Privacy Policy
Governeto is a solution provided by OPNYX SOLUTIONS ("we", "us"), the legal business entity that owns and operates the Governeto service and the governeto.com website. This policy says what the service holds, why it holds it, who processes it for us, and how it is removed.
An organisation that uses Governeto decides what is recorded about its own agents. For that record the organisation is the controller and we act on its instructions. For accounts, billing and messages sent to us, we are the controller.
1. What the service holds
| What | Detail |
|---|---|
| Your account | Name, email address, role, organisation, and how you sign in. A password is kept only as a salted scrypt hash. |
| Your organisation | Its name, its address on Governeto, its plan, its rules and its settings, including the look of its console and any background picture an administrator gives it. |
| Devices | The device's name, its operating system, the login name on it, its last IP address, and a one-way hash of the machine's own id. The raw id never leaves the machine. |
| Who connected | When a machine connects: the git name and email set on it, the name, email and organisation of the Claude account signed in on it, the name of the project folder, and the address of its repository. |
| Agent connections | The agent's kind and version, the person and device it belongs to, and whether it is switched on. |
| The record of calls | For each call: the agent, the tool, one line about the call, the project folder's name, the time, the model, token counts, and the verdict. Credentials are removed from that line before it is stored. |
| Prompts and replies | Stored only when the organisation switches on the evidence rule, which starts off. Up to 8,000 characters of what was asked and of what came back, by default, are then kept beside the call, from the start and the end of the text, with credentials removed. Without that rule, words that were judged are not stored, and the record keeps only that a prompt of a given length was made. |
| AI engine keys | Sealed with AES-256-GCM. Only the last four characters are ever shown. |
| Billing | The subscription's status and the customer reference at Paddle. Card details are held by Paddle, not by us. |
| Messages to us | What you write in the contact form, kept so that we can answer you. |
2. What leaves a connected machine
- Before each tool call: which agent, the machine's name and the hash of its device, the project folder's name, the session id, the tool's name, and one line about the call: the command, the path or the address.
- Before each prompt: its words, when a rule reads words. Otherwise only that there was one.
- At the end of a turn: the model and the token counts.
- When a rule reads words, as the rules switched on in a new organisation do, these also go to the server to be judged, up to 8,000 characters each: what a tool is given, which can be the text of a file being written; the prompt and the reply; and what tools returned, which can be the text of a file that was read. An administrator can switch those rules off. Text that is only judged is not stored.
- Never: the key file, the machine's raw id, or anything while the agent is idle.
3. How we use it
- To check each call against the organisation's rules and to show the organisation its own record.
- To sign people in, enforce roles, and count agent connections for billing.
- To keep your settings on the server under your organisation. The console keeps your sign-in token in your browser, and the installed app keeps a copy of the page itself. While you sign in with Google, Microsoft or an email, Firebase holds its own record of that sign-in in the tab; it goes when the sign-in ends or the tab closes.
- To keep the service secure and to answer requests for help.
4. Who processes it for us
| Provider | Purpose | Data involved |
|---|---|---|
| Oracle Cloud Infrastructure | Runs the API and its database. | Everything in section 1. |
| here.now | Serves the website and the console, and carries the console's requests to the API. | Request metadata, and those requests as they pass through. |
| Google Fonts | Serves the typefaces of the console. | Standard request metadata. |
| Google Firebase | Sign-in with Google, Microsoft and email. | Email address, name, sign-in events. |
| Microsoft | Sign-in, when you choose Continue with Microsoft. | Email address, name, sign-in events. |
| Paddle | Merchant of Record: checkout, invoices, tax and refunds. | Billing details you give at checkout. |
| A site your admin names | If an admin sets the background by an https address, each person's browser loads the picture from that site. | That site sees the person's IP address and browser. |
| The AI engine your organisation chooses | Judges a text when a rule needs it, and answers Explain and Ask, on the organisation's own key. | The text being judged, and the calls and figures a question is about, which can name people. |
| Slack | Announces a held call, only when an administrator sets a webhook. | The agent, the tool and one line about the call. |
5. Where it is held
The API and its database run on Oracle Cloud Infrastructure in the Hyderabad region, India. The website and the console are served by here.now.
6. What we do not do
- We do not sell or rent your data.
- We do not use an organisation's record to train AI models.
- We do not use it for advertising. The website and the console carry no advertising or analytics trackers.
- We do not look at an organisation's record, except to answer a request from that organisation or to keep the service secure.
7. Retention and deletion
The record has no automatic expiry today. It stays until an administrator erases it with RESET DATA on the Connections page, or until the organisation asks us to close its account. Console sessions end after 12 hours. The sign-in of a chat app can be renewed for up to 30 days.
8. Your rights
You may ask to see, correct or delete the data held about you, and you may object to its use. If an organisation holds your data in its record, ask its administrator first. Otherwise write to reachout@opnyx.com. Where your local law gives you further rights, those rights apply.
9. Security
The measures are described on the Security page.
10. Children
Governeto is a service for businesses and is not directed at anyone under 16.
11. Changes
We may update this policy, and we change the date at the top when we do.
12. Contact
Questions about privacy: reachout@opnyx.com. See also our Terms of Service and Refund Policy.