Privacy by
Architecture.

This privacy policy is issued by Servance Pty Ltd, an Australian company trading as OPPI. We build operational intelligence software for the hospitality industry.

When you use our website (oppi.au), sign up for our services, or interact with our platform, we act as the data controller. This means we decide how and why your personal information is processed.

When our customers use OPPI to process their own venue data (including information about their staff, guests, or operations), we act as a data processor on their behalf. In those cases, your venue is the data controller and their privacy policy applies.

We collect personal information through three channels:

• Directly from you: when you create an account, fill out a form, join our waitlist, or contact our team.
• From your venue systems: when you connect integrations such as your POS, property management system, or rostering tool. We only access data you explicitly authorise.
• Automatically: through server logs, cookies, and similar technologies when you visit our website. See Section 11 for details on cookies.

We do not purchase personal information from third-party data brokers. We do not scrape publicly available information to build profiles.

We use your personal information for the following purposes:

• To provide and operate the OPPI platform, including generating insights, projections, and operational recommendations for your venue.
• To process payments and manage your subscription.
• To communicate with you about your account, service updates, and support requests.
• To maintain the security and integrity of our systems, including fraud detection and abuse prevention.
• To improve our products by analysing aggregated, anonymised usage patterns.
• To comply with legal obligations, including Australian tax and corporate law.

We will not use your personal information for purposes materially different from those described above without notifying you first.

OPPI uses artificial intelligence and automated systems to analyse venue operational data and generate actionable insights. This is a core part of our service. Here is how we handle it:

We do not sell, rent, or trade your personal information. We share data only with the following categories of service providers, and only to the extent necessary to operate our platform:

All third-party processors are bound by data processing agreements that require them to protect your information to the same standard we apply internally.

Transparency about where your data is stored matters. Here is the current state of our infrastructure:

• Our primary database and authentication infrastructure is hosted in Singapore (AWS ap-southeast-1) via our database provider.
• Application hosting and edge delivery may utilise servers in multiple regions, including Australia and the United States, depending on the provider.
• AI processing requests may be routed to API providers with infrastructure in the United States and Europe.

We implement technical and organisational measures appropriate to the sensitivity of the information we hold:

• Encryption in transit using TLS 1.3 and at rest using AES-256.
• Logically isolated infrastructure. Venue data is partitioned so one customer cannot access another's information.
• Role-based access control (RBAC) with the principle of least privilege.
• OAuth-based integrations. We never store your third-party system passwords.
• Regular access reviews and security monitoring.

No system is perfectly secure. If we become aware of a data breach that is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals in accordance with the Notifiable Data Breaches (NDB) scheme.

For more detail on our security architecture, see our Security page.

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

When data is no longer required, it is securely deleted or anonymised so that it can no longer be linked to an individual.

Under the Australian Privacy Principles and applicable international frameworks, you have the following rights:

To exercise any of these rights, contact us at privacy@oppi.au. We will respond within 30 days. If we refuse a request, we will provide written reasons and information about how to complain.

If you are unsatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner.

Our website uses minimal cookies and local storage, limited to what is necessary for the site to function:

• Authentication tokens, stored in local storage to keep you signed in to the OPPI platform.
• UI preference cookies, such as sidebar state, to remember your interface settings between visits.

We do not currently use third-party advertising cookies, tracking pixels, or behavioural analytics tools on our marketing website. If this changes, we will update this policy and provide appropriate notice and controls.

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "last updated" date at the top of this page.
• Notify active customers via email for significant changes.
• Provide a reasonable period before changes take effect.