Privacy policy
Last updated 28 September 2026
How OPRIQ uses personal information: what we collect, why, who else sees it, how long we keep it, and your rights. It's written to be read, not skimmed past.
1. Who we are
OPRIQ is made and run by Invictus Fire & Security Ltd (“we” and “us”), a company registered in England and Wales, number 17078113, with its registered office at International House, 6 South Molton Street, London, W1K 5QF. company details to confirm
For the information in section 3 we are the controller: we decide how it's used and we're responsible for it. We're registered with the Information Commissioner's Office, number to confirm.
Questions about your information, or requests to use your rights: email info@invictus247.co.uk, or write to us at Quality House, Reedlands Road, Workington, CA14 3YF.
2. Two kinds of information
About you, as our customer or a visitor to this website (sections 3 to 9). We are responsible for this.
The records a business keeps in OPRIQ: its customers and their sites, jobs, certificates, invoices, suppliers' bills, its email, its books. The business decides what goes in and why, so the business is the controller and we're its processor: we only use those records to run OPRIQ for that business, on its instructions, under our data processing terms.
If you're a customer or the accountant of a business that uses OPRIQ, and it has given you a portal or a login, that business's own privacy notice applies to your information. Ask the business first; if you contact us, we'll pass your request to them.
3. What we collect about you
- When you visit this website: nothing is collected by the website itself. It uses no analytics, advertising or tracking (see cookies). The company that hosts it, Google, handles each request your browser makes and may record technical details such as your IP address and browser, to deliver the pages and keep them secure.
- When your business signs up and uses the apps: your name, email address and phone number; your business's name, address and details; who in your business uses OPRIQ and in what role (office, engineer, and so on).
- When you pay: what you've bought, when, and what you paid. Card details go straight to our payment provider (to confirm) and we never see or keep them.
- When you contact us: what you send us, and our replies.
- While OPRIQ runs: the technical records needed to run it safely: when people sign in and from which device, errors, and the audit log that records every change made in OPRIQ, by whom (or by the assistant), and when.
- If your business sends tax returns to HMRC through OPRIQ (not available yet): HMRC's rules require software to send, with each submission, details of the device and connection it was sent from, such as its IP address, the device and browser, and the OPRIQ user who sent it. HMRC calls this fraud prevention data. We collect it only when someone sends something to HMRC, and only what HMRC requires.
4. Why we use it, and the law that allows it
| What for | Lawful basis (UK GDPR) |
|---|---|
| Providing OPRIQ to your business, and supporting it | Our contract with your business, and our legitimate interest in serving it well |
| Billing, and keeping our accounts | Our contract; and the law, which says we must keep accounting records |
| Keeping OPRIQ secure, preventing misuse, and fixing faults | Our legitimate interest, and yours, in a service that's safe and works |
| Improving OPRIQ, from our own records of how it's used | Our legitimate interest in making it better. We never sell this |
| Telling you about changes that affect your account | Our contract |
| News and offers by email | Only if you've said yes, and you can stop them at any time |
| Answering enquiries from people who aren't customers yet | Our legitimate interest in replying |
| Sending HMRC the fraud prevention data its rules require with a tax submission (once available) | The law: HMRC requires it of software that sends returns |
Where we rely on legitimate interests, we've weighed them against your rights, and you can object (section 8).
5. Who else sees it
We use a small number of companies to run OPRIQ. They may only use the information to provide their service to us, and must keep it safe:
| Company | What they do | Where |
|---|---|---|
| Google (Firebase and Google Cloud) | Each business's database, sign-in, backups, the secret store, and hosting this website | to confirm |
| Anthropic | The assistant: Claude reads what a task needs and proposes what to do | United States |
| Contabo | The servers that run OPRIQ's software. They hold no business data of their own | to confirm |
| Intuit (QuickBooks Online) | A copy of the business's accounts, if it connects QuickBooks (only if a business connects it) | to confirm |
| The business's own email provider (Google Workspace, Microsoft 365 or another) | Reading and sending the business's email, if it connects a mailbox (only if a business connects it) | to confirm |
Once OPRIQ can send tax returns, HM Revenue & Customs receives what your business tells OPRIQ to send them, with the fraud prevention data above. We also share information when the law requires it, with our professional advisers (such as our accountant and solicitor) where they need it, and with a buyer if our business is ever sold, who would have to keep this policy's promises. We never sell personal information.
6. Outside the United Kingdom
Some of the companies above work outside the UK, Anthropic in the United States among them. When information goes abroad, it's protected by safeguards that UK law approves: the UK government's adequacy regulations (including the UK-US data bridge, where the company is certified), or the ICO's International Data Transfer Agreement or Addendum. which safeguard applies to each company Ask us for a copy.
7. How long we keep it
- Your account: while your business uses OPRIQ, and for 90 days after it stops proposed, so it can come back or take its records away. Then it's deleted.
- Billing records: six years after the end of the financial year they belong to, because the law requires it.
- Backups: each business's records are backed up every day, and each daily backup is deleted after 14 weeks. Weekly copies are also kept under a lock that nobody, us included, can remove early, so that nothing can wipe a business's records; they're kept for how long. Deleted information is finally gone once the last backup holding it has expired.
- Enquiries: two years after we last hear from you proposed, unless you become a customer.
8. Your rights
You have the right to:
- have a copy of the information we hold about you;
- have it corrected if it's wrong;
- have it deleted, where we have no reason to keep it;
- have us stop or limit using it, or object to our using it;
- have it given to you, or another company, in a form a computer can read;
- withdraw your consent, where that's what we rely on, at any time.
Email info@invictus247.co.uk. It's free, we may ask you to prove who you are, and we'll answer within a month.
9. Complaints
Please tell us first (how to complain). You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or on 0303 123 1113.
10. Information from Google, when a business connects Gmail
OPRIQ's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In plain words: when a business connects its Google mailbox, OPRIQ reads and sends email only for the features that business uses (such as filing suppliers' invoices, and sending documents a person has approved). It isn't used for advertising, isn't sold, and isn't used to train general AI models. Our staff don't read it unless the business asks us to for support, for security, or because the law requires it. the assistant's arrangement with Anthropic (SPEC D22) must keep this true
The assistant and what it does with a business's information: the assistant and your data.
11. Children
OPRIQ is for businesses, and isn't meant for anyone under 18.
12. Changes to this policy
When we change this policy, we'll change the date at the top, and tell customers by email or in the apps before anything important changes.