Workplace records and access
Operations OS processes workplace records on the company’s documented instructions for its chosen service features. Access depends on current identity, workplace membership and permissions. Registering a worker account does not grant company administration access. Communications use secure transport and service credentials are protected. These measures do not constitute a security certification.
Providers and processing locations
Google Cloud and Firebase provide the workplace database, service execution and authentication. The primary workplace database and services run in London (europe-west2). Identity, security, support and delivery processing may take place elsewhere under the applicable Google Cloud Data Processing Addendum or Firebase service-specific processing terms, including their contractual transfer safeguards. The service does not promise that all processing stays in the UK.
Resend provides transactional email, including sign-in and workplace invitations. It receives recipient addresses and the content required to deliver those messages. Its standard data-processing agreement applies. Resend stores data in the United States and documents international-transfer safeguards, including standard contractual clauses and the UK Addendum. Email sending regions do not change that storage location.
Cloudflare delivers the public website and its aggregate analytics under its standard terms and data-processing agreement. It does not host the Operations OS workplace database. Apple and Google provide app distribution, supported sign-in, installation verification and notification delivery. Stripe provides company subscription billing. Address and map providers receive the information required for requested lookup and map features. These integrations have service-specific roles and privacy terms; they are not all processors of company workplace records. Independent account, Network, billing and security purposes are covered by our privacy notice.
Retention and provider copies
Eligible company work history is retained for 24 calendar months. A private notice and export opportunity are provided at least 30 days before eligible records are removed. Disputed records, legal holds and linked or incomplete records that require review are excluded from automatic removal.
Work-database backups are retained for seven days. Routine Google service logs have a 30-day retention period; mandatory audit logs have a separate 400-day period. Deleted scopes are recorded for recovery so restoration can reapply deletion instructions. These periods do not apply to every integration or data category.
Firebase Authentication may take up to 180 days to remove deleted identity data from its live and backup systems. Resend’s current plan retains emails and logs for 30 days and backups for seven days; its account-termination process removes remaining customer data within 90 days. Provider retention can differ from removal of workplace records in Operations OS.
Returning or deleting a company’s records
Contact admin@operationsos.co.uk from an authorised company account to request return or deletion. Cancelling a subscription is separate from this request. We verify the instruction, agree the scope and completion timetable, and identify any records that must be retained by law. Where return is requested, we prepare usable exports and verify access before completing closure.
Closure is a controlled support process. It excludes other companies’ records and workers’ independent accounts, checks attached files and provider references, and records the scope for recovery. Justified retained records have restricted use and a review date. Backup copies remain beyond ordinary use through their lifecycle; restoration must reapply deletion instructions. We provide a completion response explaining any retained categories and provider exceptions.
Provider information and changes
We notify affected customers before adding or replacing a workplace subprocessor and provide the opportunity to object described in the addendum. Contact admin@operationsos.co.uk for processing information, privacy requests or security matters.
Google Cloud processing terms · Firebase privacy and retention · Resend processing agreement · Resend security and retention · Cloudflare processing agreement
Company data-processing addendum · Privacy notice · Company service terms