Privacy Policy
Effective date: March 10, 2026 · Last updated: October 13, 2026
The short version
OpenFactory collects the minimum data needed to run the service, protect the platform, and deliver your operating systems. We do not sell personal data or use your builds and conversations for ads or model training. Google may process limited device and usage data for analytics and advertising on marketing and guest-launch surfaces.
This policy explains what OpenFactory Inc. collects, why we collect it, how long we keep it, and what control you retain over that information across openfactory.tech and related services.
1. What we collect
We keep the scope narrow and tie collection to a specific operational need.
Account information
We store your name, email address, profile image, and authentication identifiers so you can sign in and manage your account.
Build and recipe data
We store your recipes, build settings, generated images, logs, and test results so you can create, review, rerun, and download your systems.
Conversation data
If you use AI-assisted build workflows, we store the conversation and any generated draft artifacts so the session can continue and the system can produce the requested output.
Security and usage data
We log IP addresses, user-agent strings, authentication events, and basic service telemetry to prevent abuse, investigate incidents, and maintain platform reliability.
Organization and integration data
If you belong to a team, we store organization membership, roles, and encrypted references, aliases, and status for accounts you explicitly connect. For managed integrations, the integration provider may conduct OAuth authorization and store the provider token.
Sales and pilot inquiries
When you contact sales, request a security review, or scope a technical pilot, we store the contact details, company and role, inquiry notes, qualification answers, source and campaign context, and opaque session or visitor identifiers you submit or that accompany the form. We hash the submitting network address for abuse prevention and do not store the raw address in the commercial lead record.
ChatGPT, Codex and other MCP clients
When you connect an MCP client such as ChatGPT or Codex, you sign in and approve access in your browser. We store the linked account identifier, client name and identifier, callback URL, granted scope, connection status and timestamps, and hashes of authorization codes and access and refresh tokens to authenticate and manage the connection. The plugin does not ask you to put passwords or API keys into a conversation.
We receive the inputs supplied to each tool call, which may include prompts, recipes, repository content and test instructions. Depending on the requested task, results sent to your client may include build identifiers and status, artifact links, logs, repository content, virtual machine, app or lab details, screenshots and recordings. The client provider, including OpenAI for ChatGPT and Codex, processes the inputs and results under its own terms and privacy policy. OpenFactory does not request or retrieve your full client conversation history.
OAuth connections and refresh tokens expire after 30 days. Expiration or revocation stops access but does not automatically delete stored connection metadata or token hashes. Tool-created builds, repositories and other artifacts follow the retention periods for the relevant data above. Contact privacy@openfactory.tech to request deletion of connection records or associated account data.
You can revoke a connection through Connected clients at https://build.openfactory.tech/auth/connections. Revocation blocks subsequent authenticated requests; a request already accepted may finish. Revoking a connection does not delete your builds, repositories or other artifacts, and does not erase copies already received by the client provider.
2. How we use information
- Run the service: Provision builds, store artifacts, execute tests, and make your account data available to you.
- Secure the platform: Detect fraud, enforce access controls, investigate abuse, and maintain audit trails.
- Communicate with you: Send account notices, build status updates, and security alerts, and respond to sales, pilot, and security-review inquiries. After you create an account, we may send a few getting-started emails to help you get your first build working. They stop once you start a build, and you can turn them off at any time in Settings or with the unsubscribe link in any of these emails. Marketing emails stay off unless you turn them on in Settings.
- Improve the product: Review anonymous or aggregated usage patterns on the marketing site and service surfaces to improve navigation and reliability.
3. What we do not do
- We do not sell personal data.
- We do not give advertisers access to your builds, recipes, conversations, or account content.
- We do not use your builds, recipes, or conversations to train foundation models.
- We do not use your builds, recipes, or conversations to personalize ads.
4. When we share data
We keep third-party access limited to infrastructure and service delivery.
- Infrastructure providers: Cloud and hosting partners may process data necessary to operate the service under contractual controls.
- AI and processing providers: Where the product uses a third-party model or processing backend, the provider only receives the data needed to fulfill the request under an applicable data-processing arrangement.
- Connected-app providers: For managed app connections, an integration provider may conduct OAuth, store provider tokens, and process the account data and actions needed for a requested tool call. The connected app provider also processes data under its own terms and privacy policy.
- Analytics and advertising: Google Analytics and Google AdSense may process cookies, device identifiers, IP addresses, approximate location, page visits, and ad interactions to measure traffic, provide ads, prevent fraud, and limit how often an offer is shown.
- Legal obligations: We may disclose information when required by law, court order, or a valid legal process.
5. Retention
We retain data only as long as it remains useful for the service or necessary for security and compliance.
| Data | Kept for | After deletion |
|---|---|---|
| Account information | While the account exists | Removed within 30 days |
| Builds and recipes | While the account exists | Removed within 30 days |
| ISO images | Up to 90 days after build | Purged automatically |
| Conversations | While the account exists | Removed within 30 days |
| Security logs | Typically 90 days | Purged automatically |
| Sales, security, and pilot inquiries | Up to 24 months after the last commercial interaction | Purged automatically unless a contract or legal obligation requires longer |
| Audit logs for regulated workflows | Up to 7 years when required | Retained as required by law or contract |
Enterprise customers can negotiate different retention periods through a written agreement.
6. Your rights and controls
- Access: Request a copy of the information we hold about you.
- Correction: Ask us to correct inaccurate or incomplete account information.
- Deletion: Request deletion of your account and associated data.
- Portability: Export builds, recipes, and related configuration data where supported.
- Objection: Object to processing where the law gives you that right.
We respond to privacy requests through privacy@openfactory.tech and normally complete them well before the 30-day mark.
7. Security and regulated use
- Data is encrypted in transit and protected at rest with standard platform controls.
- Build jobs run in isolated environments.
- Access is governed by role-based controls and least-privilege principles.
- We maintain audit trails and verification records for regulated deployment workflows.
- Business Associate Agreements and regulated-environment commitments are available through enterprise agreements where applicable.
8. Cookies, analytics, and advertising
We use a small number of cookies and similar technologies.
| Cookie or signal | Purpose | Required |
|---|---|---|
| Session cookie | Keeps you signed in and maintains session state | Yes |
| Analytics cookies | Measure marketing-site traffic and navigation patterns | No |
| Advertising cookies or signals | Provide and measure Google ads and control offer frequency | No |
You can decline or withdraw optional advertising storage through the consent prompt where offered, Google ad settings, or browser controls. Core service functionality and guest launch controls remain available when an ad is unavailable or blocked.
9. Children and policy changes
Children
OpenFactory is not intended for children under 16, and we do not knowingly collect personal data from them.
Policy changes
If we make material changes to this policy, we will post the update here and, where appropriate, notify account holders in advance.
10. Contact
For privacy requests, data-processing questions, or regulated-environment inquiries, contact us here.
If you are in the EEA or UK and believe we did not resolve a complaint appropriately, you may also contact your local data protection authority.