Privacy Policy

Information We Collect

Information you provide

If you select the booking option on our website, we load a Cal.com scheduling experience. Cal.com collects the information you provide to schedule a meeting, which may include your name, email address, and any information you enter in the booking notes field.

Calls are recorded only with the consent of everyone on the call, requested before recording begins.

A recording does not begin until each current participant affirmatively agrees. If someone joins late, we obtain their consent before including them in the recording.

Please do not submit Protected Health Information, patient information, Social Security numbers, financial account information, client account numbers, trading instructions, payment-card information, passwords, private keys, government-issued identification numbers, or other sensitive information through the booking tool, public website forms, ordinary email, or other public channels.

For healthcare inquiries, do not include patient-specific information. For financial-services inquiries, do not include client nonpublic personal information, account numbers, or trading instructions. If a secure method for sharing information is appropriate, we will provide one after confirming the relevant agreement and access method.

Early-access list. If you ask to join our early-access list, we collect the email address you provide and may collect related signup information, such as your name, organization, and stated interest. We use this information to manage the early-access list, contact you about access and product updates, and send marketing communications where permitted. We receive and store early-access sign-ups through our form-handling provider, Cloudflare (Cloudflare Workers and Cloudflare Workers KV), with an internal Slack alert that contains no submission content. We may use other service providers to administer communications. You may unsubscribe from marketing emails at any time or ask us to delete your early-access-list information, subject to legal and security recordkeeping needs.

Information collected automatically

When you visit opportuna.cloud, our hosting provider may collect standard server-log information, such as your IP address, browser type, request time, requested page, and diagnostic or security information.

On product pages, we use PostHog Cloud EU for limited product analytics. PostHog is configured to collect five named website events, page URLs, and browser metadata. It is configured with cookieless, memory-only persistence; cookies are disabled; IP collection is disabled; session recording, autocapture, surveys, and cross-site tracking are disabled.

We do not use advertising pixels, behavioral advertising, session-replay technology, or cross-site tracking. Fonts are self-hosted, and we do not use a third-party font delivery service.

How We Use Information

We use personal information to:

• Respond to inquiries and meeting requests
• Schedule and manage requested meetings
• Understand how visitors use our product pages at an aggregated product-analytics level
• Operate, secure, troubleshoot, and improve our website and services
• Detect, investigate, and prevent fraud, abuse, security incidents, and unlawful activity
• Comply with law, enforce agreements, and protect rights, safety, and property

How We Disclose Information

We disclose personal information only as reasonably necessary for the purposes described in this Policy, including to:

• Our service providers, listed under Service Providers below
• Professional advisors, insurers, auditors, government authorities, courts, law enforcement, or other parties where required by law or reasonably necessary to protect rights, safety, security, or property
• A successor entity in connection with a merger, acquisition, financing, restructuring, or sale of all or part of our business

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

Service Providers. We use service providers to operate, secure, support, and improve the Service. Depending on the feature you use and the information you provide, these providers may process information on our behalf under applicable agreements and their own terms and privacy policies.

• Hostinger, which hosts our website and processes standard server logs
• Cloudflare, which provides content delivery, website security, bot detection through Cloudflare Turnstile, serverless request processing through Cloudflare Workers, storage through Cloudflare Workers KV, and encrypted infrastructure-backup services. Cloudflare may process information as necessary to deliver, secure, monitor, and improve those services. Pages that contain a personal submission are not cached.
• PostHog Cloud EU, which provides the limited product analytics described above
• Google Workspace, for email and Google Meet calls. It may process email addresses, message content, and meeting information, which may include sensitive operational information.
• Cal.com and its service providers, including providers used for scheduling, security, reliability, and error monitoring. We disclose booking information you provide when you choose to use the scheduling service.
• Notion, for client hubs, which hold each client's session records, skills and deliverables. It may process the client content and client deliverables we maintain in a client's private client hub.
• Stripe, for billing when you purchase a paid plan. Stripe handles payment-card data, and Opportuna does not receive or store card data through hosted checkout.
• Slack, for internal alerts only. Alerts contain no client content.
• Documenso, for electronic signature of client agreements, master services agreements and other client-facing documents, when you are a party to a document we send for signature. Documenso processes signer names, email addresses, document data, IP addresses, browser information, timestamps, and signature audit-trail information to deliver and evidence the electronic-signature process

Cookies and Similar Technologies

opportuna.cloud does not set cookies for PostHog analytics. PostHog is configured for cookieless, memory-only analytics and does not store a persistent identifier in your browser.

Our website does not load Cal.com automatically. If you select the booking option, we load Cal.com, a third-party scheduling service, to provide the meeting-booking experience you requested.

When Cal.com loads, it and its service providers may store or access information on your device that is necessary to deliver and secure the scheduling service. This may include a Cloudflare bot-management cookie named __cf_bm, which Cloudflare states is used to identify and mitigate automated traffic and expires after approximately 30 minutes of inactivity, and Cal.com browser storage associated with the scheduling experience.

When the Cal.com scheduling experience is loaded, Cal.com may use service providers to operate, secure, and monitor that experience. Based on our current technical review, this includes Sentry error-reporting endpoints in the United States. Information transmitted through those services may include technical and diagnostic information, such as browser, device, network, error, and interaction data.

We do not load Cal.com until you select the booking option. We do not forward the page's query string to Cal.com. Please review Cal.com's privacy policy at cal.com/privacy.

Your browser or device may retain information under its own settings, and third-party services may use technologies governed by their own policies. You may manage browser storage and privacy preferences through your browser settings.

Idea Submission Form and Cloudflare

If you submit an idea through our website, we collect:

• Your idea, limited to 1,000 characters
• Your email address, if you choose to provide it
• Submission timestamp
• Country information reported by Cloudflare
• A salted and truncated hash derived from your IP address for rate-limiting and abuse prevention
• A generated submission identifier used to manage and address the submission

Your email address is optional. We use it only to contact you if we need clarification about the idea you submitted. We use the idea, submission timestamp, country information, pseudonymized IP-derived identifier, and generated submission identifier to review submissions, operate the form, prevent spam and abuse, and improve our services.

We may send an internal notification that a submission is available for review. That notification does not include the submission content or contact information.

We do not store the raw IP address in the idea-submission record. However, Cloudflare Turnstile processes your IP address and browser or device signals to distinguish human visitors from bots and protect the form from malicious or automated activity. Turnstile runs when the form is displayed, whether or not you complete or submit it.

We use Cloudflare Workers to receive form submissions and Cloudflare Workers KV to store submitted information. Cloudflare also provides website content delivery, security, and encrypted infrastructure-backup services for Opportuna.

Do not submit Protected Health Information, patient information, Social Security numbers, payment-card information, bank account information, client financial information, account numbers, trading instructions, passwords, private keys, government-issued identification numbers, trade secrets, or other sensitive information through the idea-submission form.

Please submit only information you are authorized to share. Do not submit confidential information belonging to another person or organization.

Contact Form

If you contact us through our website, we collect:

• Your message
• Your email address, if you choose to provide it, so we can respond to a general message
• Your email address, when you submit a Privacy Request, so we can verify and respond to your request
• Request type, if you select Privacy Request
• Submission timestamp
• Country information reported by Cloudflare
• A salted and truncated hash derived from your IP address for rate limiting and abuse prevention
• A generated submission identifier used to manage and address the submission

For Privacy Request submissions, the request type may be access, correction, deletion, objection, restriction, or another request concerning your personal information.

We use this information to respond to your inquiry, operate and protect the contact form, prevent spam and abuse, and maintain related business communications.

We use Cloudflare Turnstile to protect the form from malicious or automated activity. We use Cloudflare Workers to receive submissions and Cloudflare Workers KV to store them. We may send an internal notification that a contact submission is available for review. That notification does not include your message or email address.

Please do not submit Protected Health Information, patient information, Social Security numbers, payment-card information, bank account information, client financial information, account numbers, trading instructions, passwords, private keys, government-issued identification numbers, trade secrets, or other sensitive information through the contact form.

Submissions Made Through an Agent

A person or organization may use an automated agent, assistant, or other authorized tool to submit an idea, message, or other permitted form content on their behalf.

If a submission is made through an agent, we process the submitted information in the same manner described in this Privacy Policy. The person or organization using the agent is responsible for ensuring that the agent is authorized to submit the information, that the information may be shared with us, and that the submission complies with our Terms and form-specific instructions.

Do not use an agent to submit Protected Health Information, confidential information, client financial information, credentials, account numbers, trading instructions, or other sensitive information.

Data Retention

We retain personal information for as long as reasonably necessary to respond to inquiries, schedule and manage meetings, operate and protect our website and services, execute and retain business agreements, meet legal obligations, resolve disputes, enforce agreements, and maintain ordinary business records.

For idea submissions, we generally retain the submission record for up to 180 days. If we communicate with you about a submission, related correspondence may be retained separately in our ordinary business communications records as reasonably necessary for the conversation, our services, legal obligations, dispute resolution, and ordinary business records.

We generally retain contact-form submissions for up to 12 months. We retain privacy-rights requests and related handling records for up to 36 months after the request is completed. We configure pseudonymized rate-limiting identifiers to expire after approximately two hours. We may retain relevant information longer where reasonably necessary to investigate or prevent abuse, resolve a dispute, comply with law, or preserve information subject to a legal hold.

Where this Privacy Policy states a specific retention period, we retain the relevant information for that period, subject to lawful retention requirements, documented security or abuse investigations, disputes, and legal holds. For other information, retention depends on the information involved, the purpose of processing, legal obligations, operational needs, and the retention practices of applicable service providers. We review and delete or de-identify information when it is no longer reasonably needed for these purposes, subject to lawful retention requirements and backup or security-record rotation.

Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information. No internet transmission, storage system, or other system is completely secure, and we cannot guarantee absolute security.

Your Privacy Requests

Subject to applicable law, you may request access to, correction of, or deletion of personal information we hold about you by writing to our privacy contact.

You may submit a privacy request through our Privacy Request Form or by mail to:

We currently handle privacy requests manually. We may need to verify your identity and may decline or limit a request where permitted or required by law.

You may opt out of non-transactional marketing communications by using the unsubscribe mechanism in the message, if provided, or by writing to our privacy contact.

Children

Our website and services are not directed to children under 13, and we do not knowingly collect personal information from children through this website.

Third-Party Links

Our website may link to third-party sites, products, or services. We are not responsible for their content or privacy practices. Review the privacy policies of third parties before providing information to them.

Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on opportuna.cloud with a revised effective date.

Contact