Privacy Policy

EmpireOS ("we", "our", or "us") is operated by Ben Findlay (findbene@gmail.com). This policy explains what personal data we collect when you use EmpireOS, how we use it, who we share it with, and what rights you have over it.

By using EmpireOS you agree to the practices described here. If you do not agree, please stop using the service and contact us to delete your data.

1. Data We Collect

We collect the following categories of personal data:

Account and identity data

• Your name and email address, provided at sign-up or via OAuth.
• A profile avatar URL, if you supply one.
• Your Clerk user ID — an internal identifier used to link your account across sessions.
• Your Clerk organization ID, if you create or join an organization inside EmpireOS.

Integration credentials

• Access tokens for third-party services you connect voluntarily — currently GitHub, Vercel, Stripe, Better Stack, and Sentry. Tokens are stored encrypted and are only used to pull data on your behalf. We never use them for any other purpose.
• Token metadata: provider name, connection status, and last sync timestamp.

Project and operational data

• Project names, descriptions, statuses, URLs, and stack information you enter manually or that we pull from connected integrations.
• Idea titles, descriptions, and validation notes you record.
• Deployment records, incident reports, alert history, and revenue events synced from your integrations.
• Architecture Decision Records (ADRs) and notes you write inside the app.

Usage analytics

• Page views, feature interactions, and session data collected via PostHog (see Section 5). This data is tied to a pseudonymous PostHog ID, not directly to your name or email unless you are identified via PostHog's identify call.

Audit logs

• Records of significant actions taken inside your organization — who performed an action, on which entity, and when. These exist for security and accountability.

2. How We Use Your Data

• To create and manage your account and authenticate you.
• To provide the core EmpireOS features — project tracking, alert monitoring, deployment history, revenue analytics, etc.
• To sync data from third-party integrations you have explicitly connected.
• To send transactional emails (e.g. alert notifications) if you opt in to email notifications.
• To improve the product by analyzing aggregate usage patterns via PostHog.
• To detect abuse, investigate security incidents, and maintain audit trails.
• To fulfil legal obligations (e.g. responding to valid legal requests).

We do not sell your personal data. We do not use it for advertising.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area or the UK, we rely on the following legal bases:

• Contract performance — processing your name, email, and project data to deliver the service you signed up for.
• Legitimate interests — security logging, fraud prevention, and product analytics where our interests are not overridden by your rights.
• Consent — email marketing communications, if any, where we rely on opt-in consent.
• Legal obligation — retaining records we are required to keep by applicable law.

4. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we anonymize your personal identifiers (email, name) within 30 days and purge or anonymize associated audit log entries. Aggregate or anonymized data may be retained indefinitely for analytics purposes. Integration tokens are deleted immediately when you disconnect an integration or delete your account.

5. Third-Party Services

We share data with the following sub-processors to operate the service:

We do not share your data with any other third parties except as required by law.

6. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right of access (GDPR Art. 15) — request a copy of all personal data we hold about you.
• Right to rectification (GDPR Art. 16) — ask us to correct inaccurate data.
• Right to erasure (GDPR Art. 17) — request deletion of your personal data. You can trigger this directly from Settings > Account.
• Right to restriction (GDPR Art. 18) — ask us to pause processing while a dispute is resolved.
• Right to data portability (GDPR Art. 20) — download a machine-readable copy of your data from Settings > Account > Export.
• Right to object (GDPR Art. 21) — object to processing based on legitimate interests (e.g. analytics).
• CCPA rights — California residents have the right to know, delete, and opt out of sale of personal information. We do not sell personal information.

To exercise any of these rights, email us at findbene@gmail.com with the subject line "Privacy Request". We will respond within 30 days.

7. Security

We use industry-standard measures to protect your data: TLS in transit, encrypted storage for integration tokens, and role-based access control. No system is perfectly secure. If you discover a security vulnerability, please disclose it responsibly to findbene@gmail.com.

8. Children

EmpireOS is not directed at children under 16. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it.

9. Changes to This Policy

We may update this policy as the service evolves. When we make material changes we will update the "Last updated" date at the top of this page and, where required by law, notify you by email. Continued use after the effective date constitutes acceptance.

10. Contact

For any privacy questions or requests, contact: findbene@gmail.com