Effective from: 25 September 2026. Version 1.0.
This policy explains what personal data is handled when you use OpiFlex Production Insights and the OpiFlex Production Intelligence Platform, whether through the web dashboard or the mobile app OpiFlex (Android, package ID se.opiflex.opiflex_app). In this policy we refer to them together as the statistics system. The statistics system is published by OpiFlex Solutions AB, company reg. no. 556999-2125, Glödgargränd 3, 721 30 Västerås, Sweden. Privacy questions: support@opiflex.se.
OpiFlex’s page GDPR covers the OpiFlex website and customer contacts. This policy covers the statistics system.
Summary
- The statistics system is used by employees of OpiFlex customers to follow robot cells: status, statistics, alarms, pallets and shift schedules.
- You cannot create an account yourself. Your employer or OpiFlex creates it.
- We store your e-mail address, your hashed password, your settings and what you enter yourself, such as your shift schedule.
- Data is stored on a server in Vienna, Austria (EU). Alarm notifications are sent through Google Firebase.
- No ads, no usage analytics, no crash reporting, no location, no camera, no contacts.
- We never sell personal data.
Who is responsible for your data?
It depends on the data. You can always contact OpiFlex. If your question concerns your employer, we forward it.
| Situation | Who is responsible | Who to contact |
|---|---|---|
| You work for an OpiFlex customer and use the app at work (account, role, schedule, alarm settings, acknowledgements) | Your employer is the controller. OpiFlex processes the data on your employer’s behalf (processor). | Your employer first. You may also e-mail OpiFlex. |
| Security logs and technical logs that protect the OpiFlex service against intrusion and misuse | OpiFlex is the controller. | OpiFlex |
| You work at OpiFlex (for example support) and use the app | OpiFlex is the controller. | OpiFlex |
| Your contact with OpiFlex as a supplier, for example when you e-mail us | OpiFlex is the controller. | OpiFlex |
What data is handled on our server?
| Data | Why | Source |
|---|---|---|
| E-mail address and password (the password is only stored in securely hashed form, never in plain text) | To let you sign in | Your employer or OpiFlex when the account is created |
| Which customer you belong to and your role (viewer or admin) | So you only see your own workplace’s data | Administrator |
| Display name (optional, max 100 characters) | Shown when you acknowledge an alarm or write something | You |
| Sign-in sessions (user ID, created, expires, revoked) | Keep you signed in and allow signing out everywhere | Automatic |
| Firebase push token and the device name “mobile” | Deliver alarm notifications to the right phone | Automatic at sign-in, if you allow notifications. Deleted from the OpiFlex server at sign-out. |
| Alarm acknowledgement: who and when | Show who handled an alarm | You |
| Your shift schedule (working hours, rotation in weeks) | Show “My schedule” and only notify you during your shifts | You |
| Your alarm settings per alarm type and robot, and your own cycle-time deviation threshold | You only get the notifications you want | You |
| Stop reasons you write in the web dashboard (free text) and who wrote them | Explain why a robot stopped | You |
| Security log: event type (e.g. failed sign-in), user ID, customer ID, IP address, details | Detect intrusion and misuse | Automatic |
| Technical log: IP address and user agent | Troubleshooting and security | Automatic |
| Database backups containing copies of the above | Restore the service after a failure | Automatic |
The app also sends its version number. We only count requests per version, not who uses which version.
Please note: do not write sensitive information about yourself or others in the stop reason free-text field, for example about health.
Production data. Data about robots, pallets, cycle times, stops and OEE concerns the machines, not you. At a small site it can sometimes be linked to who was working at a given time. The purpose of the app is to follow the robot cells, not to assess individuals. OpiFlex only uses production data for troubleshooting when providing support.
What is stored on your phone?
The app stores the following in its own private storage. Other apps cannot access it.
- Server address, language, theme, refresh interval and last selected customer.
- Session cookies for sign-in. No passwords.
- A temporary copy of screens you have already viewed, so the app works offline. It has a maximum age and size and is deleted when you sign out.
- A list of shown notifications: time, type and alarm ID. No names and no alarm texts.
- Your recent searches per customer.
App data is excluded from Android backup. The app only communicates over encrypted connections (HTTPS).
This storage is strictly necessary for the service you asked for, so no consent is requested (Swedish Electronic Communications Act, chapter 9, section 28, implementing the ePrivacy Directive).
Export. You can export statistics to a CSV file and share it using Android’s share menu. The file goes where you choose. From then on you, or your employer, are responsible for it.
Permissions
Besides internet access, the app only asks for permission to show notifications (Android 13 and later). The request comes after sign-in. You can decline and change it later in your phone settings. No push token is then registered and you receive no alarm notifications, but the app otherwise works.
Alarm notifications and Google Firebase
Alarm notifications are sent through Google Firebase Cloud Messaging (Google Ireland Ltd and Google LLC). Firebase is used only for notifications. Firebase receives:
- the phone’s push token and an installation ID created by Firebase,
- the notification itself, which only contains an alarm ID. No name and no alarm text. The app fetches the text from the OpiFlex server.
Google processes this data on OpiFlex’s behalf under the Firebase Data Processing and Security Terms, which OpiFlex has accepted. Google Analytics is not used. Firebase may process data outside the EU, including in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, and Google’s Standard Contractual Clauses also apply.
Who can access the data?
- Your employer’s administrators, who can create new accounts and reset passwords. They cannot see other users’ schedules or settings.
- Other users at your workplace see your display name on acknowledgements and stop reasons.
- Authorised OpiFlex staff, who need it for operations, support or security. Access is limited to a small number of designated employees bound by confidentiality.
- netcup GmbH (Germany), which runs the server in Vienna. It processes data only on OpiFlex’s behalf, under a data processing agreement.
- Google (Firebase), for notifications, see above.
- Authorities, where required by law.
No one else receives personal data. We never sell it, use it for advertising or marketing, or share it with other OpiFlex group companies.
How long is data kept?
For data where your employer is the controller, the retention periods your employer has set in its agreement with OpiFlex apply. The table shows the periods that apply unless otherwise agreed.
| Data | Retention |
|---|---|
| Push token | Deleted from the OpiFlex server at sign-out or when switching customer. Unused tokens are deleted after 90 days. |
| Account, role, display name, settings, schedule | As long as the account exists. Accounts unused for 12 months are deleted. |
| Sessions | 90 days after expiry or revocation. |
| Alarm acknowledgements | As long as your employer is an OpiFlex customer. |
| Technical log (IP, user agent) | 90 days. |
| Security log | 12 months. |
| Backups | 18 months. Stored with netcup in the EU. |
| Data held by Firebase (installation ID) | Stored by Google under Google’s Firebase terms. Google does not receive your name or e-mail address. |
| All data for a customer | Deleted no later than 90 days after the customer’s contract ends. Copies in backups disappear after 18 months at the latest. |
How is data protected?
- Encrypted connection (TLS) between app and server.
- Passwords are never stored in plain text, only in securely hashed form.
- Each customer’s data is kept separate in the database.
- Role-based access.
- Rate limiting of sign-in attempts.
- Security logging.
- Sessions can be revoked, so you can be signed out everywhere.
Your rights
You have the right to access your data and get a copy, to have errors corrected, to have data erased, to restrict processing and to object to processing based on legitimate interest. In some cases you can receive your data in a machine-readable format.
If your question concerns your work account, contact your employer first. You can also write to support@opiflex.se. We reply within one month.
You can change your display name, schedule and alarm settings directly in the app. You can also change your password there. If you have forgotten your password, contact your administrator.
Delete your account
Request deletion by e-mailing support@opiflex.se from the address the account uses, with the subject “Delete my account”.
When the account is deleted we overwrite your e-mail address and password hash, end all sessions, remove push tokens and anonymise your name in alarm acknowledgements. Display names and stop reasons you wrote are also removed. Production history about the robots remains, without any link to you. Deletion is completed within 30 days. Copies in backups disappear when backups are deleted, at the latest after 18 months.
If it is a work account, we check with your employer before deleting, since your employer is responsible for it.
Legal basis where OpiFlex is the controller
- Security log and technical log: legitimate interest in protecting the service and its users against intrusion and misuse (GDPR Art. 6(1)(f)).
- OpiFlex’s own staff: to perform the employment and support customers (Art. 6(1)(b) and (f)).
- Contact with OpiFlex as a supplier: legitimate interest in managing the customer relationship (Art. 6(1)(f)).
Where your employer is the controller, your employer determines the legal basis and must inform you.
Children
The statistics system is designed for professional use and is not directed at children.
Changes
We update this policy when the statistics system changes. The date and version are shown at the top. For major changes we inform our customers, who inform their users.
Complaints
If you are unhappy with how your data is handled, please contact us first. You may also contact the Swedish Authority for Privacy Protection (IMY), imy.se, or the data protection authority where you live or work.
Recent Comments