Privacy Policy
Last updated: 28 September 2026
This Privacy Policy explains how companyop.com ("companyop.com", "we", "us", or "our") collects, uses, shares, and protects personal information when you visit our website, create or use a company workspace, or otherwise use our cloud business software (the "Service").
companyop.com provides the Service. This policy should be read together with our Terms and Conditions, which are published at /terms. The current Privacy Policy is published at /privacy.
1. Who this policy applies to
This policy applies to:
• visitors to the companyop.com website and related public pages;
• people who create an account, join a company workspace, or sign in to the Service;
• people whose personal information is entered into the Service by a company that uses companyop.com (for example customers, employees, borrowers, suppliers, or contacts);
• people who contact us about support, billing, or marketing.
If you use the Service on behalf of a company, that company is responsible for making sure its users, and the people whose data it stores, understand this policy and the company's own privacy practices.
2. The two roles we play
Company account and platform data. For information about a companyop.com account, a company workspace subscription, billing, support, and how the Service itself is used, companyop.com decides why and how that information is processed. In privacy terms, we are the controller of that information.
Information your company stores in its apps. Business records your company enters (such as customer, employee, payroll, borrower, inventory, or accounting records) belong to your company. Your company decides why that information is collected and what it is used for. companyop.com hosts and processes that information on your company's instructions so the licensed apps can work. In privacy terms, we are a processor (or service provider) for that information, and your company is the controller.
If you are a customer, employee, borrower, or other contact of a company that uses companyop.com, contact that company first about access, correction, or deletion of records they hold about you. We will help that company where we are required to do so.
3. Information we collect
We collect what we need to run the Service, bill for it, keep it secure, and provide the apps your company licences.
Account and identity
• name, email address, and phone number where you provide one;
• login credentials (passwords are stored in a protected form, not as plain text);
• the role and permissions you have inside each company workspace you belong to;
• records of invitations you send or accept.
Company workspace
• company name, legal name, address, country, timezone, and currency;
• the workspace address (such as a subdomain or custom domain);
• the tax and billing profile your company provides;
• which apps and packages are licensed, and the status of those licences.
Billing and payments
• invoices, amounts, tax, and payment history;
• payment references and status returned by our payment processors;
• limited billing details needed to reconcile a payment (for example a payer name, or a bank-transfer proof your company uploads).
We do not ask you to store a full payment-card number in companyop.com. Card and mobile-money details are collected by the payment processor you use, under that processor's own terms and privacy notice.
Information your company puts into the apps
Depending on the apps your company licences, a workspace may contain personal information such as:
• customer and supplier contacts;
• employee and payroll records, including identifiers, bank or payment details, and pay history;
• borrower, guarantor, and loan records, including identity documents your company uploads;
• deduction instructions and files exchanged with employers or schemes;
• message recipients, message content, and delivery status for bulk messaging;
• files, contracts, and other documents stored in the workspace;
• screening queries and results where a compliance or watchlist app is used.
We process that information so the app your company asked for can function. Your company must have a lawful basis to collect it, and must not upload information it is not allowed to process.
Technical and security information
• IP address, browser type, device type, and approximate location derived from the IP address;
• sign-in times, session identifiers, and security events;
• audit logs of important actions in a workspace (who did what, and when);
• diagnostic logs needed to fix errors and keep the Service available.
Cookies and similar technologies are described in section 6.
Support and communications
• messages you send to support, including attachments;
• email preferences, and a record that you unsubscribed from marketing.
4. How we use information
We use personal information to:
• create and secure accounts and company workspaces;
• provide the apps your company licences, including storing, displaying, calculating, and exporting the records those apps need;
• take payment, issue invoices, apply tax, and manage unpaid accounts;
• send service messages (for example invoices, security notices, password resets, and licence or trial notices);
• send product or marketing email where the law allows it, and honour unsubscribe requests;
• detect abuse, fraud, and security incidents, and enforce our Terms and Conditions;
• provide support, including accessing a workspace when needed to fix a problem you asked us to fix;
• keep operational and audit logs;
• understand aggregate use of the Service so we can maintain and improve it (we prefer aggregated or de-identified figures for this);
• meet legal, tax, and accounting duties that apply to us.
We do not sell personal information. We do not use your company's workspace records to advertise third-party products to that company's customers or employees.
5. Legal bases
Where a data-protection law applies (including the Cyber and Data Protection Act of Zimbabwe, and other laws that apply because of where you or your company are located), we rely on one or more of the following:
• contract: processing needed to provide the Service you or your company asked for;
• legal obligation: processing needed to keep invoices and tax records, or to respond to a lawful request;
• legitimate interests: securing the Service, preventing abuse, keeping audit logs, and understanding how the Service is used, where those interests are not overridden by your rights;
• consent: where we ask for it, for example certain marketing messages. You can withdraw consent at any time. Withdrawal does not affect processing that already had another lawful basis.
Your company is responsible for the legal basis that applies to personal information it enters into the apps.
6. Cookies and similar technologies
companyop.com uses cookies and similar storage that are needed to run the website and the signed-in Service:
• session cookies that keep you signed in and protect forms against cross-site request forgery;
• a remember-me cookie if you choose to stay signed in;
• security and load-balancing cookies used by our hosting;
• preference cookies that remember choices such as interface settings, where the product offers them.
These cookies are used to provide the Service you requested. We do not use them to sell your browsing history. If we later add optional analytics or marketing cookies, we will describe them in this policy and, where the law requires it, ask before they are set.
You can control cookies in your browser. Blocking essential cookies will stop sign-in and other core features from working.
7. Who we share information with
We share personal information only as needed for the purposes in this policy:
• payment processors, when your company pays an invoice by card, mobile money, or another method we offer;
• email delivery providers, so we can send service and marketing email;
• infrastructure and storage providers that host the Service or store files. By default, files are held under our storage arrangement. Your company may instead connect its own storage, in which case that provider receives the files your company stores;
• professional advisers (such as accountants or lawyers) where needed, and under a duty of confidentiality;
• authorities, courts, or regulators when the law requires disclosure, or when disclosure is needed to protect the rights, safety, and security of companyop.com, our customers, or others;
• a buyer or successor if we sell or reorganise the business that operates companyop.com. In that case this policy would still apply, or you would be told about a new policy.
People inside your company workspace see the records their role allows. Actions they take are the company's actions. We do not give one company's workspace records to another company.
If your company turns on an integration (for example a fiscal or tax-authority connection, an accounting import, or a watchlist screening provider), the information needed for that integration is sent to the provider your company chose. That provider's own terms and privacy notice apply to its service.
8. International transfers
companyop.com serves companies in more than one country. Our primary operations are in Zimbabwe. Hosting, email, storage, and payment providers may process information in Zimbabwe or in other countries where those providers operate.
Where the law requires a safeguard for a transfer, we use an appropriate safeguard (such as a contract clause, or a transfer to a provider that offers an adequate level of protection). Your company remains responsible for transfers it chooses, including when it connects its own storage or a local authority integration.
9. How long we keep information
We keep personal information for as long as we need it for the purposes above:
• account and workspace records are kept while the workspace is active, and for a limited period afterwards so we can resolve billing, disputes, and security issues;
• invoices and payment records are kept for as long as tax and accounting law requires;
• audit and security logs are kept for the retention period configured for the platform, then removed or reduced;
• support correspondence is kept long enough to finish the request and to learn from recurring faults;
• marketing suppression records (such as an unsubscribe) are kept so we do not email you again by mistake;
• sandbox or trial data may be wiped on a schedule. Do not treat a sandbox as a long-term archive.
When a company asks to close its workspace, companyop.com does not promise instant self-service deletion of every copy. Contact us and we will handle retention and deletion in line with this policy, our Terms and Conditions, and the law. Backups are overwritten on a rolling cycle.
10. Security
Each company's data is kept separate from other companies' data, and access inside a workspace is limited by role. We use access controls, protected passwords, encryption in transit (HTTPS), and encryption for secrets stored by the platform. Support access to a workspace is for operation, support, and enforcement of our terms, and important administrative actions can be logged.
No online service can guarantee perfect security. Your company must keep login details safe, choose strong passwords, remove members who leave, and protect storage credentials if it connects its own storage.
11. Your rights
Depending on the law that applies to you, you may have the right to:
• ask whether we hold personal information about you, and to receive a copy;
• ask us to correct information that is inaccurate;
• ask us to delete information, or to restrict or object to certain processing;
• withdraw consent where processing is based on consent;
• ask for information you provided to be given to you in a portable form, where that right applies;
• lodge a complaint with a data-protection authority. In Zimbabwe, that is the authority designated under the Cyber and Data Protection Act.
To use these rights for account, billing, or marketing information that companyop.com controls, contact us using the details in section 16. We may need to confirm that you are the person the information is about. We will respond within the time the applicable law allows.
To use these rights for records a company stores in its workspace (customers, employees, borrowers, and similar), contact that company. If you contact us instead, we will refer the request to the company where we can identify it, unless the law requires us to act ourselves.
12. Marketing
We may email company owners and members about the Service, new apps, or related business content. Every marketing email includes a way to unsubscribe. You can also ask us to stop by emailing the support address shown on the Service (hello@companyop.com).
Service messages that are part of your account (such as invoices, security alerts, and password resets) are not marketing. Those messages may continue while the account is open.
13. Children
companyop.com is business software. It is not directed at children, and we do not knowingly create accounts for children. A company that stores information about a child (for example in a payroll record) is responsible for having the lawful authority to do so.
14. Sandbox and trial workspaces
A sandbox or trial workspace is for evaluation. Data in it may be deleted on a schedule. Do not put live production records, or personal information you are not prepared to lose, into a sandbox.
15. Changes to this policy
We may update this Privacy Policy from time to time. The current version is published at /privacy and can be updated by platform administrators in site settings. When we make a material change, the "Last updated" date at the top of this policy will change and, where the law requires it, we will give further notice. If you continue to use the Service after the updated policy is published, the new policy applies from that date, except where the law requires a different step.
16. Contact
Questions about this Privacy Policy, or requests about personal information that companyop.com controls, can be sent to companyop.com via companyop.com or the support email shown on the Service (hello@companyop.com).
If you write about records held inside a company workspace, include the company name so we can direct the request to the right place.