Privacy Policy

This Privacy Policy explains how OS Tools ("we", "us", or "our") collects, uses, discloses, and protects the personal information of users ("you") who access or use our website and services at ostoolbox.com (the "Service"). By using our Service, you agree to the collection and use of information in accordance with this Policy.

1. Information We Collect

1.1 Personal Identification Information

We collect personal information only when you voluntarily provide it. This may include:

• Name and email address (when you register for an account)
• Payment details processed through our third-party payment provider, Whop (we do not store card details directly)
• Email lists or data you upload to use our verification tools

1.2 Non-Personal Information

When you visit our website, we may automatically collect non-personal information such as:

• Browser type and version
• Operating system
• Internet service provider
• Pages visited and time spent on the site
• Referring URLs and device type

1.3 Cookies & Tracking Technologies

We use cookies and similar tracking technologies (e.g., analytics tools) to enhance your experience, analyze usage patterns, and improve our Service. You may configure your browser to refuse cookies, though some features may not function properly as a result.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our Service
• Process transactions and manage your account credits
• Send transactional emails (e.g., job completion notifications, account updates)
• Respond to support inquiries and improve customer service
• Monitor and analyze usage to improve the Service
• Detect, prevent, and address fraud or security issues
• Comply with legal obligations

We do not sell or rent your personal data to third parties. We do not use your uploaded email lists for any purpose other than performing the verification service you requested.

3. Data You Upload for Verification

When you upload email lists or other data for processing through our tools, this data is used solely to perform the requested service. We do not share, sell, or analyze this data for any purpose beyond what is required to complete your job. Uploaded data is processed on secure servers and is deleted or anonymized once the job is complete and results have been made available to you.

All data is secured in transit using TLS encryption and at rest using AES-256 encryption.

4. Payments

All payments are processed through Whop, a third-party payment processor. We do not store or have access to your payment card details. Whop's handling of your payment information is governed by their own privacy policy, available at whop.com/privacy.

5. Data Retention

We retain your personal data only for as long as necessary:

• Account data: retained while your account is active; deleted or anonymized within 24 months of account closure.
• Uploaded verification data: deleted promptly after job results are delivered.
• Log and security data: retained for up to 12 months.
• Billing/transaction records: retained as required by applicable financial and tax regulations.

6. Sharing Your Information

We do not sell, trade, or rent your personal data. We may share information in the following limited circumstances:

• Service providers: Trusted third parties who assist us in operating our Service (e.g., cloud infrastructure, analytics), bound by confidentiality obligations.
• Legal requirements: When required by law, court order, or governmental authority.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Request that we limit processing of your data in certain circumstances.
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing of your data for certain purposes.

To exercise any of these rights, please contact us at help.organicsupremacy@gmail.com. We will respond within a reasonable timeframe.

8. Security

We implement industry-standard security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction. These include encrypted communications (TLS), encrypted data storage (AES-256), and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Children's Privacy

Our Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will take steps to delete it promptly.

10. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date. We encourage you to review this Policy periodically. Continued use of the Service after changes constitutes your acceptance of the revised Policy.

12. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Hong Kong. Any disputes arising under this Policy shall be subject to the exclusive jurisdiction of the courts of Hong Kong.

13. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

14. Legal Bases for Processing (GDPR)

• Contract — account creation, billing, delivery of the tools you request.
• Legitimate interest — fraud prevention, security logging, product analytics in aggregate, customer support.
• Consent — marketing/analytics cookies, Meta Pixel, Google Ads, retargeting (you can withdraw at any time via the Cookie Settings link in the footer).
• Legal obligation — keeping billing records and abuse logs to satisfy tax and law-enforcement duties.

15. Sub-processors

We use the following service providers to operate OS Tools. We require each of them to provide GDPR-grade protection for your data.

16. Retention Periods

• Account & profile: kept while your account is active. Deleted within 30 days of account closure.
• Uploaded lists & tool inputs: deleted automatically 30 days after job completion.
• Tool results & CSV exports: stored until you download them, then purged within 30 days.
• Billing records & invoices: 7 years (legal/tax obligation), anonymised if you delete your account.
• Marketing attribution (Meta / Google): 180 days, then purged automatically.
• Consent records: 24 months for anonymous visitors; for the lifetime of the account otherwise.
• Support tickets: kept while the account is active, deleted on account closure.

17. International Data Transfers

OS Tools is operated from Hong Kong. Some sub-processors are located in the EEA or the United States. Where required, transfers outside the EEA rely on the European Commission's Standard Contractual Clauses (2021/914) and, where relevant, on the EU–US Data Privacy Framework. You can request a copy of the safeguards by emailing us.

18. Your GDPR Rights

If the GDPR applies to you, you have the right to:

• Access a copy of your personal data — use Account → Privacy → Download my data.
• Rectify inaccurate data — update your email in Account → Profile.
• Erase your data — use Account → Privacy → Delete my account.
• Restrict or object to processing — email us.
• Data portability — the export download is in JSON, a machine-readable format.
• Withdraw consent at any time — Cookie Settings link in the footer.
• Lodge a complaint with your local data protection authority.

We respond to verified requests within 30 days, at no cost.

19. Cookies & Tracking

We split cookies and similar local-storage items into three categories:

• Strictly necessary — Supabase auth session, support chat session, theme preference. Always on; the site cannot function without them.
• Analytics — aggregate product usage (off by default).
• Marketing — Google Ads tag, Meta Pixel (_fbp, _fbc, fbclid) and Google Ads click IDs. Loaded only after you click Accept.

Change your choice at any time via the Cookie Settings link in the footer.

20. Business Customers (DPA)

If you process EU personal data using OS Tools on behalf of your own customers, you are a controller and we are your processor. A signed Data Processing Addendum is available for download — counter-sign it and keep it on file.