each third party processes data in accordance with its own terms and applicable data protection laws. Opus Solutions ensures contractual safeguards are in place with each processor where required by applicable law.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Right to Data Portability: Request a machine-readable copy of your data.
• Right to Object: Object to the processing of your data for certain purposes.

To exercise any of these rights, message us on WhatsApp at +966 59 723 2969. Email support is not available at the moment. Include your project name or reference so we can find the right records. We will respond within the timeframe required by applicable law (typically 30 days). We may need to verify your identity before processing your request.

Opus Solutions implements reasonable technical and organizational measures to protect your data, including:

• Encryption of sensitive fields at rest using AES-256-GCM — including names, contact details and message content in project requests.
• All traffic served over HTTPS/TLS.
• Strict access controls to encrypted data, limited to authorized automated systems and to the owner account.
• Hashing of sensitive identifiers (requester identifiers) for lookup without exposing plaintext values.
• Rate limiting and cross-site request forgery protection on the forms that accept your data.

While we take these precautions seriously, no online service can guarantee absolute security. You use the services at your own risk. We encourage you to use strong, unique passwords, and to enable two-factor authentication on any account you connect to us.

We may update this Privacy Policy when necessary to reflect changes in our practices, legal requirements, or our services. Changes are reflected in the “Last updated” date at the top of this page, and material changes are published on this website. We encourage you to review this policy periodically.

Questions, concerns, or requests about this Privacy Policy or your personal data: message us on WhatsApp at +966 59 723 2969. Email support is not available at the moment.