1. Scope & Foundational Principles
This Privacy Policy applies to all services, software applications, APIs, neural inference networks, autonomous hardware devices, and digital properties owned and operated by OpenGrab Technologies, Inc. and its consolidated affiliates (“OpenGrab”, “we”, “our”, or “us”).
We operate under a simple foundational premise: privacy is an immutable architectural constraint, not an afterthought. We minimize data intake, enforce mathematical isolation between organizational tenants, and provide complete auditable visibility into how information moves through our infrastructure.
2. Information We Collect & Neural Telemetry
Depending on your interaction with OpenGrab platforms, we may collect and process information in the following structured categories:
- Identity & Organizational Credentials: Name, institutional email address, company affiliation, billing information, and cryptographically hashed passwords.
- Customer Neural Inputs & Outputs: Prompts, audio recordings, sensor streams, code repositories, and unstructured payloads submitted to OpenGrab inference APIs or candidate management portals.
- Distributed Compute & Hardware Telemetry: Cluster compute node utilization, token throughput rates, latency histograms, IP addresses, browser fingerprint metadata, and TLS handshake metrics.
- Candidate & Recruiter Dossier Information: Resumes, employment trajectories, evaluation metrics, interview transcripts, and ATS scoring rubrics processed via OpenGrab hiring platforms.
3. Enterprise Model Training Exemption
Strict Non-Use of Customer Data for Foundation Training
OpenGrab Technologies does not use, store, or serialize any Customer Inputs, model completions, fine-tuning payloads, or proprietary datasets submitted via enterprise API keys or dashboard accounts to train, re-train, or adapt our public foundational weights without explicit, written contractual consent.
Your intellectual property, proprietary algorithms, and sensitive enterprise data remain strictly segregated within ephemeral execution memory. Fine-tuned adapter checkpoints trained by enterprise tenants remain the exclusive property of that tenant.
4. Legal Bases for Processing (GDPR & CCPA/CPRA)
We process personal data strictly in accordance with lawful justifications specified under Article 6 of the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA):
5. Cryptographic Security & Zero-Knowledge Storage
We maintain industry-leading technological safeguards to defend customer data against unauthorized exfiltration, interception, or corruption:
- Encryption at Rest: All database disks, snapshot archives, and backup volumes are encrypted with AES-256 via FIPS 140-3 validated Hardware Security Modules (HSMs).
- Encryption in Transit: Mandatory TLS 1.3 with Perfect Forward Secrecy (PFS) for all public web traffic and inter-cluster worker communication.
- Role-Based Access Control (RBAC): Zero permanent administrative standing access to production database clusters. All production interventions require multi-party cryptographic elevation.
- Audit Immutability: All administrative queries and system modifications are recorded in an append-only, tamper-evident audit ledger.
6. Data Retention & Autonomous Purge Cycles
We retain personal data only for the duration required to fulfill the business purposes outlined in this policy:
| Data Classification | Default Retention Horizon | Deletion Mechanism |
|---|---|---|
| Ephemeral API Inferencing | 0 to 30 Days (configurable to 0) | Automated memory wipe post-execution |
| Account Profiles & Billing | Duration of active subscription + 7 years statutory | Cryptographic purge upon account termination |
| Candidate Job Applications | 12 Months from application date | Automated ATS scrubbing schedule |
| Cluster Security Logs | 90 Days rolling buffer | FIFO automated log truncation |
7. International Transfers & EU-US DPF
OpenGrab maintains infrastructure distributed internationally. When transferring personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to jurisdictions that have not received an adequacy decision, we utilize European Commission Standard Contractual Clauses (SCCs) and adhere to the EU-U.S. Data Privacy Framework.
8. Your Privacy Rights & Access Controls
Regardless of your geographic location, OpenGrab provides universal access to core privacy rights:
9. Verified Subprocessors & Infrastructure
We partner exclusively with enterprise infrastructure providers that guarantee equivalent or superior data security standards. All subprocessors are bound by rigorous Data Processing Agreements (DPAs):
Infrastructure tiers include Tier-4 cloud compute facilities, zero-log DNS resolution providers, and PCI-DSS Level 1 payment processing gateways. An up-to-date subprocessor list is provided to enterprise customers upon request.
10. Data Protection Officer & Regulatory Contact
For questions concerning this Privacy Policy, to exercise statutory rights, or to report a security incident, contact our Office of Data Privacy: