Privacy Policy

Operating Library provides industry SOP libraries and client workspaces for consultants, agencies and business owners. It is run by Stockhound Pty Ltd (ABN 79 662 195 888), an Australian company founded by Benjamin Fowler. In this policy, “we”, “us” and “our” mean Stockhound Pty Ltd, trading as Operating Library.

This policy explains how we collect, use, share and protect personal information when you visit operatinglibrary.com, contact us, create an account, take a free sample, buy a licence or subscription, use client workspaces, or respond to a review link that a consultant sends you.

For any privacy question or request, email hello@operatinglibrary.com.

Enquiries. When you contact us or submit a form, we receive your name, email address, organisation, role, phone number if you give one, and your message.

Your account. Your name and email address, how you sign in (for example with a Google account, or an email address and password), which our sign-in provider Clerk handles, the industry you choose for a free sample, your sessions, and the licences, releases and subscription linked to your account.

Purchases. Payments are processed by Stripe. We receive your name, email address, the billing details needed for tax, what you bought, the amount and the payment reference. We never see or store your full card number.

Client workspaces. When you use a workspace, you may enter information about your client: their business details, the names, job titles, email addresses, departments and photos of their staff, their tools and branding, workshop notes, and the changes you make to SOPs.

Review links. If a consultant sends you a review link, we record your responses to the SOPs you are shown (confirmations, flags, comments and timings) with the date and the name the consultant gave us for you.

Technical information. Our servers and service providers log IP addresses, browser and device details, the pages requested and errors, so we can run, protect and fix the service.

Please do not put sensitive information, such as health records, financial account numbers or government identifiers, or payment card details into enquiries, SOP edits or workspace notes.

We use personal information to:

Provide what you ask for: the library, your account, free samples, client workspaces and the documents you export.

Take payments and keep the purchase, tax and accounting records the law requires.

Send service emails: sign-in and verification codes, receipts, review invitations and reminders you ask us to send, and important notices about your account.

Keep the service secure: limiting repeated requests, preventing misuse, recording changes in an audit log and keeping backups.

Answer enquiries and support requests, and improve the library and the service using aggregated or de-identified information.

Where the GDPR or UK GDPR applies, we rely on performing our contract with you, our legal obligations, and our legitimate interests in running a secure, reliable service. Where we rely on consent, you can withdraw it at any time.

We do not sell personal information, and we do not make decisions with legal or similarly significant effects about you by automated means alone. We use limited information to measure and improve our own advertising on Facebook and Instagram, as section 7 explains. When you create a free account, we send you a short series of emails about using the library, and occasional news such as new industries and pricing changes. Every one lets you unsubscribe, and records whether it was opened and which links were clicked, so we can improve them.

A client workspace can suggest wording that fits an SOP to your client. When you ask for a suggestion, we send the SOP text and part of the client’s profile (their name, size, location, tools, and the job title and names of the people in each role) to Anthropic, which provides the Claude AI model, so it can return the suggestion. We do not send staff email addresses or photos.

Anthropic processes this under its commercial terms for business customers, which do not allow it to use the content to train its models. A suggestion only changes an SOP if you accept it. If a client’s information should not be processed this way, do not request suggestions in that client’s workspace.

For the information you enter about your clients and their staff, you decide what to collect and why, and we process it on your behalf to provide the workspace. In privacy-law terms, you are responsible for that information (as the controller or the entity that collected it), and we act as your processor or service provider.

You are responsible for having a lawful basis to share it with us and for telling the people concerned, for example that their names and roles will appear in SOPs and review links. We use it only to provide and secure the service and as you instruct, and we help you respond to requests from the people it is about.

You can export a workspace at any time and erase a client’s personal information from it.

Service providers who help us run Operating Library: hosting and backups (Amazon Web Services, in the United States), sign-in (Clerk), email delivery (Resend) and our own mailboxes (Google Workspace), email marketing (Customer.io, in the United States), payments (Stripe), website hosting and forms (Webflow), AI suggestions (Anthropic), and content delivery networks that serve fonts and scripts. They may use the information only to provide their services to us. We also share the advertising information described in section 7 with Meta Platforms, which uses it under its own terms and privacy policy to measure and deliver our ads.

People you choose. Client staff you send review links to see the SOPs and names those links cover. Teammates you add can work on your clients, and contractors see only the clients they are given.

Legal and safety. We disclose information where the law requires it, to protect people’s rights and safety, or as part of a sale or restructure of the business, in which case this policy continues to apply.

Our providers may process information outside your country, including in the United States and Europe. Where the law requires it, we use recognised safeguards for these transfers, such as standard contractual clauses.

The library uses essential cookies to keep you signed in: one of its own, and those of Clerk, our sign-in provider. It also uses your browser’s storage for things like saved packs and preferences. Stripe’s checkout page uses its own cookies to take payments and prevent fraud. The website and its providers may use essential cookies for security and to work properly.

To measure and improve our advertising on Facebook and Instagram, the website uses the Meta pixel and our servers use Meta’s Conversions API. They tell Meta when someone views a page, creates a free account, starts a checkout or buys a licence, with the page, IP address, browser, Meta’s own cookies and the ad that was clicked. For accounts and purchases they also send a hashed (scrambled) copy of your email address and account number, which Meta uses to match the event to its users. If your browser is set to a UK or European time zone, we ask first and send nothing unless you accept. We do not use other advertising cookies or third-party analytics. You can clear cookies and site storage in your browser settings, although the library will then sign you out, and you can control how Meta uses this information in your Facebook or Instagram ad settings.

Sign-in verification codes expire within minutes, and signed-in sessions end after a period of inactivity.

Account and licence records are kept while your account exists. Your licence rights are permanent, so we keep the record of what you bought for as long as you might rely on it.

Purchase, tax and accounting records are kept for as long as the law requires, generally up to seven years.

Client workspaces are kept while your account is active. If your subscription ends, workspaces stay read-only and exportable. You can erase a client’s personal information at any time. If you close your account, we delete its workspace data within 90 days, and copies in backups are removed as those backups are replaced.

Enquiries are kept for as long as needed to respond and to keep reasonable business records. Security logs are kept for a limited period, or longer if we need them to investigate an incident.

Information is sent over encrypted connections (HTTPS). Sign-in is handled by Clerk: we never see or store your password, and Clerk keeps passwords only in hashed form. Access to every account, client and document is checked on our servers: contractors see only the clients they are given, and review links cover only the SOPs they were sent for, expire and can be withdrawn. Changes are recorded in an audit log, and data is backed up.

No service can guarantee complete security. If a data breach is likely to cause serious harm, we will notify you and the relevant regulator as the law requires.

Depending on where you live, you can ask to access, correct, export or delete your personal information, object to or restrict some uses, and withdraw consent where we rely on it. To make a request, email hello@operatinglibrary.com. We will verify your identity and respond within 30 days.

If your information sits in a consultant’s client workspace, we will pass your request to them, because they control it, and help them respond.

If you live in California, you have the right to know, delete and correct personal information. We do not sell personal information. Our use of the Meta pixel and Conversions API may count as “sharing” for cross-context behavioural advertising under California law. You can opt out by turning on Global Privacy Control in your browser, which we treat as an opt-out. You will not be treated differently for using any of these rights.

If you are unhappy with how we have handled your information, please contact us first. You can also complain to a privacy regulator: in Australia, the Office of the Australian Information Commissioner (oaic.gov.au); in the United Kingdom, the Information Commissioner’s Office (ico.org.uk); in the European Union, your local data protection authority.

Operating Library is a business service and is not intended for anyone under 18. We do not knowingly collect personal information from children.

We update this policy when our services or practices change, and change the date at the top. If a change materially affects how we use information you have already given us, we will tell account holders by email before it takes effect.