Privacy policy.

1. Who we are

Ops AI ("Ops AI", "we", "us", "our") builds AI automation for Managed Service Providers. We are the data controller for the personal data we collect about our website visitors, account holders, and billing contacts. For the operational data you run through the product, we act as your processor — see section 2.

You can reach our privacy team at privacy@msp-ops.ai. Ops AI is operated by MSP Ops AI Ltd, a company registered in England and Wales (company number 17199742), with its registered office at 3 Ketteringham Drive, Warrington, Cheshire, WA5 3UD, United Kingdom.

2. Controller and processor

Ops AI plays two different roles, and the distinction matters for your rights:

When we are the controller

For your account, billing, website, and marketing data, we decide why and how the data is processed. This policy governs that data in full.

When we are the processor

When you connect your tools and run SOPs, Ops AI processes data about your MSP customers and their end-users on your behalf. For that data, you (and in turn your customers) are the controller, and we process it only on your documented instructions under your customer agreement and Data Processing Addendum. If an end-user of one of your customers wants to exercise a right over their data, that request goes to the controller — your MSP — not to us. We'll support you in answering it.

3. Data we collect

As controller, we collect:

• Account and identity data — name, work email, role, and tenant, provided through Microsoft Entra when you sign in. Sign-in is Entra-only; we don't hold a password for you.
• Billing data — your plan, billing contact, and invoice history. Payment is handled by Stripe; full card numbers are tokenised and never reach our systems.
• Product telemetry — feature usage, agent run metadata, and cost traces we need to operate, bill, and improve the service.
• Website data — privacy-friendly, cookieless analytics about visits to www.msp-ops.ai. See section 12.
• Communications — what you send us by email or through the contact form, and our replies.

4. How we use it, and our legal bases

We process personal data only where we have a lawful basis under the UK GDPR and, where it applies, the EU GDPR:

Where we rely on legitimate interests, we've weighed them against your rights and freedoms. You can object at any time — see section 11.

5. Data we process on your behalf

To run your SOPs, Ops AI stores and processes the operational data described on our Security page. In summary, that's:

• Event payloads from your webhooks (PSA, RMM, EDR)
• Agent decision traces — reasoning, tool calls, arguments, results
• The SOP definitions you author
• Minimal customer identity records for cross-vendor mapping
• Audit logs for every write action, approval, and user action

We process this data only to provide, secure, and support the service. We don't access the contents of your tenant except where it's necessary to operate or support it, to keep it secure, or where you ask us to — and any such access goes through a logged, tenant-scoped path. We don't build profiles of your customers' end-users, and we don't use this data for our own marketing.

6. AI and model providers

Ops AI uses large language models to run agents. Model inference is performed by Microsoft's Azure OpenAI Service under a data-processing agreement with two commitments that matter:

• No training on your data. Your prompts, responses, and tool outputs are not used to train or fine-tune any third-party model.
• No retention for model improvement. Prompts and responses are not retained by the model provider to improve their models.

Microsoft's standard service-abuse monitoring may retain prompts and responses securely for up to 30 days before deletion; this data is never used to train or improve models.

The specific Azure regions used for inference are disclosed in your agreement.

7. Sub-processors and sharing

We don't sell personal data, and we don't share it for anyone else's advertising. We use a small set of sub-processors to run the service, each under a data-processing agreement:

We may also share data with our professional advisers where needed, with authorities where the law requires it, and with a successor in the event of a merger or acquisition (in which case this policy continues to apply to your data). We give advance notice of new sub-processors as set out in the Data Processing Addendum, so you can object.

8. International transfers

Customer data is region-pinned. The operational data we process on your behalf is stored in a single Microsoft Azure region (currently in the US), with geo-redundant backups in Azure's paired region.

For our own controller data, and for the limited sub-processors above, some processing may take place outside the UK or EEA. Where it does, we rely on an adequacy decision, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses, with additional safeguards where appropriate.

9. How long we keep data

We keep data only as long as we need it. These are our default retention periods; tighter or longer limits can be agreed per tenant.

10. Security

Customer data lives in tenant-scoped PostgreSQL with per-tenant isolation that's verified by automated tests on every deploy. Vendor credentials are encrypted at rest, with the encryption key held in Azure Key Vault. Every write passes through an approval gate, and every action is recorded in an append-only audit log. The full architecture — data-flow diagram, tenant isolation model, and retention — is on our Security page.

11. Your rights

Under the UK GDPR and EU GDPR you have the right to access, rectify, erase, restrict, and port your personal data, to object to processing, and to withdraw consent where we rely on it. To exercise any of these, email privacy@msp-ops.ai. We'll respond within 30 days and won't charge you for a reasonable request.

If your request concerns data we process as a processor — that is, data about one of your MSP customers or their end-users — please direct it to the controller (your MSP). We'll help them respond.

12. Cookies and analytics

This website uses no advertising cookies and no cross-site tracking. Visitor analytics are collected through Cloudflare Web Analytics, which is cookieless and does not fingerprint or profile you. The product may set a strictly-necessary cookie to keep you signed in; that cookie isn't used for tracking.

13. Children

Ops AI is a business tool. It isn't directed at children, and we don't knowingly collect personal data from anyone under 16. If you believe a child has provided us data, email privacy@msp-ops.ai and we'll delete it.

14. Changes to this policy

We'll update this page when our practices change and revise the effective date at the top. For material changes that affect you, we notify account holders by email before they take effect.

15. Contact and complaints

Questions, requests, or concerns about privacy go to privacy@msp-ops.ai. For a signed Data Processing Addendum or a specific clause in writing, email legal@msp-ops.ai.

If you're in the UK and we can't resolve a complaint, you can contact the Information Commissioner's Office at ico.org.uk. If you're in the EEA, you can complain to your local supervisory authority. We'd rather you came to us first so we can put it right.