Privacy Policy
Effective date: 16 September 2026 · Version 1.0
1. Who we are
OPEX FP&A is operated by Opex Technologies Pte. Ltd. ("we", "us"), Singapore. For any privacy question or request, contact us at the address on our contact page or by email; we respond within 30 days.
2. What we process
To operate the service we process: (a) account identifiers — your email address or username, display name and hashed passwords; (b) one-time sign-in codes (OTPs) and session records; (c) configuration you enter, such as your Epicor OData endpoint and per-company reporting settings; (d) financial master data and balances synchronised from your Epicor Kinetic environment (companies, books, GL accounts, account segments, report categories, fiscal calendars, trial balances and journal lines); (e) operational logs and error diagnostics.
3. Why we process it
Account data and OTPs are used to authenticate you (contract performance). Epicor data is processed to deliver the reporting service you subscribed to (contract performance). Logs and diagnostics are used for security and service reliability (legitimate interests). Contact-form messages are used to respond to your enquiry.
4. Where data lives
Application data is stored in Cloudflare D1 databases in your account or ours, and the service runs on Cloudflare Workers. Credentials for your Epicor integration are encrypted at rest with AES-256-GCM; we never store your card details — subscription payments are handled by Stripe under its own privacy policy.
5. Retention
Staged Epicor data is refreshed on each sync and retained while your subscription is active. One-time passwords expire after 10 minutes and consumed codes are invalidated immediately. Sessions expire after 7 days. On request, we delete account and staged data within 30 days of subscription end.
6. Recipients
We use Cloudflare (hosting, D1, transactional email) and Stripe (payments) as processors. We do not sell personal data and we do not use your financial data for advertising.
7. Your rights
Subject to applicable law (including the Singapore PDPA and, where relevant, the GDPR), you may request access, correction, portability or deletion of your personal data, and object to or restrict certain processing. Contact us to exercise these rights.
8. Changes
If this policy changes materially, we will notify active account holders by email at least 14 days before the change takes effect.
Questions? Contact us.