- 1. Who is responsible
- 2. What we collect
- 3. OPERO mobile app
- 4. Why we use it, and on what legal basis
- 5. Who we share it with
- 6. Transfers outside the EU/EEA
- 7. How long we keep it
- 8. Security
- 9. Your rights
- 10. Cookies and analytics
- 11. Changes
- 12. Contact
This policy explains how Ofski, MB collects and uses personal data when you visit opero.events, sign up for OPERO, sign in, and pay for it.
1. Who is responsible
The controller is Ofski, MB:
- Company code: 304215619
- Address: Naugarduko g. 26-13, LT-03225 Vilnius, Lithuania
- Email: support@opero.events (privacy questions too)
Data inside your Workspace. Workspaces hold data such as events, artists, contacts and finances. For that data the OPERO customer who owns the Workspace is the controller. We process it only on the customer’s behalf, under our Data Processing Agreement (opero.events/dpa). If your data is in someone’s Workspace, contact that company first.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account and identity | First and last name, email address, password (stored only as a secure hash), language, profile photo if you add one | You |
| Workspace and membership | Company or workspace name, workspace address, country, time zone, which workspaces you belong to and your role | You, your Account admin |
| Billing | Billing name and address, VAT number if any, plan, invoices, payment status. Card or bank details are handled by Stripe; we only see the type and last four digits. | You, Stripe |
| Communications | Emails and support requests you send us | You |
| Technical and security | IP address, browser type, sign-in times, request logs, security events, bot-check result (Cloudflare Turnstile) | Automatically |
We do not intentionally collect special categories of personal data. The Service is not intended for anyone under 18.
3. OPERO mobile app
The OPERO app for iOS and Android gives members of an OPERO Workspace access to their Workspace on the go. It is provided by Ofski, MB. The roles described in this policy apply in the same way: Ofski, MB is the controller for your account data, and processes Workspace data on behalf of the customer who owns the Workspace.
What the app processes. When you sign in, the app sends your email address and password over an encrypted connection to account.opero.events to authenticate you; the app does not store your password (your device’s password manager may save it if you choose). The app then shows and lets you edit the data of the Workspaces you are a member of, for example events, tasks, comments and notes, finance entries, ticket sales, team members and documents, and uploads photos and files you choose to attach, such as receipts. Questions you ask the OPERO assistant are sent to your Workspace server.
Where data goes. The app communicates only with OPERO’s servers: account.opero.events (your account and sign-in) and your Workspace’s address (<workspace>.opero.events). It contains no advertising, analytics, crash-reporting or tracking software and does not track you across apps or websites. AI features and document reading are performed by the Workspace server through the AI provider listed in this policy (Anthropic); the app itself does not contact it.
Camera and photos. The app asks for camera access only when you choose to take a photo of a receipt or document. Photos you pick are selected with your device’s system picker, which does not give the app access to your photo library. Temporary copies are deleted from the device after a successful upload.
Data stored on your device. Sign-in tokens are kept in the device’s secure storage (iOS Keychain / Android Keystore). For offline use, the app keeps an encrypted copy of recently viewed Workspace data for up to 7 days, and an encrypted queue of files you added while offline until they are uploaded. Signing out, or losing access to a Workspace, deletes the tokens, the offline copy, the queue and any previewed documents from the device. Your appearance and sound preferences are stored locally.
Deleting your account. You can delete your OPERO account on the web (in a Workspace: Settings › My account › Delete my account) or by writing to support@opero.events. The steps are at opero.events/delete-account. Workspace data belongs to the Workspace’s organisation and is handled under its agreement with OPERO.
Contact. Questions about the app and your data: support@opero.events.
4. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and run your Account and Workspaces, sign you in, send emails you need (confirmation, invitations, sign-in links, password reset) | Contract (Art. 6(1)(b)) |
| Billing, invoices, tax and accounting records | Contract; legal obligation (Art. 6(1)(c)) |
| Security, preventing fraud and abuse (bot checks, logs, rate limits) | Legitimate interests (Art. 6(1)(f)) |
| Support and service messages (for example changes to terms, incidents) | Contract; legitimate interests |
| Improving the Service using aggregated usage information | Legitimate interests |
| Marketing emails, only if you opt in | Consent (Art. 6(1)(a)), which you can withdraw at any time |
5. Who we share it with
We use the following service providers (processors), only to provide the Service:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting servers | EU (Germany/Finland) |
| Amazon Web Services EMEA SARL | Encrypted offsite backups | EU (Paris) |
| Stripe Payments Europe Ltd. | Payments, invoices, tax calculation | EU; transfers to the US under safeguards |
| Cloudflare, Inc. | Bot protection on sign-up (Turnstile); website visit statistics (Web Analytics) | Global; transfers under safeguards |
| Hostinger International Ltd | Sending emails | EU (Lithuania) |
| Anthropic, PBC | AI features (only content you use in AI features) | US; transfers under safeguards |
We may also disclose data to authorities when required by law, to professional advisers (for example our accountant) and to a successor if our business is transferred. We do not sell personal data.
Services you connect yourself. Some features work only when a Workspace connects its own account with another provider, such as an advertising account, a ticketing platform or a flight data service. That provider is chosen by the Workspace, works under its own terms and privacy policy, and is not our processor. We send it only what the feature needs, and only while the connection is on. A Workspace owner or admin can disconnect it at any time in Settings → Integrations.
| Service | What it is used for | What we send | Provider’s policy |
|---|---|---|---|
| AeroDataBox, through RapidAPI | Flight lookup in Touring: fills in times and airports for a flight | The flight number and date, with the Workspace’s own RapidAPI key. No names or other personal data. | aerodatabox.com, rapidapi.com/privacy |
6. Transfers outside the EU/EEA
Some providers process data outside the EU/EEA, mainly in the United States. In that case we rely on an adequacy decision (for example the EU–US Data Privacy Framework, where the provider is certified) or on the European Commission’s Standard Contractual Clauses.
A service you connect yourself may process data outside the EU/EEA under its own terms. For flight lookup no personal data is sent.
7. How long we keep it
- Account data: while your Account exists, and up to 60 days after it is closed.
- Workspace data: as described in our Terms. Trial Workspaces are deleted 30 days after the trial ends. Cancelled Workspaces are deleted 30 days after the subscription ends. Workspaces locked for non-payment are deleted 60 days after locking.
- Backups: deleted data may remain in encrypted backups until those backups expire. Active Workspaces may have yearly backup copies kept for up to 10 years; backups of deleted Workspaces are removed within about 12 months.
- Billing and accounting records: 10 years, as required by Lithuanian law.
- Security logs: up to 14 days, unless needed longer to investigate an incident.
- Unconfirmed sign-ups: deleted after 7 days.
8. Security
- Data is encrypted in transit (HTTPS).
- Each Workspace has its own separate database.
- Access is limited to staff who need it.
- Passwords are stored only as hashes.
- Logs are kept free of passwords and session tokens.
- Backups are encrypted and stored offsite in the EU.
9. Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy;
- correct it;
- have it deleted;
- restrict its processing;
- object to processing based on legitimate interests;
- data portability;
- withdraw consent at any time.
To use these rights, email support@opero.events. We will reply within one month. You can also complain to the Lithuanian data protection authority, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), or to the authority in your country.
10. Cookies and analytics
We use only cookies that are strictly necessary for the Service to work:
- the sign-in session cookie;
- a security token that protects forms;
- a cookie that remembers your preferences, such as theme;
- Cloudflare Turnstile, on the sign-up page, to tell people from bots.
These do not need consent.
Analytics. We use Cloudflare Web Analytics to count visits to the opero.events website. It does not use cookies, does not store anything on your device and does not track you across sites. It records the page address, the website you came from, and general information your browser sends anyway: approximate country, device type, browser and operating system. It does not identify you and does not build a profile of you.
Because we use no analytics or marketing cookies and no cross-site tracking, no cookie consent banner is shown.
11. Changes
We may update this policy. We will post the new version here with a new effective date, and tell Account owners by email about material changes.
12. Contact
Ofski, MB · Naugarduko g. 26-13, LT-03225 Vilnius, Lithuania · support@opero.events