Privacy Policy

1. Scope

This policy covers opselith.com, its browser tools, support contacts and, where enabled, Opselith Pro purchases. Privacy questions: support@opselith.com.

2. Core browser tools

The core toolkit is designed for local browser processing. Files and text used in the CSV, list-comparison, conversion, migration-mapping, password, naming and JWT tools are processed in the browser rather than uploaded to an Opselith processing service as part of normal operation.

Free scripts are generated in your browser; Pro scripts are generated securely after server-side Pro license validation. Opselith does not connect to your Microsoft tenant on your behalf.

3. Anonymous usage statistics

Opselith records aggregate usage counters containing a date, tool, action and count. It can also count which published PowerShell scripts are opened and whether that happened from a script page or the Builder. These counters do not include Builder input values, generated scripts, tenant data or user identifiers.

Search intelligence is privacy-filtered in the browser before it is sent. Only allowlisted generic IT/admin terms are eligible to leave the browser; unknown words are removed. If no safe term remains, Opselith records only that a search was privacy-withheld. Raw search text is not sent to Opselith or stored in the analytics database.

The requesting IP may be used transiently for rate limiting, but is not written to the usage or search-intelligence database or included in aggregate statistics. Ratings are aggregate counters and are not stored together with your name, email, file name, input or generated content.

4. Tester program

Invited testers can submit structured test results and product feedback through the Tester Hub. A tester key is verified to authorize the submission, but the raw key and requesting IP address are not stored with the report. Reports may contain the tester slot, selected Opselith area or script, workload, test outcome, software/module versions and the text the tester chooses to submit.

Tester reports must not contain tenant names, usernames, email addresses, credentials, tokens, secrets, customer data, production exports or generated scripts. Reports are kept for product validation, troubleshooting and quality improvement.

5. Pro purchases

For purchases processed through the Pro checkout flow, the purchase email and Paddle transaction identifiers are processed to issue and validate time-limited Pro keys, resend a still-valid key and support the purchase.

Opselith Access Keys use an opaque key identifier with server-side entitlement records. The raw Access Key is not stored in the Opselith database, and newly issued Access Keys do not embed the Paddle customer identifier. A purchased Pack can therefore remain linked to the same Access Key without putting the customer reference inside the key itself.

Paddle is the Merchant of Record and payment provider for Paddle Checkout and processes payment, billing, tax and transaction information under its own policies.

For discretionary refund reviews, Opselith stores the Paddle transaction identifier, a SHA-256 hash of the purchase email, the Pro plan, a structured reason category, request status and any Paddle adjustment identifier. The launch form does not store the raw purchase email or free-text reason details in the refund-review table. The purchase email is used transiently to verify the transaction and send the request receipt.

6. License emails

Transactional Pro license emails are sent using Resend. The email address and license information needed to send the message are processed for this purpose. The license flow is not a marketing newsletter.

7. Cookies and browser storage

Opselith does not use advertising or tracking cookies for the core website. The core tools do not need a cookie banner to work.

Some features save information in this browser so they can remember your choices. This includes Favorites, recent work, saved non-sensitive Builder settings, workflow progress, Migration Workspace projects, rating state, and an activated Pro or tester key. This uses browser local storage.

A short-lived secure session cookie may be used for restricted test or lab pages. It is only used to keep that private session working. It is not used for advertising or cross-site tracking.

These values stay in browser storage unless you remove them through an Opselith control, clear the site's browser data, or choose to export supported local workspace data. The Manage local data page can create a JSON file containing supported Favorites, recent work, Builder saves, workflow progress and Migration Workspace projects. Creating, previewing and restoring that file is handled in the browser; Opselith does not upload the file as part of that process.

The local workspace export does not include a saved Pro or tester key or generated PowerShell scripts, and restoring or clearing supported workspace data does not overwrite or remove that key. Saved Builder values or Migration Workspace project details can contain environment-specific names or domains, so review an exported file before sharing it.

Migration Workspace projects can store project names, organization names, source and target domains, selected workloads, mapping-readiness summaries, Exchange-readiness summaries, migration-wave summaries and manual readiness confirmations locally. Wave planning CSV rows are analyzed in the active browser session; only wave names, dates, workload selections and counts are saved to the project. Raw mapping, Exchange recipient or migration-wave user rows are not copied into the project. Separate Migration Workspace project exports are also created locally and are only shared if you choose to move or send the downloaded file.

Locking Pro access removes the saved Pro or tester key. My Toolkit export is a separate export and intentionally excludes Pro keys, recent history, generated scripts and legacy configurations that do not carry field-level sensitivity metadata.

8. Security and providers

Opselith uses infrastructure providers to host the service, deliver transactional email and process Pro payments. Security controls include HTTPS, security headers, rate limiting and signed webhook verification. No internet service can guarantee absolute security.

9. Retention

Information is kept only as reasonably necessary to operate the service, prevent abuse, maintain transaction and license functionality, meet legal obligations and resolve disputes.

Temporary commerce records are kept only for the operational period needed to process and support the transaction. Raw webhook payloads are cleared after processing or a recorded processing failure rather than being retained as long-term event history. Expired checkout and withdrawal records are periodically cleaned, and an email retained with a confirmed withdrawal request is scrubbed after the support and refund-handling window.

Resolved discretionary refund-review records are deleted after 180 days. Open review records are kept only while reasonably necessary to handle the request, prevent abuse, meet legal obligations or resolve disputes. Structured reason categories are used instead of free-text intake to reduce unnecessary personal data.

10. Your rights

Depending on where you live, you may have rights concerning personal data, including access, correction, deletion, restriction or objection. Contact support@opselith.com. We may need enough information to verify a request safely.

11. Third parties and changes

Paddle and Resend have their own privacy and service policies for data they process. This policy may be updated when the service or applicable requirements change; the effective date identifies the current version.