Privacy Policy

01What we collect

We collect the minimum data necessary to provide the service:

• Email address — when you create an account
• Structured analysis results — root cause, confidence scores, recommendations — if you are signed in
• Usage counts — how many analyses you have run this week, to enforce free tier limits
• Feedback signals — thumbs up/down on triage results, if you provide them
• Anonymous analytics — page views and feature usage via Plausible (no cookies, no fingerprinting)

We do not collect: raw log data, stack traces, incident payloads, service names, IP addresses beyond rate limiting, or any personally identifiable infrastructure information.

02Raw log data — zero retention

This applies to all input modes — incident triage, pre-mortem scanning, post-mortem drafting, on-call handoff, and blast radius prediction. In every case, your raw input is processed and gone.

This is a core architectural decision, not an afterthought. It is enforced at the code level in our serverless functions, which are stateless by design.

03Your analysis history

If you create an account and sign in, OperatorMesh saves the structured output of your analyses to your private dashboard. This includes:

• Root cause identification
• Confidence scores (diagnosis and remediation)
• Recommended actions
• Timestamp and analysis mode
• A short excerpt of your input (first 200 characters only)

Your raw logs are never part of this stored history. Only the processed, structured output is saved.

You have full control: Every analysis in your dashboard has a Delete button. You can delete individual analyses or contact us to delete all your history permanently.

If you use OperatorMesh without signing in, nothing is stored — analyses exist only in your browser session.

04Account data

Account creation requires only your email address. Authentication is handled by Supabase (SOC2 Type II certified). We store:

• Email address
• Account creation date
• Subscription plan (free, starter, or pro)
• Weekly usage count (resets every Monday)

Payment processing is handled by Lemon Squeezy. We never see or store your payment card details. Lemon Squeezy is PCI DSS compliant.

05Analytics

We use Plausible Analytics — a privacy-first analytics platform. Plausible does not use cookies, does not fingerprint browsers, and does not track users across sites. All analytics data is anonymised and aggregated. You do not need to consent to any tracking to use OperatorMesh.

06AI and model training

OperatorMesh uses the Anthropic Claude API to perform AI analysis. Under our agreement with Anthropic:

• Your inputs are never used to train Anthropic's models
• API inputs are not stored by Anthropic beyond the immediate request
• We do not fine-tune models on your data
• No human reviewer at Anthropic or OperatorMesh reads your incident data

07Data sharing

We do not sell your data. We do not share your data with advertisers. The only third parties who receive any data are:

• Anthropic — receives your input for AI processing, discards it immediately after
• Supabase — stores your account and structured analysis results
• Lemon Squeezy — processes payments
• Resend — sends transactional emails (account confirmation, usage nudges)
• Plausible — anonymised analytics only

All providers are contractually prohibited from using your data for their own purposes.

08Your rights

You have the right to:

• Access — request a copy of all data we hold about you
• Deletion — request deletion of your account and all associated data
• Correction — correct any inaccurate data
• Portability — export your analysis history in JSON format
• Objection — opt out of any non-essential data processing

To exercise any of these rights, email founder@operatormesh.com. We respond within 30 days.

GDPR: If you are in the European Economic Area, you have additional rights under GDPR. We process only the minimum necessary data and have a lawful basis for each processing activity. A Data Processing Agreement (DPA) is available on request for enterprise customers.

09Security

• All traffic encrypted via HTTPS (enforced by Netlify)
• Database access protected by Row-Level Security — users can only access their own data
• API keys stored as environment variables, never in code
• Rate limiting: 15 requests per IP per minute
• Bot protection on all API endpoints
• No raw incident data written to any persistent storage

If you discover a security vulnerability, please email founder@operatormesh.com immediately.

10Contact