Privacy Policy

1. Who We Are

LI Internal Operations Pty Ltd ("LI", "we", "us", "our") operates the OMS (Order Management System), a proprietary software platform for order management, inventory, device registration, and logistics coordination. LI is the data controller for personal information processed through the OMS.

The OMS is deployed across three AWS regions: AU (ap-southeast-2, primary), US, and EU. Data residency rules are enforced per region — EU data is isolated to the EU deployment exclusively.

2. Information We Collect

2.1 Account & Identity Information

When you are onboarded to the OMS, we collect and store:

• • Full name
• • Work email address
• • Company or organisation name
• • Assigned role and access scope (e.g. ops_admin, contract_mfg_user)
• • For Internal Users: your Google Workspace identity, authenticated via Google SSO restricted to @internal-ops.io accounts
• • For External Users: your device UUID and the SHA-256 public key fingerprint of your registered device

2.2 Device & Network Information

The OMS uses a PKI-based device registration system. When you register a device:

• • A device UUID (generated locally on your device) is recorded
• • Your device's RSA public key is stored; your private key never leaves your device
• • The last-seen timestamp for each device is maintained in real time
• • For External Users, a cryptographic Network Fingerprint Hash of your registered WiFi/LAN network is recorded alongside a user-provided plain-language network description

2.3 Customer Information (Operational)

The OMS syncs minimal customer records from connected CRM and payment systems (Stripe, HubSpot, WooCommerce) for order fulfilment purposes. We store:

• • An internal OMS customer ID (e.g. cus_7f3k…21e)
• • An external CRM reference ID (e.g. hs_442091, wc_88213)
• • Region and integration source
• • No customer names or email addresses are stored in the OMS — these are fetched on-demand from the CRM only when required (e.g. for document generation) and are not persisted

2.4 Usage & Platform Data

The OMS automatically records platform usage data for security, compliance, and operational purposes. See Section 4 for full details.

3. How We Use Your Information

We use the information we collect exclusively for:

• • Authenticating and authorising your access to the OMS
• • Fulfilling purchase orders, managing inventory, and coordinating logistics
• • Operating the PKI device-registration and network-fingerprint verification systems
• • Generating and delivering transmittal documents, packing slips, and commercial invoices
• • Maintaining the immutable audit log required for regulatory compliance
• • Providing system health monitoring and incident response
• • Complying with our legal obligations under applicable law

We do not sell, rent, or share your personal information with third parties for marketing or advertising purposes.

4. Monitoring, Logging & Online Presence

By accessing the OMS, you consent to the following monitoring and recording activities, which are a fundamental part of how the platform operates:

4.1 Real-Time Online Presence

The OMS uses Phoenix Presence (Elixir) to track which registered devices and user accounts are currently connected. This means LI's authorised operations staff can see your online/offline status in real time while you are using the platform. Presence data is scoped to the OMS session and is not exposed to other users outside your organisation.

4.2 Immutable Audit Log

Every action performed through the OMS is written to an immutable audit log. Audit log entries cannot be modified or deleted — no update or delete path exists in the system. Logged events include:

• • State transitions on purchase orders, inventory units, and devices
• • Device approval and rejection decisions
• • Document generation and print job submissions
• • GDPR erasure operations
• • Role changes and user management actions
• • Token and credential access events
• • Superuser actions (logged separately under row-level security)

Audit logs are retained for a minimum of seven (7) years, based on the AU ASIC baseline applied globally. EU audit logs additionally comply with GDPR Article 5 storage limitation principles.

4.3 Activity Log

A separate activity log records user interactions such as page views and modal opens. This log captures the actor and the section accessed, but does not capture personal information entered into forms. Activity logs are retained on a quarterly rolling basis.

5. Security & Encryption

LI implements multiple layers of security to protect your personal information:

Despite these measures, no system is completely secure. You are responsible for maintaining the security of your own credentials and registered device. Please notify us immediately at privacy@li-ops.io if you suspect unauthorised access.

6. Data Retention

7. Third-Party Integrations

The OMS integrates with the following third-party services. Each integration is limited to the data strictly necessary for its purpose:

LI does not transfer personal information to any other third party without your explicit consent, except where required by law.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

To exercise any of these rights, contact our Privacy Officer: privacy@li-ops.io. We will respond within 30 days.

9. Children's Privacy

The OMS is a business-to-business platform and is not directed at, or intended for use by, individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. We will notify you of material changes via the OMS notification system or by email at least 14 days before the change takes effect. Continued use of the OMS after the effective date constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact: