Data Privacy Notice.

Who is responsible.

Operava Global Solutions is the personal information controller for personal information it determines to process through LeadMASTER. This notice applies to visitors, authorized workspace users, email senders and individuals whose information appears in messages handled by the service.

Where LeadMASTER processes recipient or message information on behalf of an account holder, the account holder may separately determine the purposes and means of that processing and remains responsible for its instructions, recipient notices and lawful authority. Operava Global Solutions processes that information to provide, secure and support the service and in accordance with applicable law and documented instructions.

Categories of information.

• Account and authentication data: administrator identifiers, account details, password-verification data, one-time-code verification records, session identifiers or hashes, and security events.
• Technical and security data: IP address, request metadata, browser/device information, timestamps, rate-limit records and security-verification results.
• Email data: sender and recipient addresses, sender names, reply addresses, subject lines, message bodies, original inbound messages, attachments contained in original messages, and delivery or bounce events.
• Integration data: API-key prefixes and hashes, scopes, email request metadata, idempotency records, webhook endpoints, event payload metadata and delivery-attempt records.
• Support and communications: information included in support requests or communications with the service operator.

Please do not submit sensitive personal information unless it is strictly necessary, lawful and appropriately protected. Do not share passwords, OTPs, API secrets or session tokens in messages or support requests.

Why information is processed.

Information is processed only for specified and legitimate purposes, including:

• Creating and administering authorized workspace access; verifying administrators; issuing and validating OTPs; and maintaining secure sessions.
• Receiving, storing, organizing and displaying messages; submitting authorized outgoing email; and recording provider acceptance, delivery, bounce, delay or complaint events.
• Operating API keys, account-scoped requests, idempotency controls, webhooks and related integration security.
• Preparing AI-assisted reply suggestions when a user requests them. Suggestions are drafts for human review and are not automatically sent.
• Protecting the service, detecting abuse, troubleshooting, maintaining availability, enforcing service terms and responding to lawful requests.
• Meeting legal, regulatory, accounting and recordkeeping obligations and establishing or defending legal claims.

Depending on the activity and applicable law, processing may be based on performance of a requested service or contract, compliance with a legal obligation, consent where required, or legitimate interests that do not override the rights and freedoms of the individual. Where consent is the basis, it may be withdrawn subject to lawful limitations and processing already undertaken.

When information is shared.

Information may be processed by service providers acting on behalf of or supporting the service, including infrastructure, hosting, security, database, email-delivery and AI-assistance providers. Current service architecture uses Cloudflare for application hosting and security and Amazon Web Services / Amazon Simple Email Service for email transport and delivery events. Providers receive only information reasonably needed for their services and are subject to applicable contractual and security requirements.

Information may also be disclosed where required by law, to protect rights and safety, to investigate abuse or security incidents, or in connection with a corporate transaction subject to appropriate safeguards. We do not sell personal information.

Because providers may operate in different countries, information may be processed outside the Philippines. Where cross-border processing occurs, appropriate safeguards and accountability measures will be applied as required by applicable data-protection law.

How information is protected.

Controls used by the service include access restrictions, administrator allowlisting, human security verification, rate limits, time-limited single-use email OTPs, hashed session and API credentials, secure session cookies, account-scoped authorization checks, HTTPS transport, webhook signature verification and server-side secret storage. Access is limited according to operational need.

No system or transmission method is completely secure. Users must protect their credentials, restrict API keys to trusted server environments, verify webhook signatures and promptly report suspected unauthorized access.

How long information is kept.

Personal information is retained only for as long as reasonably necessary for the purposes described in this notice, to provide the service, meet legal obligations, resolve disputes, enforce agreements and maintain security. Retention depends on the record type, operational need, applicable legal requirements and provider configurations.

When information is no longer required, it will be securely deleted, anonymized or otherwise disposed of, subject to lawful retention requirements, backup cycles and records needed to establish or defend legal claims. Some provider logs and backups may persist for a limited period under the relevant provider's retention controls. Requests for deletion are assessed against these requirements.

Your data privacy rights.

Subject to the conditions and limitations under applicable law, including the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), you may have the right to be informed, access your personal information, object to or withdraw consent from certain processing, request correction, request erasure or blocking, obtain data portability where applicable, and seek damages or lodge a complaint with the National Privacy Commission.

To protect information, we may ask you to verify your identity or authority before acting on a request. We will respond within the period required by applicable law. Certain information may need to be retained or processing may continue where a lawful basis or legal obligation applies.

Cookies and local storage.

LeadMASTER uses a necessary secure, HttpOnly and SameSite=Strict session cookie for authenticated administrator access. It supports session continuity and is not intended for advertising. Security and infrastructure providers may use necessary technologies to protect and operate the service. Blocking essential cookies may prevent sign-in or workspace functions from working.

Privacy requests and concerns.

For privacy questions, access or correction requests, deletion requests, or concerns about the handling of personal information, contact hello@operavaglobal.com with the subject line “LeadMASTER Privacy Request”. Include enough information for us to understand and verify the request, but do not send passwords, OTPs or API secrets.

You may also raise a concern with the National Privacy Commission of the Philippines through its official website at privacy.gov.ph.

Updates to this notice.

This notice may be updated when the service, its data practices, providers or legal requirements change. The revised version and effective date will be published on this page. Material changes will be communicated through an appropriate service notice where required by law.

Related document: Terms and Conditions.