Octopus mascot logo Octopus
← Back to home

Privacy Policy

Last updated: 2026-06-27

This Privacy Policy explains how Octopus ("we", "us", "our") collects, uses, discloses, and protects personal data when you use our website and application (the "Service"). It also describes your privacy rights and how to exercise them.

1. Controller and Contact

Data controller: INSALABS SARL (RNE: 1986144C), Immeuble Tamayouz, Bureau A1, Centre Urbain Nord, 1082 El Menzah, Tunis, Tunisia.
Privacy contact: contact@octopus-agent.com
Legal contact: contact@octopus-agent.com

2. Personal Data We Collect

Depending on how you use the Service, we may process:

  • Account data: email address, hashed password, account confirmation status, login/session tokens.
  • Profile data: first/last name, phone, location, links (for example LinkedIn/portfolio), and user settings.
  • Application workflow data: job title, company name, job description, recipient emails, generated drafts, and status metadata.
  • Uploaded files: resumes and related files you submit for processing.
  • Billing data: credit balance, purchase history, and payment references from payment providers (we do not store full card numbers).
  • Technical and log data: IP-derived diagnostics, browser/device metadata, request logs, and security events.
  • Support and communications: messages you send to us and related records.

3. Purposes and Legal Bases

Processing is conducted in accordance with Tunisian Law n°2004-63 of 27 July 2004 on personal data protection (supervised by the INPDP), and where applicable, GDPR Article 6.

  • To provide the Service (account creation, authentication, core features): performance of a contract.
  • To process your content (AI-assisted drafting, PDF generation, workflow automation): performance of a contract.
  • To process credit purchases and payments: performance of a contract and legal obligations.
  • To secure and monitor the Service (fraud prevention, abuse prevention, incident response): legitimate interests.
  • To communicate service notices (account, transactional, policy updates): performance of a contract and legitimate interests.
  • To comply with law (tax, accounting, legal requests): legal obligations.
  • Where required, for optional activities: your consent.

4. AI Processing Notice

Some features require sending selected user-provided text or files to AI providers for content generation and transformation. You control what content you submit. We advise against submitting unnecessary sensitive personal data.

5. Recipients and Processors

We may share data with processors that help operate the Service, such as:

  • Cloud hosting and infrastructure providers
  • AI model providers used by configured product features
  • Email service providers
  • Payment processors (Flouci — Kaoun SARL, authorized by the Banque Centrale de Tunisie)
  • Storage providers (including object storage used for file uploads)
  • Product analytics and error monitoring (PostHog, hosted in the EU)

We use contracts and safeguards with processors in line with applicable data protection law, including GDPR Article 28 where applicable.

6. International Data Transfers

Your data may be processed in countries outside your own jurisdiction. Where required, we use appropriate transfer safeguards, such as adequacy decisions, Standard Contractual Clauses, or equivalent legal mechanisms.

7. Data Retention

We keep personal data only as long as necessary for the purposes above, including:

  • Account and profile data: while your account is active, then deleted or anonymized when no longer needed.
  • Application and generated content data: retained while your account is active, unless you delete it sooner.
  • Billing and transaction records: retained as required by accounting, tax, and legal obligations.
  • Security and audit logs: retained for a limited period necessary for abuse prevention and incident analysis.

8. Your Privacy Rights

Subject to applicable law, you may have rights to:

  • Access your personal data
  • Correct inaccurate data
  • Delete data (right to erasure)
  • Restrict or object to certain processing
  • Data portability
  • Withdraw consent where processing is consent-based
  • Lodge a complaint with a supervisory authority — in Tunisia: INPDP (Instance Nationale de Protection des Données Personnelles), inpdp.nat.tn

To exercise rights, contact contact@octopus-agent.com. We may request verification of identity before completing sensitive requests.

9. Cookies and Similar Technologies

We use essential cookies and local storage for authentication, session continuity, security, and core app functionality. We measure product usage and errors with PostHog without cookies or local storage. If we introduce non-essential analytics or marketing cookies, we will provide appropriate notice and consent controls where legally required.

10. Security

We implement technical and organizational measures designed to protect personal data, including access controls, encryption in transit, credential safeguards, and monitoring. No system can be guaranteed 100% secure, but we continuously improve security controls.

11. Children

The Service is not intended for children under 18, and we do not knowingly collect personal data from children. If you believe a child has provided data, contact us so we can take appropriate action.

12. Automated Processing

We use automated systems to assist with content generation and workflow recommendations. These features are support tools and should be reviewed by users before action is taken. We do not use solely automated decisions to produce legal effects about users in the ordinary operation of this Service.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a revised "Last updated" date. For material changes, we may provide additional notice (for example by email or in-app notice).

14. Contact

Privacy requests and questions: contact@octopus-agent.com