Privacy policy — Oply Digital Twin connector
Effective 2026-10-21. Source of the policy published at the privacy URL named in the Claude Connectors Directory listing and linked from the Oply console.
Before publication: fill the legal identifiers marked
<…>(controller's legal name, CNPJ, address, the data-protection contact). Nothing else in this text depends on them. The retention periods in §4 are applied by the api's dailyretentioncommand (ODTservices/retention.py); the technical logs' period is the cloud log groups' setting, and the deletion of a lapsed trial workspace after notice is still an operator's step (the command deactivates it). The two emails named below must exist.
1. Who we are
The connector and the Oply Digital Twin behind it are operated by Oplytec (<legal name>, CNPJ <…>, <address>, Brazil). Questions about this policy and requests about
your data: privacidade@oplytec.com (<data-protection officer>).
Under the Brazilian General Data Protection Law (LGPD) and, where it applies, the GDPR, your company is the controller of the business data it brings to its Oply workspace and of its users' accounts; Oplytec is the operator (processor) of that data, and the controller of the account and usage records described in §2.3 and §2.4.
2. What the connector processes
2.1 Account data
To sign you in and to decide what a tool may do: your username, name, role (member or administrator), the workspace you belong to, the permissions you consented to, and the identifier of the AI host application that asked. These come from your Oply account and from the sign-in; the connector keeps none of them beyond the token's life (§4).
2.2 Business data
The data your workspace holds in the Digital Twin: master data (sites, products, suppliers, transports), sales history, inventory, prices and promotions, rules, forecasts, plans and orders. The connector reads it and, on your assistant's instruction and with your confirmation, writes to it, exactly as the Oply console would. The connector stores none of it: every answer is computed by the Digital Twin for the call and returned to the host. A file uploaded through an upload URL goes directly to your workspace's data lake, not through the conversation.
Sales history is not personal data as the Digital Twin expects it (sales by site,
product and day, optionally by customer group). Do not upload customer-identifying
data into a sales dataset; the datasets' columns are listed by list_datasets and none
asks for a person.
2.3 Usage records
For billing, quotas, support and abuse prevention, every tool call is recorded with: the workspace, the caller (the user, or the API key, as an opaque identifier), the host application's identifier, the tool's name, the outcome (success, or the kind of failure), the duration, and the time. The arguments of the call and its results are never recorded. The content of your conversation with the assistant never reaches the connector at all: the host sends only the tool call.
2.4 Technical logs
Request logs (the same fields as §2.3, plus the request's network address and the host's software identification) are kept for operational monitoring and security, and deleted after 90 days at most.
2.5 Credentials
Access tokens are signed, expire after one hour and are not stored by the connector. Refresh tokens and API keys are stored hashed; the value of an API key is shown once at creation and cannot be recovered afterwards. Credentials your workspace registers for a data source (for example, to pull a file from your cloud storage) are stored in the cloud platform's secret manager and referenced by name; their value never passes through the assistant.
3. What we do not do
- We do not use your business data, your usage records or your conversations to train models, ours or anyone else's.
- We do not sell, rent or share your data for advertising.
- We do not read your conversation: the connector receives tool calls, nothing else.
- We do not act on your data without a call from your assistant that you authorised through the consent page and, for every write, confirmed in the host.
4. Retention
| Data | Kept |
|---|---|
| Business data (§2.2) | while the workspace exists; deleted with it, or on request |
| Usage records (§2.3) | 24 months, for billing and audit |
| Technical logs (§2.4) | 90 days at most |
| Authorization codes | 10 minutes; the record of a redeemed code for 30 days, to detect a replay |
| Access tokens | 1 hour (not stored) |
| Refresh tokens | 30 days, or until revoked |
| API keys | until revoked or expired; the hash is kept for audit |
| Dynamically registered host applications | forgotten after 90 days without use |
| Trial workspaces | the trial period (14 days); deactivated 7 days later unless converted, then deleted after notice |
5. Where
The Digital Twin and the connector run on cloud infrastructure in the United States
(AWS, us-east-2) for the hosted service at mcp.oplytec.com; a deployment on another
cloud or region (Google Cloud, Magalu Cloud in Brazil) is a contractual choice of the
customer. Data is encrypted in transit (TLS) and at rest by the cloud provider.
Subprocessors: the cloud provider of the deployment; the AI host application you chose (for example, Anthropic for Claude), which receives the tool results you asked for under its own terms and privacy policy.
6. Security
OAuth 2.1 with PKCE only; permissions scoped per tool and capped by role and plan; secrets stored hashed; least-privilege service roles; a per-caller rate limit and a monthly quota per workspace; every write requires the host's confirmation. Report a vulnerability to security@oplytec.com.
7. Your rights
Under the LGPD (art. 18) and, where applicable, the GDPR, you may ask to access, correct, delete, anonymise or export your personal data, or to revoke a consent. Users of a workspace ask their workspace administrator first (the administrator manages accounts in the Oply console); the administrator, or anyone else, may write to privacidade@oplytec.com. We answer within 15 days.
Disconnecting the connector in your AI host revokes its access at the next token refresh; an administrator revokes an API key in the console, effective within a minute.
8. Changes
We publish changes to this policy at the same URL with a new effective date, and notify workspace administrators by email for material changes.