Snapshot 227808
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Privacy Notice ON THIS PAGE About Optro Optro’s business model What does this Privacy Notice Cover? Quick Links How we collect and use your personal data Use of Artificial Intelligence Disclosing your personal data Protecting your personal data Transferring your personal data internationally Retaining your personal data Certifications Minors Your privacy rights Contact Information Changes to this Privacy Notice INFORMATION FOR CALIFORNIA RESIDENTS Make Us A Preferred Source About Optro Optro’s business model What does this Privacy Notice Cover? Quick Links How we collect and use your personal data Use of Artificial Intelligence Disclosing your personal data Protecting your personal data Transferring your personal data internationally Retaining your personal data Certifications Minors Your privacy rights Contact Information Changes to this Privacy Notice INFORMATION FOR CALIFORNIA RESIDENTS The Privacy Notice was last updated on: October 30, 2026 At Optro, Inc, (formerly AuditBoard, Inc.), we are committed to respecting your privacy. A reference in this Privacy Notice to “Optro”, “we”, “us”, or “our” is a reference to Optro, Inc. About Optro Optro is a leading provider of risk management applications for audit, risk and compliance professionals. This means Optro customers - companies and organizations - use our software applications to manage enterprise, assurance and compliance risks. To learn more about Optro products, visit our Product page. Optro’s business model We operate a Software-as-a-Service (SaaS) business model for enterprise customers, meaning we do not sell our customers’ users’ data or monetize that data by selling advertising. Instead, we sell subscriptions to our services. Our customers control the data they and their end users put into our services and how it is used. How we use and disclose our customer representatives’ data is described in more detail below. If you use the Optro platform as part of your business or you are an entity that has an agreement with Optro (collectively, an “Organization”), that Agreement will govern as between Optro and the Organization in the event of any overlap or conflict with this Privacy Notice. Nothing in that Agreement limits the rights available to you as an individual under applicable data protection law. What does this Privacy Notice Cover? Some data protection laws in various jurisdictions distinguish between “controllers” and “processors” of personal data. While other jurisdictions may use different terminology, the concept typically remains the same. A controller decides why and how to process personal data. A processor only processes information on behalf of a controller based on the controller’s instruction and pursuant to a governing written contract; the processor does not make decisions about personal data. Optro may be either a controller or a processor depending on the scenario. This Privacy Notice applies when Optro is the data controller of your personal data (unless a different Optro privacy notice is displayed when we collect your personal data), and explains how Optro collects, uses, and shares your personal data for its own purposes. This Privacy Notice may apply to you when you: Visit an Optro website, including https://optro.ai/, that links to this Privacy Notice Interact with Optro as a representative of a company that has (or is considering) a business relationship with Optro (e.g., you are a customer or our service provider) Create or use an account offered directly by Optro (as opposed to an account offered by our customers) Register for or attend an Optro marketing, learning, or training event or webinar Visit Optro’s Partner Portal Provide us feedback about our products or services (e.g., user research surveys and interviews) Receive sales or marketing communication from us, including emails or telephone calls This Privacy Notice does not cover how we process personal data on behalf of our customers as a processor. If you are an employee or an end user of an organization that uses an Optro product or service and you have questions or concerns about the personal data your organization holds in Optro about you (when Optro is a processor), please direct your request to that organization. Optro cannot respond directly to your request. If you are an Optro employee or job applicant, information about how we use and protect your information is communicated to you in a separate notice. If you have any questions or concerns about our use of your personal data, then please contact us using the Contact Information provided at the bottom of this Privacy Notice. Quick Links We recommend that you read this Privacy Notice in full to ensure you are fully informed; however, if you only want to access a particular section of this Privacy Notice, then you can click on the relevant link below to jump to that section. How we collect and use your personal data Disclosing your personal data Protecting your personal data Transferring your personal data internationally Retaining your personal data Minors Your privacy rights Contact Information Changes to this Privacy Notice How we collect and use your personal data Optro collects and uses your personal data for various reasons. When we do so, we will use it in accordance with applicable laws. Some jurisdictions, including the European Economic Area (“EEA”), the United Kingdom (“UK”), and Switzerland, require a legal basis—a reason why Optro is legally allowed to collect and use your personal data. Below, we describe (1) in what instances we collect your data, (2) the categories of data we collect in those instances, (3) our purposes for collection, and (4) the legal bases for collection. If we need to collect other personal data from you, we will explain which information we need and why at the time we collect it. If we ask you to provide personal data, we will indicate at the point of collection whether the provision of that data is required by law or by contract (including where it is necessary to enter into a contract with you), or whether the provision of personal data is voluntary. Where the provision of personal data is required, we will explain the possible consequences of not providing it (for example, that we may be unable to process your enquiry, provide you with access to our services, or consider your job application). Where it is voluntary to provide personal data, there will be no adverse consequences if you choose not to provide it, although some features or services may not be available to you. Information provided by you Sometimes, we may ask you to provide personal data voluntarily; for example, we may ask you to provide your contact details to create an account with us (Optro Community), to subscribe to marketing communications from us, and/or to submit inquiries to us. In some cases, we may combine the information you provide. Information collected automatically We also collect certain information related to your use of our websites. In some jurisdictions in the United States and countries in the EEA, the UK, and Switzerland, this information may be considered personal data under applicable data protection laws. We may combine this information with personal data provided by you. In particular, we collect the following personal data from you automatically: Information obtained from other sources We also collect information about you from other sources including third parties, individuals at your company, or publicly available sources. We may combine this information with personal data provided by you. Specifically, we collect personal data from the following other sources: Use of Artificial Intelligence We use artificial intelligence (AI) tools, including third-party AI services, to support our business operations. For example, to offer our website chatbot service, to transcribe and summarize calls, meetings, and demos; to draft, personalize, and improve our communications; to analyze feedback and research responses; and to organize, enrich, and prioritize records relating to our business relationships, including with the help of third party data enrichment providers. Where we use AI for these activities, we rely on the same legal bases described above for the underlying purpose (for example, our legitimate interests in operating and marketing our business, or your consent where required). We maintain human oversight of these tools and do not use them to make decisions that produce legal or similarly significant effects about you solely by automated means. Disclosing your personal data Optro may share or make accessible your personal data to third parties as follows: Optro Affiliates: Optro may disclose any of the categories of personal data described above to affiliates of Optro where necessary to fulfill a request you have submitted or for customer support, marketing, technical operations, event registration, and account management purposes. Service providers: Optro may disclose the categories of personal data described above to third party service providers or vendors contracted to provide services on our behalf (for example, IT and hosting, data analytics, event services, customer support, call recording, chatbot technology, data enrichment, email fulfillment, and payment services). These third party service providers may use personal data we provide to them only as instructed by Optro, except where required by applicable law to do otherwise. They may not use it to correct or add to their own databases or to provide services to anyone else, but may use it in deidentified or aggregated form that no longer identifies you or Optro, where permitted by applicable law Artificial intelligence service providers: We may make personal data available to third-party AI providers that process it on our behalf and under our instructions to deliver the functions described in "Use of artificial intelligence." These providers are contractually restricted to using the data only to provide services to Optro, are prohibited from using it to train or improve their own models (other than in deidentified or aggregated form that no longer identifies you or Optro, where permitted by applicable law), and are subject to the same security and international-transfer safeguards described in this Notice. Event Sponsors and Partners: When you participate in webinars, events, and other activities where Optro collaborates with third parties such as sponsors and event organizers, we may disclose the information described under “if you register for events and webinars” above, such as your contact information and interests in these offerings or services to these approved third parties to communicate with you. Mobile Information and Opt-In: Notwithstanding any other provision in this Privacy Notice, mobile information, including SMS opt-in data and consent, will not be shared with any third parties or affiliates for marketing or promotional purposes. Optro partners: Optro may share your personal data with certain partners that offer supplementary services to those provided by Optro, such as partners that resell Optro services, to the extent you consent to such sharing (where required by applicable law) or direct us to intentionally interact with such third parties. Advertising: When you visit our website, we may enable third parties to use cookies and other trackers to show you ads on third party websites that are more relevant to you. Please see our Cookie Notice for more information about the types of cookies we use or click “Cookie Preferences” (link located in the footer of our Website) to set your preferences and opt-out of targeted advertising. Where we do so, those third parties may collect identifiers and information about your online activity directly from your browser, and this may constitute a sale or sharing of personal data for targeted advertising under certain state privacy laws. Additional disclosures: Optro may disclose personal data if we have a good faith belief that such action is necessary to (a) conform to legal requirements or comply with legal processes; (b) establish, exercise or defend legal claims; and/or (c) act to protect the interests of our users or others. If Optro goes through a business transition, such as a merger, restructuring, acquisition by another company, or sale of all or a portion of its assets, your personal data may be among the assets transferred. Optro may also ask for your consent to disclose your information to other unaffiliated third parties that are not described elsewhere in this statement. Optro does not sell personal data for monetary consideration. To the extent our use of advertising cookies and similar technologies constitutes a sale or sharing of personal data for cross context behavioral advertising under applicable state privacy laws, you may opt out at any time as described under “Exercising your Privacy Rights” below. Protecting your personal data Wherever your personal data may be held with Optro, we take appropriate technical and organizational measures to protect personal data from unauthorized access or disclosure. Optro uses commercially reasonable security measures to protect against the loss, misuse, and alteration of your information under our control based on the type of personal data and applicable processing activity, such as data encryption, and enforcement of least privilege and need-to-know principles. We train our employees on data handling practices. We believe the security of your information is a serious issue and we are committed to protecting the information we receive from you. Although Optro complies with its legal obligations with respect to security of your personal data and while we attempt to ensure the integrity and security of personal data, please note that no method of transmission over the internet, or method of electronic storage, is completely secure. Please note that data that is transported over an open network, such as the internet or e-mail, may be accessible to anybody. We cannot guarantee the confidentiality of any communication or material transmitted via such open networks. When disclosing any personal data via an open network, you should remain mindful of the fact that it is potentially accessible to others, and consequently, can be collected and used by others without your consent. Transferring your personal data internationally Optro operates as a global business and complies with applicable legal requirements when we need to transfer, store or process your personal data in a country outside your jurisdiction. We take appropriate safeguards to protect your privacy, your fundamental rights and freedoms, and the ability to exercise your rights. For example, if we transfer personal data from the EEA, the UK, or Switzerland to another country such as the United States, we will implement an appropriate data transfer solution such as entering into “standard contractual clauses” approved by the European Commission or competent governmental authority (as applicable) with the data importer. Following the adequacy decision by the European Commission, Optro currently relies on the EU-U.S. Data Privacy Framework and the UK Extension and the Swiss-U.S. Data Privacy Framework as legal bases for transfers of personal data from the EU, UK, or Switzerland to the United States. Where the EU-U.S. Data Privacy Framework, the UK Extension or the Swiss-U.S. Data Privacy Framework is no longer an applicable as a transfer mechanism, Optro will implement an appropriate data transfer solution such as entering into “standard contractual clauses” approved by the European Commission or competent governmental authority (as applicable) with the data importer. For more information, see the Certifications subsection below or our Data Privacy Framework Notice here. Note that the transfer of personal data is also subject to applicable export control laws. Retaining your personal data Optro will retain personal data we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with the Service you have requested or to comply with applicable legal, tax or accounting requirements). At the end of any such period, we may continue to retain a copy of your personal data for the duration of: (a) any applicable limitation period under applicable law (i.e., any period during which any person could bring a legal claim against us in connection with your personal data, or to which your personal data are relevant); and (b) an additional six (6) month period following the end of such applicable limitation period (so that, if a person brings a claim at the end of the limitation period, we are still afforded a reasonable amount of time in which to identify any personal data that are relevant to that claim), and (c) if any relevant legal claims are brought during the periods noted above, we continue to process personal data for such additional periods as are necessary in connection with that claim. When we have no ongoing legitimate business need to process your personal data, and no ongoing limitation periods or legal claims, we will either delete or anonymize it or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible. Optro’s Service features allow customers who are authorized users to determine their own policies regarding storage, access, modification, deletion, sharing, and retention of personal data. Customers should regularly check with the admin of the services for your company about the policies and settings it has in place. Notwithstanding the foregoing, we may retain personal data for longer periods only if such retention is required or necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule, or regulation. Where we deidentify personal data, we maintain and use it in deidentified form and do not attempt to reidentify it, except as permitted by applicable law to test whether our deidentification processes are effective. Certifications Data Privacy Framework. Optro adheres to the principles of the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Optro relies on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF as a legal basis for transfers of personal data. To learn more, visit our Data Privacy Framework Notice here. In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Optro commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commission and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF. Minors Optro’s products and services (including our website) are not directed to individuals under the age of 18. We do not knowingly collect personal data from children under 18. If we become aware that a child under 18 has provided us with personal data, we will take steps to delete such data. If you become aware that a child has provided us with personal data, please contact us at privacy@optro.ai. Your privacy rights Depending on where you are located and how you interact with Optro, you may have certain legal rights over the personal data we process about you, subject to local privacy laws. These may include the right, depending on your jurisdiction, to: Obtain information about and access the personal data we process about you Request correction of your incorrect personal data Request the deletion of your personal data Request restriction of the processing of your personal data Opt out of disclosures to third parties or for a purpose materially different from the purpose(s) for which your personal data was originally collected Object to the processing of your personal data carried out on the basis of our legitimate interests or for direct marketing purposes Receive a copy of your personal data in a structured, commonly used, and machine-readable format Request that your personal data that you provided to Optro be transferred to another controller in a structured, commonly used and machine-readable format Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects or otherwise significantly affects you (“Automated Decision-Making”) Opt out of marketing communications at any time. You can update your email subscription settings by clicking on the “Manage your Subscriptions” link in marketing emails we send you or by visiting https://resources.optro.ai/preferences-center.html Complain to a regulator or data protection authority about our collection and use of your personal data. For more information, please contact your local data protection authority Withdraw your consent, where we rely on consent as our legal basis for processing your personal data. Such withdrawal does not affect the lawfulness of any processing performed prior to the date on which we receive notice of such withdrawal, and does not prevent the processing of your personal data in reliance upon any other available legal bases in accordance with applicable law. Exercising your Privacy Rights To exercise your rights with respect to information covered by this Privacy Notice, please submit a request via the Privacy Preference Center or contact us using the contact details at the bottom of this Privacy Notice. Optro may ask you for additional information so that it can verify your identity. Optro will take steps to verify your identity, including validating your name and the email you use when interacting with Optro. You may also authorize another person or third party to submit a request to exercise your rights by providing written permission in conjunction with the submission of the requested information or by giving the third party your power of attorney. We will acknowledge your request within 10 business days and provide a substantive response within 45 days. Where permitted by applicable law we may extend that period once by a further 45 days. In the event that Optro needs an extension to fulfill a request, we will notify you. If we deny your request, we will provide reasons for that denial. If we decline your request, you may appeal that decision by replying to our response or by contacting us using the details at the bottom of this Privacy Notice. We will respond to your appeal in writing within 45 days. If we deny the appeal, we will explain why and tell you how to submit a complaint to your state attorney general. You may opt-out of the sale or sharing of your personal data for targeted advertising by clicking the “Cookie Preferences” link in the footer of our Website and opting out of the Functional and Advertising Cookies, or by implementing the Global Privacy Control (GPC). For instructions on how to download and use GPC, please visit https://globalprivacycontrol.org. See our Cookie Notice for more information. Optro will not discriminate against you for exercising your rights. Optro does not make decisions based solely on automated processing that produces legal or similarly significant effects as part of the processing activities covered by this Privacy Notice. If your personal data has been submitted to us by or on behalf of an Optro customer and you wish to exercise any rights you may have under applicable data protection laws, please inquire with the applicable customer directly. Lodging a complaint. You may lodge a complaint with a data protection authority such as the supervisory authority of your usual place of residence. A full list of EEA data protection authorities is available here. Alternatively, you may request the details of your competent data protection authority by using the contact details at the bottom of this Privacy Notice. Contact Information Please contact us if you have any questions/comments about this Privacy Notice or any of our privacy practices, or you wish to exercise your rights. You can contact Optro's Data Protection Officer at privacy@optro.ai or by mail at: Optro, Inc. Attention: Privacy 103 Foulk Road, Suite 202 Wilmington, DE 19803, USA Toll Free: 1 (877) 769-5444 If you have an unresolved privacy or data use concern that we have not addressed satisfactorily or you wish to appeal, please contact any of the following: EU Data Protection Authorities (DPAs) - https://www.edpb.europa.eu/about-edpb/about-edpb/members_en UK Information Commission - https://ico.org.uk/make-a-complaint/uk-extension-to-the-eu-us-data-privacy-framework-complaints-tool/ Swiss Federal Data Protection and Information Commissioner (FDPIC) - https://www.edoeb.admin.ch/en/model-complaint-form-swiss-us-dpf Singapore Personal Data Protection Commission (PDPC) - https://www.pdpc.gov.sg/individuals/e-services/report-a-data-protection-concern Changes to this Privacy Notice This Privacy Notice may be amended or revised from time to time at the discretion of Optro. Changes to this Privacy Notice will be posted on the website and links to the Privacy Notice will indicate that the notice has been changed or updated. If we propose to make any material changes, we will provide notice in accordance with law prior to the change becoming effective. We encourage you to periodically review this Privacy Notice for the latest information on our privacy practices. INFORMATION FOR CALIFORNIA RESIDENTS Under the California Consumer Privacy Act (the “CCPA”), we must disclose our practices regarding the collection, use, and disclosure of the Personal Information of California Residents. California Residents are also afforded certain rights with regard to the Personal Information we collect about them that include the rights of access, deletion, correction, and to be free from discrimination. This section includes the disclosures required by the CCPA, and describes the rights afforded to California Residents. We also describe the methods by which a California Resident may exercise these rights and some of the statutory exceptions that may apply. The disclosures required by the CCPA are as follows: Categories of Sources of Personal Information: Please refer to Section "How we collect and use your personal data" for details on the sources from which we may collect or obtain Personal Information of California Residents. Collection of Personal Information: Please refer to Section "How we collect and use your personal data" for details on the categories of Personal Information we may collect about California Residents. Use of Personal Information: Please refer to Section "How we collect and use your personal data" for details on how we may use the Personal Information of California Residents. Collection and Use of Sensitive Personal Information: We use and disclose sensitive personal information only for purposes permitted under the CCPA without a right to limit, as described in the section “Information collected automatically” above. Selling or Sharing of Personal Information: We do not sell Personal Information for monetary consideration, and we do not knowingly sell or share the Personal Information of consumers under 16 years of age. To the extent our use of advertising cookies and similar technologies constitutes a sale or sharing of Personal Information for cross context behavioral advertising, you may opt out as described below. Retention of Personal Information: Please refer to Section “Retaining your personal data” for details on how we may retain the Personal Information of California Residents. If you are a California Resident, the CCPA grants you the following rights regarding your Personal Information: Right to Know: California Residents have the right to request that we disclose the categories of Personal Information that we collect, use, disclose or sell about you. You may also request the specific pieces of Personal Information that we have collected about you. Right to Request Deletion of Personal Information: California Residents have the right to request that we delete any Personal Information that we have collected from or about you. However, we may retain Personal Information as authorized under the CCPA or other applicable law, such as Personal Information required to provide our services, to protect our business and systems from fraudulent activity, to debug and identify errors that impair existing functionality, to comply with legal obligations, to comply with law enforcement requests pursuant to lawful process, for scientific or historical research, for us or others to exercise free speech or other rights, or for our own internal purposes reasonably related to your relationship with us. Right to Correct: California Residents have the right to request that we correct inaccurate Personal Information that we maintain about you, taking into account the nature of Personal Information and the nature of Processing. However, we are not required to comply with a request to correct where we have a good-faith, reasonable, and documented belief that a request is fraudulent or abusive, or if we have determined based on the totality of the circumstances, that the contested Personal Information held by us is more likely than not accurate and therefore does not require correction. Right to Opt Out: California Residents have the right to opt out of the sale or sharing of their Personal Information for cross context behavioral advertising. You may exercise this right by clicking the “Cookie Preferences” link in the footer of our website or by enabling the Global Privacy Control, as described under “Exercising your Privacy Rights” above. Right to Non-Discrimination. California Residents have the right to not be discriminated against for exercising their CCPA rights. We will not “discriminate” against you for exercising your CCPA rights as we understand that term to be defined by the CCPA and its implementing regulations. Authorized Agent. Under the CCPA, you may appoint an authorized agent to submit requests to exercise your rights on your behalf. Should you choose to do so, for your and our protection, we will require your authorized agent to provide us with signed permission demonstrating they are authorized to submit a request on your behalf. We note, should your authorized agent fail to submit proof that they have been authorized to act on your behalf, we will deny their request. To exercise your rights under the CCPA, please submit your request through the Privacy Preference Center or by email at: privacy@optro.ai or by mail at Optro, Inc., Attention: Privacy, 103 Foulk Road, Suite 202, Wilmington, DE 19803, USA. Generally, in order to verify your requests to exercise your rights, we will compare the Personal Information we have about you to pieces of Personal Information we will request in the course of processing your request. The Personal Information required for verification may include your name, email address, phone number, or postal address. We will deliver a response to you within 45 days of receiving your verifiable California Resident request.