Privacy Policy

We follow a simple rule: collect the minimum needed to provide the service. Here is exactly what we store and why:

To be explicit:

• We never sell your data. To anyone. Period.
• We never share your data with advertisers or data brokers.
• We never use your builds, recipes, or conversations to train AI models.
• We never profile you for marketing or ad targeting.
• We never send unsolicited marketing emails (unless you explicitly opt in).

Everything we collect serves one of three purposes:

• Running the service: Building your images, storing your recipes, delivering your ISOs.
• Keeping it secure: Detecting unauthorized access, preventing abuse, maintaining audit trails.
• Communicating with you: Account notifications, build status updates, and security alerts. Nothing promotional unless you ask for it.

As few parties as possible. Here is the complete list of third parties that may process your data:

• Anthropic (AI provider) — processes conversation data to power the build assistant. Governed by a data processing agreement. They do not use your data to train their models.
• Amazon Web Services — hosts our infrastructure. Your data is encrypted at rest and in transit.
• Google Analytics — anonymized marketing site usage only (not the console).

We may also disclose data if required by law or legal process — but we will notify you first unless legally prohibited from doing so.

That's it. No ad networks, no data brokers, no "trusted partners."

We keep your data only as long as it's useful to you or required for security:

Enterprise customers can negotiate different retention periods. Want us to keep your build history longer? Shorter? Just ask.

Your data is yours. You have the right to:

• See it: Request a full export of everything we have on you.
• Fix it: Correct any inaccurate information.
• Delete it: Request complete deletion of your account and all associated data. We'll do it within 30 days.
• Take it with you: Export your builds, recipes, and configurations in standard formats.
• Object: Tell us to stop any processing you're not comfortable with.

Email privacy@openfactory.tech and we'll respond within 30 days — usually much sooner.

Security is our product, so we take it seriously in our own house too:

• All data encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Each build runs in a fully isolated environment.
• Role-based access controls with least-privilege principles.
• Cryptographic verification (SHA-256) of all build artifacts.
• Continuous monitoring and automated security alerting.

If you're building compute environments for healthcare or other HIPAA-regulated work:

• We offer Business Associate Agreements (BAAs) for enterprise customers.
• The Service does not require or intentionally collect Protected Health Information (PHI). If PHI ends up in your builds or conversations, a BAA must be in place first.
• We maintain technical safeguards (encryption, access controls, audit logging) and administrative safeguards (training, incident response) aligned with HIPAA.

Contact privacy@openfactory.tech to set up a BAA.

For pharmaceutical, biotech, and medical device customers building validated compute environments:

• All build operations generate immutable audit trails (who, what, when).
• Build records follow ALCOA+ principles — attributable, legible, contemporaneous, original, and accurate.
• Verification hashes ensure no data has been altered after the fact.
• Enterprise customers can leverage our audit trail and electronic signature capabilities to support 21 CFR Part 11 compliance.
• Audit and verification logs are retained for 7 years.

For users in the EEA and UK — here are the legal bases we rely on:

• Contract: We need your account and build data to provide the service you signed up for.
• Legitimate interest: Security logs to protect the platform (we keep these minimal and short-lived).
• Consent: Analytics cookies and any optional communications — you can withdraw anytime.
• Legal obligation: Where required by law (e.g., GxP audit trail retention).

For international transfers from the EEA/UK, we use Standard Contractual Clauses (SCCs) approved by the European Commission.

We use very few cookies:

You can disable non-essential cookies in your browser settings. The service works fine without analytics cookies.

If you're in the EEA or UK and aren't satisfied with our response, you can lodge a complaint with your local data protection authority.