Privacy Policy

1. Two kinds of data, and two different roles

Read this section first, because the rest of the policy depends on it.

• Operator data is the operator business, its users, their roles and sign-in details, and its settings. For this data, OnlyOps decides how it is processed, and this policy is the account of that.
• Subscriber data is the names, areas, buildings, phone numbers, meter readings, reading photos, bills and payments of the people an operator supplies. The operator decides what is collected and why. OnlyOps holds and processes it on the operator’s instructions, to run the Service for that operator and for nothing else.

If you are a subscriber of a generator operator, section 9 is written for you.

2. Data we hold

• Operator account information: what is needed to create and secure an operator’s account and its users, such as name, username and role, and a password stored only as a one-way cryptographic hash. We never store a password in readable form.
• Billing data the operator enters: subscribers and their details, tariff and tier settings, bills and payment records.
• Meter readings and photos: meter values, and the photos an operator’s field staff take as proof of a reading.
• Records of account activity: a record of significant actions taken in an account, such as who changed a price or voided a bill, with the time, the network address and the browser used. We keep it for security and to resolve disputes.

We do not receive or store payment card numbers or bank credentials. The Service is not designed to hold health, genetic, biometric, criminal or state security data, and our Terms forbid operators to enter it.

If you ask for access on our home page: we keep what you send, which is your name, phone number, town, roughly how many subscribers you have, and the language the page was in. We use it only to call or message you about OnlyOps. It is kept in OnlyOps’ database at Neon, in Frankfurt, and only the OnlyOps team can see it. If the form is sent again with the same phone number, the details sent last replace the earlier ones. If you correct your number on the thank-you screen within a few minutes of sending, the entry with the wrong number is removed, unless our team has already started working on it. Once 12 months pass since the form was last sent with your number or we last updated your entry, we delete it, at the latest the next time anyone sends the form or our team opens the list. We remove it at once if you ask: email founder@onlyops.io or message us on WhatsApp.

3. How data is used

We use the data only to provide the Service: to sign users in, calculate and record bills, store meter readings and their photos, track collections, and show an operator the state of their own business. We use aggregate information that identifies no one to keep the Service reliable and to improve it. We do not use operator or subscriber data for advertising, we do not sell it, and we do not use it to train any artificial intelligence system. What the home page’s access form sends is used only to call or message the person who sent it about OnlyOps, as section 2 says.

4. Where data is stored

The Service is hosted by Vercel and its database runs on Neon, both in Frankfurt, Germany. Meter photos are stored with Cloudflare. All of these are outside Lebanon. The video on our home page is served by Cloudflare. We use these providers because they give a level of security and reliability we could not run ourselves. Data travels over encrypted connections, and our hosting provider keeps technical records of requests, such as network addresses, to run and secure the Service.

5. How data is protected and separated

Each operator’s data is kept separate from every other operator’s, both in the application and in the database itself, and the separation is based on the signed-in account, never on anything the browser sends. Passwords are stored with a modern password hashing algorithm and cannot be recovered. Sessions are held on the server and can be ended. Meter photos are kept in private storage and shown only through short-lived, access-controlled links. Recorded payments are kept in an append-only ledger, so a recorded payment is never silently altered. Access by OnlyOps staff is limited to what is needed to run and support the Service.

6. Sharing

We do not sell data, and we do not share it with anyone for their own marketing. We use a small number of providers to run the Service: hosting (Vercel), the database (Neon) and photo storage (Cloudflare). They process data only to deliver the Service. If we add a provider, for example to send bills by message or to take payments online, we will name it here before it receives any data. We may disclose data where the law requires it, or to protect the rights, safety and security of operators and of the Service. If the Service is transferred to a company formed to provide it, or to anyone who takes over our business, the data transfers with it and remains subject to this policy.

7. Retention

We keep operator data while the account is active and for as long as needed to provide the Service and to meet legal and record keeping obligations. Billing and payment records may be kept longer where financial or legal rules require it. When an account ends, the operator may ask for an export of its data for at least 30 days. After that we may delete it, except for records we must keep by law.

8. Your rights

Under Lebanese Law No. 81 of 2018 on Electronic Transactions and Personal Data, you may ask whether we process personal data about you and for a copy of it, ask us to correct, complete or update it, object to its processing on legitimate grounds, and ask for it to be deleted in the cases the law provides. Write to founder@onlyops.io. We act on a request to correct, complete, update or delete data within 10 days, as the law requires. If the data is held for your generator operator, section 9 explains who acts on it.

9. If you are a subscriber

If your generator operator uses OnlyOps, your name, area, building, phone number, meter readings, the photos of those readings, your bills and your payments are held in the Service for that operator and by that operator’s decision. OnlyOps does not decide what your operator collects about you, and it does not use your details for anything other than running your operator’s billing.

Your operator may give you a link to your bill. The page it opens shows your name, subscriber number, area and building, and the details of that bill. It never shows your phone number or meter photos. Anyone who has the link can open the page, so share it only with people you trust.

Ask your operator first. They hold the relationship, and they can correct a reading, a bill or a phone number directly. If you cannot reach them, or your request is about how OnlyOps itself holds the data, write to founder@onlyops.io and tell us which operator bills you. We will pass your request on promptly and help where we can.

10. Cookies and what is stored on your device

OnlyOps uses no analytics, no advertising technology and no outside tracking of any kind. We set only the cookies the Service needs to work: one that keeps you signed in, and two that remember your language and the billing month you are viewing. Your light or dark display choice, and the screen you came from, are kept only in your browser and are not sent to us. Because none of this is used for tracking, the Service does not ask you to consent to cookies.

11. Changes to this policy

We may update this policy from time to time. When we make a material change, we will update the date above and tell operators by email or in the Service.

12. Contact

OnlyOps operates from Beirut, Lebanon. For any privacy request, email founder@onlyops.io.

13. Language

This policy is written in English. If we publish a translation, the English text governs wherever the two differ.