Privacy Policy
Last updated: 12 October 2026
This policy explains how Opmore AB (“Opmore”, “we”, “us”) collects, uses, and protects personal data when you use our website, platform, and associated services. It is written to comply with the EU General Data Protection Regulation (GDPR) and Swedish data protection law.
If you have any questions, email mo@opmore.ai.
1. Who we are
Opmore AB, a Swedish limited company. The data controller for all processing described below is Opmore AB. Contact: mo@opmore.ai.
2. What data we collect
Data you give us directly
- Account data: your email address, password (stored as a bcrypt hash, never in plaintext), and the list of client playbooks you have access to.
- Questionnaire and workshop submissions: the answers you provide when filling out an OPTICS diagnostic, a discovery questionnaire, or a workshop registration. This typically includes your name, email, company, website, LinkedIn URL, and free-text answers about your sales process.
- The contact form (formerly the waitlist): when you send it, we save your name, work email, company, your role, what you want to test Sticky for (the options you pick and anything you write) and where you came from (see below). Your IP address and browser (user agent) are saved with them, to spot abuse. We also add you to our CRM, the list of contacts we keep inside Opmore, in the same database as the rest of the site, with a note of your answers. We use all of this to get back to you about Opmore, as you asked (people who joined the earlier waitlist, about early access and the launch). Through Resend we send you one email to confirm we got your answers, and we email ourselves a copy of your answers. If the address is a work address, we also send you occasional updates, offers and news about Opmore, about one or two emails a month, under our legitimate interest in telling business contacts about our service (Art. 6(1)(f) GDPR and the Swedish Marketing Act); you can object when you send the form and unsubscribe from every email, at no cost. We do not send these updates to private addresses such as Gmail or Hotmail. To be removed, email mo@opmore.ai.
- Sticky on our website: when you ask Sticky a question on opmore.ai, your question and the conversation so far are sent through OpenRouter to an AI model that writes the answer. Without the form, we keep only a daily count of questions and what they cost; a cookie,
sticky_vid(24 hours), and a hashed, daily-changing form of your IP address limit how many questions one visitor can ask. If you leave your email and your company's website in Sticky's form, we use them to contact you about trying Opmore, which you asked for (Art. 6(1)(b) GDPR), and we keep the questions you asked Sticky with your contact details so we can follow up (our legitimate interest in answering your request, Art. 6(1)(f)). If the address is a work address, we also send you occasional updates, offers and news about Opmore, about one or two emails a month, under our legitimate interest in telling business contacts about our service (Art. 6(1)(f) GDPR and the Swedish Marketing Act); you can object when you send the form and unsubscribe from every email, at no cost. We do not send these updates to private addresses such as Gmail or Hotmail. We check that your email's domain can receive mail; we do not otherwise verify the address. A cookie,sticky_lead(30 days), lets you keep asking. We keep these details while we are in contact and for up to 12 months after, or until you unsubscribe or ask us to delete them. We never sell your data. - Playbook content: any text you write into your playbook pages, including fields you edit inline.
- Integration credentials: if you connect a tool such as Google Workspace or Attio, you authorize it through Pipedream Connect, which stores the credential (for example an OAuth token or an API key) so the agent can read and act in that tool on your behalf. Connections are used only to fulfill your requests.
- MCP connection data: if you connect an MCP client (Claude Desktop, Cursor, etc.) to your playbook, we store the access token we issue, the client name, and a log of write actions taken through that connection.
Data we collect automatically
- Session cookies: a NextAuth session cookie that keeps you signed in. See our Cookie Policy.
- Fonts: our pages load their typefaces from Google Fonts. When a page opens, your browser fetches them from Google's servers, which shows Google your IP address and browser. This happens before you answer the cookie banner, and it sets no cookie.
- Startup Fika videos: the homepage shows episodes of Startup Fika, our founder's show on YouTube. Nothing loads from YouTube until you press play on an episode. When you do, the player loads from youtube-nocookie.com, which Google runs: Google receives your IP address and browser details, and the player may store data in your browser (local storage, and on some browsers cookies). What Google does with it is covered by Google's own privacy policy. We receive nothing from the player.
- Server logs: standard web server logs (IP address, user agent, request path, timestamp) retained for up to 30 days for security and debugging.
- Analytics: if you accept analytics in the cookie banner, we use Google Analytics 4 to understand how the site is used (pages visited, rough location, device and browser). We turn on IP anonymization, so the full IP address is not stored. If you decline, no analytics cookies are set and Google Analytics does not load. See our Cookie Policy.
- Where you came from: when you send a form on the site (a demo request, the contact form or the earlier waitlist, a newsletter sign-up, the diagnostic, a questionnaire, an early-access or tester application), we save with it how you reached us: the campaign tags in the link you followed (
utm_source,utm_medium,utm_campaign,utm_content,utm_term), a Google Ads click id (gclid), a partner's referral code (ref), the personal code (t) in a link we sent you, the first page you opened on the site (the path only), and the site that sent you (its address without the query). This is saved with the form whether or not you accept cookies, because it travels with the form you send. Without Accept, nothing is stored on your device for it: it stays in the open page and is copied onto links between our own pages, so it survives a reload. With Accept, we also keep your first visit in your browser's local storage for 90 days (see the Cookie Policy). - Whether you booked a call: after you send one of those forms, we check our booking calendar (Google Calendar) for a call booked under the email address you gave, at most twice: about 15 minutes after the form and again a day later. We note the time a booking was found. The check runs through Pipedream, which holds our calendar connection.
Data we do NOT collect
- We do not use tracking pixels or advertising cookies.
- We do not send where you came from, or whether you booked, to Google Ads or any other advertising platform.
- We do not sell your data to anyone. Ever.
3. Why we process your data (legal basis)
| Purpose | Legal basis |
|---|---|
| Delivering the platform and playbook features you asked for | Contract (Art. 6(1)(b) GDPR) |
| Reading your Gmail/Calendar or CRM data to generate AI insights you requested | Contract + your explicit OAuth consent |
| Sending essential account emails (invites, password resets) | Contract |
| Keeping your contact-form answers (formerly the waitlist) and your entry in our CRM, and getting back to you about Opmore (for the earlier waitlist, about early access and the launch), as you asked when you sent the form | Steps you asked us to take before a contract (Art. 6(1)(b)) |
| Contacting you about trying Opmore after you leave your email and your company's website in Sticky's form on our website, as you asked | Steps you asked us to take before a contract (Art. 6(1)(b)) |
| Keeping the questions you asked Sticky with your contact details, so we can follow up | Legitimate interest in answering your request (Art. 6(1)(f)) |
| Sending occasional updates, offers and news about Opmore to a work address you gave in Sticky's form or the contact form (formerly the waitlist) (never to private addresses such as Gmail or Hotmail) | Legitimate interest in telling business contacts about our service (Art. 6(1)(f) GDPR and the Swedish Marketing Act). You can object when you send the form and unsubscribe from every email, at no cost |
| Site analytics with Google Analytics, and keeping your first visit in your browser for 90 days, after you accept cookies | Consent (Art. 6(1)(a)), which you can withdraw by clearing your browser storage for opmore.ai |
| Saving how you reached us with a form you send, and checking whether you booked a call, so we know which channels bring us customers | Legitimate interest (Art. 6(1)(f)) |
| Loading the typefaces of our pages from Google Fonts | Legitimate interest (Art. 6(1)(f)) |
| Playing a Startup Fika episode from YouTube | Consent (Art. 6(1)(a)), given by pressing play on a button that says the video comes from YouTube |
| Investigating fraud, abuse, and security incidents | Legitimate interest (Art. 6(1)(f)) |
| Complying with Swedish accounting and tax law | Legal obligation (Art. 6(1)(c)) |
4. Who we share data with (sub-processors)
We use a small set of third parties to operate Opmore. All of them are bound by data processing agreements or equivalent terms. We share only what each one needs to do its job.
| Sub-processor | Purpose | Location |
|---|---|---|
| Hostup AB | VPS hosting (Coolify server where the application runs) | Älvsjö, Sweden (EU) |
| Turso | Database hosting (playbook content, user accounts, MCP tokens) | AWS eu-west-1 (Ireland, EU) |
| Resend | Transactional email delivery (invites, password resets, the contact-form confirmation). It sees the recipient's address and the content of the email. | Ireland, EU (sent through Amazon SES, eu-west-1). Resend is a US company. |
| Luma Labs, Inc. | Event registration, reminders and calendar invites for live sessions | United States |
| Google OAuth sign-in; reading Gmail and Google Calendar data on your behalf when you connect those integrations; our booking calendar, where you book a call with us and where we check whether you booked | United States + global | |
| Google Fonts | Serves the typefaces our pages use. It sees your IP address and browser when a page loads. | United States + global |
| Google Analytics | Site usage analytics, loaded only after you accept analytics in the cookie banner | United States + global |
| OpenRouter | Gateway to the large language models we use (listed in section 8). Playbook content, interview answers and the most recent messages of your chat conversations are sent through OpenRouter's API to a provider that serves the chosen model, to produce the response shown to you. | United States (gateway). Model providers: mostly United States, some Chinese or Singaporean (see section 8) |
| ElevenLabs | Voice. Turns speech into text and text into speech for voice interviews, Practice calls and audio versions of playbook pages. It hears what is said in a call and reads the text it speaks. See section 8 for recording and retention. | United States (global API) |
| TypeSafe AI, Inc. | After each reply in Ask, its Jev model judges whether your question was answered. It sees the question and the reply, and can see the titles of your playbook's sections. | United States |
| Pipedream | Integration connections (Pipedream Connect). Stores the credentials for the tools you connect and carries the agent's requests to those tools, so it sees the data that passes through those requests. It also carries our check of our own booking calendar, so it sees the email address a form was sent with. | United States |
| Cloudflare | File storage (R2) for company logos and for images sent to Opmore's Telegram bot. No playbook content. | Global network, not pinned to the EU |
International data transfers
Some sub-processors (Resend, Google, Attio, OpenRouter and the model providers it routes to, ElevenLabs, TypeSafe, Pipedream, Cloudflare, Luma Labs) are located outside the EEA. Where transfers to third countries occur, we rely on the following safeguards where applicable:
- Adequacy decisions (e.g. the EU–US Data Privacy Framework) for transfers to US providers where those providers are certified.
- EU Standard Contractual Clauses (SCCs) for other US and UK transfers, including Luma Labs.
- Model providers via OpenRouter: requests to the models listed in section 8 go through OpenRouter to one of the providers serving that model. Most are in the United States; some are Chinese or Singaporean companies. Data sent to them is subject to the law where they process it, and OpenRouter applies its own SCC equivalents for downstream transfers. If this routing does not work for your use case, contact us and we can talk about which model handles your playbook.
5. How long we keep data (retention)
| Data type | Retention |
|---|---|
| Active customer account data, playbook content, connected integrations | While your account is active |
| Data after account cancellation | 90 days, then permanently deleted |
| Workshop submission forms | Until you request deletion |
| Discovery questionnaire submissions | Until you request deletion |
| Contact-form answers (formerly the waitlist), and your entry and notes in our CRM | Until you ask to be removed (email mo@opmore.ai) |
| Your email, your company's website and the questions you asked Sticky on our website, after you send its form | While we are in contact and for up to 12 months after, or until you unsubscribe or ask us to delete them |
| Event registration data (name, email, company, answers to registration questions) | 12 months after the event |
| MCP tool-call audit logs | 90 days (longer if referenced in an active security investigation) |
| Transactional email logs (Resend) | Up to 30 days (Resend's retention) |
| Voice interview audio and transcripts at ElevenLabs | 1 day, then deleted by ElevenLabs |
| Practice call recordings and transcripts at ElevenLabs | No automatic deletion (kept until deleted) |
| Where you came from and whether you booked, saved with a form you send | As long as the form it was saved with |
| Your first visit, in your browser's local storage (only after you accept cookies) | 90 days, or until you decline or clear your browser storage |
| Server access logs | Up to 30 days |
| Invoices and accounting records | 7 years (required by Swedish Bokföringslagen) |
6. Your rights under GDPR
You have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Erasure (“right to be forgotten”): request deletion of your data. We will comply unless we are legally required to retain it (e.g. invoices).
- Portability: receive your data in a machine-readable format.
- Restriction: ask us to pause processing while we resolve an issue.
- Object to processing based on legitimate interest.
- Withdraw consent at any time, where consent is the legal basis (e.g. by disconnecting a Google integration).
- Lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.
To exercise any of these rights, email mo@opmore.ai. We will respond within 30 days.
7. Security
We use standard security practices: TLS on all traffic, bcrypt for password hashing, OAuth tokens are stored server-side only, short-lived access tokens for MCP connections, rate limits on authentication endpoints, and principle-of-least-privilege access controls. Full encryption-at-rest for integration credentials is on our roadmap.
No online service is perfectly secure. If you discover a vulnerability, please report it to mo@opmore.ai.
8. AI-specific notes
When you use Ask (the chat), interviews, Practice, suggestions, or the MCP integration, parts of your playbook content, interview answers, CRM excerpts, and email excerpts may be sent to a large language model provider to generate the response you requested. We reach the models below through OpenRouter. Contents of individual tool calls are sent only when needed to answer a specific question.
Which models we use
As of the date at the top of this policy:
- DeepSeek answers questions in Ask and runs voice interviews. DeepSeek V4 Flash answers the questions you ask Sticky on our website.
- Xiaomi MiMo runs text interviews, drafts interview briefs, summarizes interviews and compiles the answers into your playbook, checks replies against your playbook, and runs a few older and supporting features.
- OpenAI GPT writes the first draft of a new playbook and suggests follow-up questions, and OpenAI Whisper turns your speech into text when you dictate with the microphone.
- Anthropic Claude runs Practice: the roleplay calls, their preparation, scoring and notes.
- Google Gemini suggests a short display name for a company's assistant bot from the company name.
For each request, OpenRouter picks one of several providers that serve that model. Most of these providers are in the United States. Some are Chinese or Singaporean companies: Xiaomi serves its own MiMo models, and Baidu, StreamLake and Alibaba are among the providers serving DeepSeek. Some providers keep the prompts they receive for a period set by their own terms, for example 30 days at Xiaomi and at Anthropic. One model is reached directly rather than through OpenRouter: TypeSafe's Jev, which checks after each reply in Ask whether the question was answered.
Training
Opmore does not train AI models on your content. We send it to the providers above only to produce the replies, interviews, drafts, and voice you ask for.
Voice
Voice runs on ElevenLabs, through its global API in the United States. It turns speech into text and text into speech for voice interviews, Practice calls, and audio versions of playbook pages. Voice is optional: experts can talk or type.
Voice interviews are not recorded. What your experts say becomes text in your playbook, and ElevenLabs deletes its copy of the call after one day.
Practice calls are different. ElevenLabs records them and keeps the recording and transcript with no automatic deletion. If our model does not answer during a Practice call, ElevenLabs can fall back to a model of its own. ElevenLabs also runs its own automatic analysis (topic and sentiment) of interview and Practice transcripts.
9. Children
Opmore is a B2B product for founders and sales teams. We do not knowingly collect data from anyone under 13 (the digital age of consent under Swedish law implementing GDPR Article 8). If we learn we have, we will delete it.
10. Cookies
Opmore uses a NextAuth session cookie (__Secure-authjs.session-token in production, authjs.session-token in local development), which keeps you signed in while you use the site. This cookie is:
- Strictly necessary for the site to function. You cannot stay logged in without it.
- First-party only: set by opmore.ai, never read by third parties.
- HttpOnly and Secure in production: not accessible to JavaScript and only transmitted over HTTPS.
- Lifetime: 30 days by default, or until you sign out.
Because the session cookie is strictly necessary, it loads without consent under the EU ePrivacy Directive.
We also use Google Analytics 4 to understand how the site is used. Google Analytics sets non-essential cookies, so it loads only after you accept analytics in the cookie banner shown on your first visit. If you accept, the GA cookies record pages visited, rough location, and device and browser details, with IP anonymization turned on. This data is processed by Google. If you decline, no analytics cookies are set and Google Analytics does not load. Your choice is stored in your browser, and you can change it by clearing your browser storage for opmore.ai.
Accept covers one more thing, which is browser storage rather than a cookie but is treated the same way: we keep your first visit in your browser's local storage under opmore-attribution. It holds how you first reached the site (the campaign tags, Google Ads click id, referral code and personal link code described in section 2, the first page you opened and the site that sent you), so a visit next week still counts as coming from the same link. It lasts 90 days, is never written without Accept, and is removed if you decline. Your cookie choice itself is kept in local storage under opmore-cookie-consent, which is strictly necessary to remember it.
One more thing can store data in your browser, and only after you ask for it: the YouTube player for a Startup Fika episode on the homepage. It loads from youtube-nocookie.com, which Google runs, only when you press play on an episode, and the button says the video comes from YouTube. From then on Google receives your IP address and browser details, and the player may keep data in your browser's local storage and, on some browsers, set cookies, under Google's own privacy policy (see section 2). Nothing loads from YouTube before you press play.
Sticky on our website sets two first-party cookies, only when you use it: sticky_vid (24 hours), which limits how many questions one visitor can ask, and sticky_lead (30 days), which lets you keep asking after you send Sticky's form (see section 2).
Apart from Google Analytics, the opmore-attribution item and a YouTube player you start, we do not use advertising cookies or any other non-essential cookies or browser storage.
If you clear your browser cookies, you will be signed out and will need to log in again.
11. Changes to this policy
When we make material changes, we will update the “Last updated” date at the top and, if the change is significant, notify account holders by email.