Privacy Statement.

This Privacy Statement explains how OBMX ("we", "us", "our") handles personal information when you visit obmx.app, use the OBMX desktop or mobile apps, or use any service we provide (the "Service").

If your organization uses OBMX, your organization is the controller of the data it puts into OBMX. We process that data on its behalf as a processor. For data we collect directly from you (for example, when you sign up for a personal account or contact us), we act as the controller.

Account information: name, email address, password hash, profile picture, role, and identity provider details when you sign in with Google or Microsoft.

Workspace and customer content: projects, tasks, comments, files, time entries, attendance records, leave requests, candidate records, and other data you or your organization create in the Service.

Usage and device data: pages viewed, features used, IP address, browser and operating system, app version, language, and approximate location derived from IP. This is used for security, troubleshooting, and product improvement.

Cookies and similar technologies: we use a small number of first-party cookies and local storage entries to keep you signed in, remember preferences, and measure aggregate usage. We do not use advertising cookies.

Communications: when you contact support or sales, we keep a record of the message and any attachments so we can respond and follow up.

To provide the Service: authenticate you, deliver features, sync data across devices, send transactional notifications, and operate integrations you enable.

To improve the Service: diagnose problems, measure feature adoption, prevent abuse, and develop new functionality. We aggregate or pseudonymize data wherever practical.

To keep the Service secure: detect fraud, abuse, and unauthorized access; investigate incidents; and enforce our Terms.

To communicate with you: respond to support requests, send important account notices, and (with your consent where required) share product updates.

To comply with law: meet legal obligations, respond to lawful requests, and protect rights, property, or safety.

Where the GDPR or UK GDPR applies, we rely on the following legal bases: performance of a contract with you, our legitimate interests in operating and securing the Service, your consent for optional features such as marketing emails, and compliance with legal obligations. Where we rely on consent, you can withdraw it at any time.

With service providers (sub-processors): we use vetted vendors for hosting, email delivery, error monitoring, analytics, and payment processing. They access personal data only as needed to provide their service to us and are bound by written contracts.

With your organization: if you use OBMX through an organization, your organization administrators can see workspace activity, billing details, and content you contribute, consistent with their permissions.

With identity providers and integrations you enable: when you connect Google, Microsoft, Autodesk ACC, biometric devices, or other systems, we exchange the data needed for that integration to function.

For legal reasons: we may disclose information when we believe in good faith that disclosure is required to comply with law, protect rights or safety, or enforce our Terms.

In a business transfer: if OBMX is involved in a merger, acquisition, or asset sale, your information may be transferred, subject to confidentiality and the protections in this Statement.

We do not sell personal information.

We keep personal data for as long as your account is active and as needed to provide the Service. When you or your organization deletes content, we remove it from production systems within a reasonable period and from backups in line with our backup rotation. Some records are kept longer when required for legal, accounting, or security purposes.

OBMX is operated from servers we manage and from regional cloud providers. Personal data may be processed in countries other than where you live. Where required, we use appropriate safeguards such as Standard Contractual Clauses for transfers out of the EEA or the UK.

We use industry-standard safeguards including encryption in transit (TLS), encryption at rest for sensitive fields, access controls, audit logging, and regular dependency and vulnerability scanning. No method of transmission or storage is perfectly secure; if you discover a vulnerability, please report it to security@obmx.app.

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our processing of your personal data, and to data portability. EEA, UK, and similar users also have the right to lodge a complaint with a supervisory authority.

You can exercise most rights from your account settings. For requests we cannot fulfill in the product, contact privacy@obmx.app. If you contact us through your organization's workspace, we may forward the request to your organization administrator.

OBMX is not directed to children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal information, contact privacy@obmx.app and we will delete it.

When you sign in with Google or Microsoft, we receive a verified identifier, your email address, name, and profile picture from the provider. We use that information solely to create or look up your OBMX account. We do not request access to your mailbox, calendar, contacts, files, or other resources outside what is needed for sign-in, unless you explicitly enable an integration that requires it.

We may update this Statement to reflect changes to the Service, our practices, or the law. When we make material changes, we will notify you by email or through the Service before they take effect. The "Effective" date at the top of this page indicates when the current version came into force.

Questions about this Statement, or to exercise any of your rights, can be sent to privacy@obmx.app. For security reports, use security@obmx.app.