Privacy Policy

Optonum LLC ("we", "us", "our") operates the Optonum cloud manufacturing operations platform at optonum.com. This Privacy Policy explains what personal and factory data we process, why we process it, and your rights.

Data controller: Optonum LLC. Optonum LLC is a limited liability company formed under the laws of Wyoming, United States. Registered address: 1021 E Lincolnway, Ste. 10591, Cheyenne, WY 82001, United States. Contact: hello@optonum.com.

This policy applies to our website, web application, API, and email communications. By creating an account or using the service, you acknowledge this policy.

We process the following categories of information:

• Account data: name, email address, authentication identifiers, organization membership, and role assignments (via Supabase Auth).
• Factory and operations data you enter or upload: assets, orders, bills of materials, inventory, simulation inputs and results, workforce records, quality records, agent proposals, change requests, and audit logs.
• Usage and technical data: pages visited, feature usage, error reports, IP address, browser type, and performance metrics to operate and improve the service.
• Billing data: subscription plan, Stripe customer and subscription identifiers, and payment metadata. We do not store full credit card numbers.
• Communications: support messages and optional agent briefing emails sent to addresses you configure.

We use your data to:

• Provide, authenticate, and secure the platform (multi-tenant access control, backups, incident response).
• Run production simulation, analytics, dashboards, and AI features grounded in your factory context.
• Operate autonomous AI agents that propose changes; proposals remain pending until a human approves them.
• Process subscriptions and send transactional email (invites, briefings, service notices).
• Improve reliability and product quality using aggregated, de-identified usage analytics where feasible.
• Comply with legal obligations and enforce our Terms of Service.

Where GDPR applies, we rely on: (a) contract — processing necessary to deliver the service you signed up for; (b) legitimate interests — security, fraud prevention, and product improvement, balanced against your rights; (c) consent — where required for optional marketing or non-essential cookies; (d) legal obligation — where law requires retention or disclosure.

You may withdraw consent for optional processing without affecting the lawfulness of prior processing.

Optonum includes an AI assistant and optional autonomous agents (Bottleneck Oracle, Procurement, Planning, and Quality on eligible plans). When you use these features, relevant factory context — such as asset counts, bottleneck metrics, inventory levels, and order summaries — is sent to configured LLM providers to generate replies or structured proposals.

AI outputs are decision-support only. Agents Propose Change Requests or Guide next steps; they cannot modify your production data without an explicit human approval (or Guide acknowledge) through our Change Request workflow. You should review all proposals before applying them.

We do not use your factory data to train public foundation models. We reach our AI providers (Google Gemini, OpenAI) through their paid API services; under those services' terms the providers do not use the content we send to train their models or improve their products, and keep logs only for a limited period to detect abuse (up to 30 days for OpenAI).

Primary AI subprocessor: Google Gemini API (agents, structured inference and assistant chat). When configured, OpenAI is the fallback provider for assistant chat and the agents if Gemini is unavailable. See Subprocessors below.

If you accept analytics — when you create your account or later inside the application — the production application uses PostHog to record sessions so that we can reproduce and fix errors. A recording captures the page layout, mouse movements, clicks, scrolling and the pages visited. Without your acceptance PostHog is not loaded and nothing is recorded. Our public website (home, pricing, legal pages, sign-in and sign-up) runs no analytics or session recording for anyone.

All on-screen text and everything typed into form fields is masked in the browser before the recording is sent, so a recording shows where you clicked and what went wrong, not your factory data, names or figures.

Information on how long recordings are kept is available on request at hello@optonum.com. You can withdraw your acceptance at any time under Settings → General in the application; this stops recording at once and removes PostHog's data from your browser.

Only inside the application, and only after you accept analytics: PostHog usage analytics and masked session recording, capability-usage counts, and Sentry page-speed measurements.

You can change your choice at any time under Settings → General in the application. Your choice is saved with your account, so it applies on every device you sign in from.

When the application fails, Sentry sends us the error and the page it happened on so we can fix it. Passwords, tokens and cookies are removed first; nothing is stored on your device and nothing is recorded.

We store the following on your device without asking, because the service cannot work without them:

• Cookie (sb-…-auth-token): Keeps you signed in (Supabase session cookie). Removed when you sign out.
• Cookie (NEXT_LOCALE): Remembers the interface language you chose. Kept for 1 year.
• Browser storage (theme-preference-v1): Remembers the light, dark or system theme you chose.
• Browser storage: Screen state you created on this device — last project, collapsed sections, unsent drafts. Never sent to us.
• Tab storage (optonum:signup-consent): Holds the boxes you ticked on the signup form while you sign up with Google, so you are not asked twice. Deleted when you arrive, and with the browser tab.

We use the following categories of service providers to operate the platform. They process data only on our instructions and under contractual safeguards:

Your data may be processed in the United States, the European Union, and other regions where our subprocessors operate. Where required, we rely on Standard Contractual Clauses, the EU-US Data Privacy Framework (where applicable), or equivalent transfer mechanisms.

We retain account and factory data while your subscription or free account is active. After termination, we delete or anonymize data within a reasonable period unless longer retention is required for legal, tax, audit, or dispute-resolution purposes.

Audit logs and agent run records may be retained longer where needed for compliance features (e.g. compliance checklists and audit-trail export on Enterprise plans).

AI usage counters reset daily; underlying audit entries follow the general retention schedule.

Depending on your jurisdiction, you may have the right to:

• Access, correct, or delete personal data we hold about you.
• Export your data in a portable format where technically feasible.
• Object to or restrict certain processing, and withdraw consent where processing is consent-based.
• Lodge a complaint with your local supervisory authority.

If you are located in Turkey or your factory operations are subject to Turkish law, the following KVKK disclosures apply in addition to this policy.

Data controller: Optonum LLC, 1021 E Lincolnway, Ste. 10591, Cheyenne, WY 82001, United States. Contact: hello@optonum.com.

Your personal data is processed on the legal bases of performance of the service contract, legitimate interest, explicit consent (where required), and legal obligation.

Under Article 11 of the KVKK you have the right to learn whether your personal data is processed, to request information about it, to learn whether it is used in accordance with its purpose, to know the third parties to whom it is transferred in Turkey or abroad, to request its correction if it is processed incompletely or inaccurately, to request its erasure or destruction, to object to a result to your detriment arising from analysis carried out solely through automated systems, and to demand compensation for damage arising from unlawful processing.

You may submit your requests to hello@optonum.com. Requests are concluded within 30 days at the latest.

Transfers abroad: subprocessors such as Supabase, Vercel, Google Cloud/Gemini, OpenAI, Stripe, Resend, PostHog and Sentry may process data in US/EU regions; transfers are carried out under contractual safeguards and in accordance with applicable legislation.

The service is intended for business users aged 18 and over. We do not knowingly collect personal data from children.

We may update this policy with reasonable notice for material changes. The "Last updated" date at the top reflects the latest revision.

Privacy inquiries and data subject requests: hello@optonum.com. Product support: support@optonum.com. Postal: Optonum LLC, 1021 E Lincolnway, Ste. 10591, Cheyenne, WY 82001, United States.