Privacy Policy

Last updated: 19/08/2026 Wishbones Ltd ("we", "us", "our") provides OpModelHero (the "Service"). This policy explains what personal data we collect, how we use it, and the choices you have. For the personal data you provide about yourself, we are the data controller. For the content you and your organisation put into the Service, you are the controller and we act as your processor. 1. Information we collect - Account details: your name, email address and password (passwords are stored securely by our authentication provider and are never visible to us), plus your organisation memberships and role. - Organisation content: the architecture information you create — requirements, capabilities, actors, processes, applications, data, infrastructure and interactions — and any documents you upload for AI import. - Contact form: if you contact us, the name, email address and message you submit. - Usage and technical data: basic log and device information, and error diagnostics, used to keep the Service secure and working. - Cookies: a small number of essential cookies needed to sign you in and keep your session secure (see "Cookies" below). 2. How we use your information We use personal data to: provide and maintain the Service; authenticate you and keep accounts secure; send service emails such as sign-up confirmations, invitations, password resets and replies to enquiries; provide support; protect against fraud, abuse and bots; and improve and troubleshoot the Service. 3. Legal bases (where applicable, e.g. UK/EU GDPR) We rely on: performance of our contract with you (to provide the Service and your account); our legitimate interests (to secure, support and improve the Service, and to respond to enquiries); your consent where we ask for it; and compliance with legal obligations. 4. AI-assisted document import If you use the AI import feature, the documents you choose to analyse are sent to our AI provider to extract and classify enterprise-architecture information, which is then returned to you to review and accept. You should avoid uploading documents containing personal or sensitive information you do not have the right to process. 5. Service providers We use trusted third parties to run the Service, and share personal data with them only as needed to provide it. These currently include providers for hosting and delivery, database, authentication and file storage, AI document analysis, transactional email, bot protection, and error monitoring. Providers include Vercel, Supabase, Anthropic, Cloudflare & Resend. We do not sell your personal data. 6. International transfers Some of our providers may process data outside your country. Where we transfer personal data internationally, we take steps to ensure it is protected in line with applicable law (for example, appropriate safeguards such as standard contractual clauses). 7. Data retention We keep personal data for as long as your account is active and as needed to provide the Service. If you close your account or ask us to delete your data, we will delete or anonymise it within a reasonable period, except where we must keep it to meet legal obligations or resolve disputes. 8. Security We use technical and organisational measures to protect personal data, including encryption in transit, access controls, and row-level security that limits access to your organisation's data. No system is completely secure, but we work to protect your information and to respond promptly to any issues. 9. Your rights Depending on where you live, you may have rights to access, correct, delete, export or restrict the use of your personal data, and to object to certain processing. You can exercise many of these directly in the Service (for example, editing your profile or deleting your account) or by contacting us. You also have the right to complain to your data protection authority. 10. Cookies We use only essential cookies required to sign you in, keep your session active, and verify administrator access. We do not use advertising or third-party tracking cookies. 11. Children The Service is not intended for children under 18, and we do not knowingly collect their personal data. 12. Changes to this policy We may update this policy from time to time. If we make material changes, we will take reasonable steps to let you know, and we will update the "Last updated" date above. 13. Contact For any privacy question or to exercise your rights, contact us via our Contact page.