This policy explains how Softup LLC (“FurniOps”, “we”) handles personal data when you visit furniops.com, create an account, or use the FurniOps service, dashboard, API or MCP server.
When a business uses FurniOps, the data it puts into its organisation is processed on its behalf under our Data Processing Addendum; that business is the controller for it. This policy covers the data we control ourselves: accounts, security, billing, our website and support.
1.What we collect
Your account
- Email address, display name, and whether you have verified your email.
- A hash of your password (we never store the password itself). When you set a password we check it against known breached passwords by sending only the first 5 characters of its SHA-1 hash to the Have I Been Pwned range service.
- Second factors you add: an authenticator-app secret (stored encrypted), hashed recovery codes, passkeys (the public key and the device name you give it).
- If you sign in through your company's single sign-on: the identifier and email address your identity provider sends.
- The organisations you belong to and your role in each; invitations sent to your email address.
Security and sessions
- For each signed-in session: a hashed session token, your user agent, a keyed hash of your IP address and a shortened form of it (for display in your session list), and times.
- A security audit trail of account events (sign-ins, factor changes, key changes, invitations), with the same IP and user-agent details.
- For API keys: when each key was last used and, to detect unusual use, the country and network operator it was used from (looked up locally; we store no full address for this).
Using the service
- Request logs for your organisation's API calls: method, route, path, status, duration, which key or user made it, a truncated IP address (the last part removed) and the user agent. Never request bodies or credentials. Kept 31 days and visible to your organisation.
- An activity timeline of changes in your organisation (who did what, from which IP and browser).
- The emails we send you (address and content while queued; the content is erased once sent).
- If your organisation receives vendor files by email, the sender's address and the attachments.
Billing
Your Stripe customer ID and usage counts. Card details are entered into Stripe's form and held by Stripe; we never see them.
Cookies
We use only cookies needed for the service to work; no advertising or analytics cookies.
| Cookie | Purpose |
|---|---|
__Host-fo_session | Keeps you signed in to your FurniOps account |
__Host-fo_sso | Holds a single sign-on attempt in progress |
fo_oauth_* | The state of an OAuth sign-in or consent in progress |
__Host-fo_dashboard, __Host-fo_dashboard_signin | Your dashboard session and a sign-in in progress |
fo_mode | Whether the dashboard shows your test or live data |
__Host-fo_console, __Host-fo_console_signin, __Host-fo_look | The FurniOps staff console's session, a sign-in in progress and the reason a staff member gave for opening an organisation (staff only) |
2.Why we use it, and our legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Providing your account and the service | Account, organisations, sessions | Contract |
| Keeping accounts and the service secure: lockouts, breached-password checks, unusual-key alerts, audit | Security data, request logs | Legitimate interests (security); legal obligation where it applies |
| Sending service and security email | Email address | Contract; legitimate interests |
| Billing | Billing data | Contract; legal obligation (tax records) |
| Support | What you send us; with your organisation's permission, time-limited staff access | Contract; legitimate interests |
| AI features your organisation turns on | Catalogue content (not intended to contain personal data) | Contract (on the customer's behalf) |
We do not sell personal data, use it for advertising, or make decisions with legal effects about you by automated means.
4.Where it is stored
Our servers, databases and file storage are in DigitalOcean's Bengaluru, India region. Email is sent through Resend in the United States, and traffic passes through Cloudflare's global network.
5.How long we keep it
| Data | Kept |
|---|---|
| Account data | Until you delete your account |
| Sessions | A session expires after 7 days idle or 30 days at most; an ended session's record is deleted 30 days later |
| Account security audit | 400 days |
| API request logs | 31 days |
| Unusual-use data for API keys | 8 days |
| Emails we send | Content erased once sent; the delivery record for 30 days |
| Billing records | As long as tax law requires |
| Backups | 30 days, then deleted |
6.Your rights
Depending on where you live, you may have the right to access, correct, delete or port your data, to object to or restrict processing, and to complain to a data protection authority.
- Delete your account yourself in your account settings. This erases your account, factors, sessions and memberships at once and sends you a confirmation. If you were the only member of an organisation, that organisation and its data are deleted too.
- Download a copy of the data held about your account from your account settings.
- Correct your name and email in your account settings.
- For anything else, such as an objection, email [email protected]. If your data is in a business's organisation, we may refer you to that business.
7.Security
Encryption in transit and at rest, encrypted secrets, hashed passwords and keys, multi-factor authentication, tenant isolation enforced in the application and the database, audit trails and regular testing.
8.Children
FurniOps is a business service. It is not meant for children.
9.Changes
We post changes here, with the version and the day it takes effect, and email account owners before a material change takes effect.
10.Contact
Softup LLC, [email protected].
Version history
| Version | Effective | Change |
|---|---|---|
| 1.0 | First version. |