OpalSpan: supplementary privacy and processing notice
Version: privacy-en-2026-10-15-v9. Language: English.
Prepared successor; not selected as a contractual package. Ready IT ApS, CVR 38769383, Denmark; contact@readyit.dk; telephone +45 22 76 54 06.
This supplement clarifies the existing notice's recipients, technical-work routes and actual storage controls. It does not change accepted terms, lawful instructions, data categories, retention periods, telemetry tiers, cookies or statutory rights. The applicable underlying notice remains identified by the customer's recorded agreement and feature instructions.
Roles and purposes
Ready IT's own account, billing, service-security and necessary support/incident purposes retain the legal bases described in the underlying notice. Customer technical-work processing follows the customer's DPA/instructions; an MSP's upstream-controller chain must be established. Purchasing as a business, remaining on Free or omitting business details does not decide the legal role.
Necessary support reports can contain reporter/account identifiers, technical context, descriptions and selected screenshots/files. Ready IT processes necessary information to provide support, investigate faults/security and maintain the service; the applicable contract or legitimate-interest basis and customer-controlled data obligations depend on the actual purpose. Do not supply unrelated customer material or credentials.
Recipients, context and international processing
AWS supplies Stockholm hosting and private artifact storage, operational CloudWatch logging and the international CloudFront edge. PostgreSQL and Typesense are hosted components in this boundary, not separate SaaS recipients. AWS's ordinary Danish-account contracting route is Amazon Web Services EMEA SARL; its DPA identifies its applicable parties and transfer arrangements.
OpenAI Ireland Ltd. supplies hosted Mech API processing, including necessary context, selected attachments and tool results, hosted search and requested selected-file analysis. Relevant context can span cases within the workspace. Separate conversations are not confidentiality boundaries. The production project uses Global geography, Standard tier and Standard Retention. Organisation feedback/evaluation/input-output sharing opt-ins are disabled, and Mech disables stored Responses output. Abuse monitoring, caching, container state and image/file safety handling still apply under the provider's published limits and exceptions. EU-only processing and zero retention are not promised.
Okta/Auth0 identity, Microsoft 365/Graph contact and contract mail, and Stripe payment processing retain their disclosed scopes. An EU identity tenant does not prove EU-only supplier support or onward access. Payment/fraud/legal controller processing is not automatically technical-work subprocessing.
Submitted bug reports are delivered to private GitHub issues. GitHub receives the description, technical context and attachment links; processing can occur outside the EEA, including the US. GitHub's applicable account agreement/role must be established rather than inferred from a private repository or its public corporate DPA. Original attachments are stored in private AWS S3 rather than committed into Git.
If you select an external assistant to operate Agent CLI, the assistant's provider can receive the prompts, outputs and files you make available. You select and contract with that provider unless a separate Ready IT engagement expressly provides otherwise. Its account type, transcripts, retention, training settings and transfer arrangements are separate from hosted Mech. Local agent execution does not establish local-only inference.
International safeguards must match the actual recipient and service. OpenAI DPA 4.1 addresses EEA onward transfers using SCC-containing agreements or applicable adequacy. AWS's terms incorporate its DPA and supplementary transfer arrangements. An in-scope adequacy decision differs from an SCC route needing an effectiveness assessment; US ownership is not itself a prohibition. Neither EU hosting nor encryption promises immunity from foreign legal demands. Disclosure requests require a case-specific lawful basis and transfer analysis. Ask contact@readyit.dk for applicable safeguard copies and recipient details.
Access lifetimes and retention distinctions
Anyone holding a bug-report attachment link can download without login. New reports' links last 90 days from publication preparation; exchanged storage URLs last at most five minutes, capped by the original expiry. Existing grants keep their own expiry. Expiry is not erasure of issue/report history or recovery copies. Confirmed expired original objects undergo bounded application cleanup after successful storage deletion; pending/uncertain originals remain for delivery reconciliation.
Application/system CloudWatch log groups currently retain 14 days. This differs from workspace audit retention, case/conversation history and provider logs. Private artifact storage uses application-managed expiry, not a blanket S3 bucket lifecycle. Seven daily automatic snapshots do not set the lifetime of separate manual/local recovery copies.
The underlying notice's periods/criteria for cases, conversations, scratch and retained files, telemetry, financial/contract evidence, mail and recovery copies remain unchanged. A return/deletion/restriction instruction covers its actual systems and relevant recovery copies, subject to explained lawful exceptions. Completed instructions must be reconciled before restored data returns to use.
Rights, requests and complaints
Contact contact@readyit.dk for applicable access, correction, erasure, restriction, portability and objection rights, or to withdraw consent where used. Customer-controlled requests are handled with the responsible controller. Ready IT verifies authority and scope and explains outstanding actions and any lawful retention exceptions. You may complain to Datatilsynet or another competent supervisory authority. Existing cookies/device-storage information and rights are unchanged.
Supplier references: AWS, OpenAI DPA, OpenAI data controls, OpenAI subprocessors, Okta, Microsoft DPA, Stripe and GitHub.