Trust
Security & data
Last updated
1. What the website handles
Contact and walkthrough forms can collect your name, email, company, message, and how you heard about Oplut. Newsletter signup records your email and explicit permission to receive news and product updates, separately from inquiries and existing fieldwork contacts. We also keep request sources, timestamps, and conversation records. Hosting and delivery services may process technical request and delivery information.
These forms do not grant store access or authorize a purchase, return, credit, refund, or other commercial action. Please do not submit passwords, Shopify access tokens, customer or shopper records, store exports, payment details, or confidential account terms. The privacy notice explains how website information is used.
2. Where the website runs
- Application hosting
- The website runs on a Hetzner server in Hillsboro, Oregon. Oplut uses Coolify on that server to manage deployments.
- Database
- Neon provides a managed PostgreSQL database in AWS US West 2 (Oregon) for website inquiry and contact records.
- Email delivery
- Resend delivers website inquiry notifications and acknowledgments. Zoho Mail hosts our business mailbox for receiving inquiries and replying to you.
- Domain services
- Cloudflare provides the domain's DNS services.
The application and primary database locations do not describe every location used for email delivery, provider support, or other provider operations.
3. Website protections
The website uses browser security policies to restrict resource loading, block embedding in another site, and disable access to the camera, microphone, and location. Inquiry forms validate submitted fields and include an automated-submission check to help reduce spam.
No website, email, or storage system is completely secure. Oplut is not SOC 2 or ISO 27001 certified; certifications held by service providers do not extend to Oplut.
4. Records and deletion requests
Website inquiries are stored in the website database. Copies of related correspondence are also held by our email providers. Deleting an active database record does not necessarily remove copies from email, provider logs, or database recovery history at the same time; those records have separate retention periods.
Our privacy notice describes the purposes for retaining website records. To request access, correction, deletion, or an end to follow-up, email contact@oplut.com.
5. Store access
Product interfaces shown on this website are demonstrations, not live merchant accounts. Visiting the site, viewing a demonstration, or submitting a contact form does not install an app or grant Oplut access to a brand's or retailer's Shopify store. The public website does not read store orders, inventory, or shopper records through a Shopify integration.
6. Report a security concern
Email contact@oplut.com with the subject “Security concern.” Include the affected page, what you observed, and steps to reproduce the issue using your own information. Remove personal data and secrets from screenshots or examples. We can arrange an appropriate way to share sensitive details if needed.
Please do not access another person's information, disrupt the service, or send passwords or live access tokens. This contact route does not authorize testing or promise a bounty or a particular response time.