Privacy Policy

Effective November 4, 2026

This Privacy Policy explains how ObligationOS collects, uses, discloses, and protects information when you use the Service. It should be read together with the Terms of Service.

1. Information we collect

We collect account information such as name, email address, authentication information, workspace membership and role, notification preferences. We process documents, images, spreadsheets, text, obligations, dates, amounts, notes, workspace items, AI questions, and other content you choose to submit. We may also collect technical and operational information such as IP address, browser/device information, timestamps, logs, security events, and feature usage needed to operate and protect the Service.

2. How we use information

We use information to provide and secure accounts and workspaces; store and analyze documents; identify and organize potential obligations and dates; provide AI features; deliver email and in-app notifications; process subscriptions; provide support; prevent abuse; diagnose errors; comply with law; and maintain and improve the Service.

3. Document storage and security

Production document storage is designed to use private Amazon S3 storage. Uploaded objects are configured for server-side encryption at rest using AES-256, and production web traffic is intended to use encrypted HTTPS connections. Access to workspace content is controlled through authenticated accounts and workspace permissions. No Internet service can guarantee absolute security, and users should avoid uploading information they are not authorized to process.

Routine site administration shows operational metadata rather than uploaded files, full extracted text, summaries, or evidence. Website superuser status alone does not grant access to another workspace's documents. Authorized workspace members can still access content according to their roles and team permissions. The Service is not end-to-end encrypted: the processing system and people with sufficient infrastructure privileges can technically access content. Exceptional operational access is intended only for necessary support, security, or legal purposes; it is not a routine document-browsing feature. Authenticated document views and file downloads generate access records containing account, workspace and resource identifiers, action, and time, without copying document contents. These application access records are normally retained for 90 days.

4. Artificial intelligence processing

ObligationOS uses third-party AI services, including OpenAI, to provide features such as document classification, summaries, obligation identification, deadline extraction, and Ask ObligationOS. Relevant document content and workspace context may be transmitted to OpenAI for processing. OpenAI states that API data is not used to train or improve its models by default unless the API customer explicitly opts in. Under OpenAI's standard API data controls, abuse-monitoring logs may retain customer content for up to 30 days, subject to legal, safety, feature-specific, and account-specific exceptions. Third-party practices may change, and their applicable terms and privacy documentation also govern their processing.

Our AI requests disable optional response storage where supported. This does not eliminate the provider's separate abuse-monitoring, caching or legally required retention. See OpenAI's data controls. Full extracted document text is used temporarily during processing rather than retained as a second full-text database copy for new analyses. Summaries, obligation details and supporting evidence excerpts remain available to authorized workspace members and can themselves contain sensitive information.

5. Service providers

We use service providers to operate the Service. These may include Amazon Web Services for hosting, storage, email delivery; OpenAI for AI processing; Stripe for payment processing; and other infrastructure, security, analytics, or support providers used to operate the Service. Providers receive information only as reasonably necessary for their functions and are subject to their own legal and contractual obligations.

6. Email and in-app notifications

If enabled, we use your email address to send account, verification, workspace, and reminder communications. You can adjust optional reminder channels in account settings. Certain service, security, billing, or legal communications may still be necessary.

7. Payments

Payment transactions may be processed by Stripe. ObligationOS may receive billing status, customer or subscription identifiers, plan information, and limited transaction metadata, while payment-card details are handled by the payment processor according to its policies.

8. How information is shared

We do not make uploaded documents publicly accessible as part of normal Service operation. Information may be shared with members of a workspace according to their permissions; with service providers acting for the purposes described above; at your direction; in connection with a business transaction subject to appropriate protections; or when reasonably necessary to comply with law, enforce rights, protect safety or security, or prevent fraud and abuse. We do not sell uploaded document content as a data product.

9. Retention

We retain account and workspace information for as long as reasonably necessary to provide the Service, maintain legitimate business and security records, resolve disputes, and meet legal obligations. Retention can vary by data type and provider. Deleting an account or content may not immediately remove copies from backups, security logs, legally required records, or third-party systems operating under their own retention schedules.

Original uploaded files remain available for viewing, downloading and re-analysis until deleted through the Service or an applicable deletion process. Deleting a document also removes its associated findings and queues deletion of the original file and completion attachments linked to those findings; failed storage deletions are retried. Earlier file versions and backups can remain under their retention schedules. Legacy extracted-text copies from before this change are removed through a separate cleanup process after confirming that the original file remains available.

10. Your choices

You can update certain account and notification information in the Service, leave eligible shared workspaces, and stop optional email reminders through available settings. Depending on where you live, applicable law may provide additional rights to access, correct, delete, or obtain information about personal data processing. Requests may be submitted through the contact method designated on the ObligationOS website or within the Service, and identity verification may be required.

11. Workspace administrators

When you use ObligationOS through a business or shared workspace, the workspace owner or administrators may control membership, permissions, and workspace content. Your organization may have its own privacy obligations and policies for information it places in the Service.

12. Children

The Service is not directed to children under 13, and we do not knowingly seek personal information from children under 13. Users must meet any higher minimum age required by applicable law or have legally valid authorization where permitted.

13. International processing

Information may be processed in the United States and other locations where ObligationOS or its service providers operate. Where required, appropriate legal mechanisms are used for cross-border processing.

14. Changes to this Policy

We may update this Privacy Policy as the Service, providers, or legal requirements change. The effective date above identifies the current version. Material changes will be communicated where appropriate.

15. Contact

For privacy questions, personal data requests, or deletion requests, email privacy@obligationvia.com.