Who we are
KinetiX is operated by Opex Consulting Group (“OpexCG”, “we”, “us”), based in Singapore. You can reach us at marketing@opexcg.com.
Our role depends on the data:
- Website enquiries and administrator sign-in. We decide why and how this data is used, so we are responsible for it.
- Data in your Epicor. When someone uses KinetiX, it reads that person’s Epicor data on their behalf. The company that owns the Epicor instance decides what is in it and who may use KinetiX on it. We handle that data only to answer requests the user makes, as described below.
The sections below describe what the product does today. Where we say “KinetiX server” we mean the Cloudflare Worker that serves this site, the chat at /chat, the sign-in at /authorize, the MCP endpoint at /mcp and the administrator page at /admin.
What we collect, and why
| Where | What we receive | Why |
|---|---|---|
| This website | Standard request data that Cloudflare processes to serve a page: IP address, browser type, requested address and time. | To deliver and protect the site. |
| Contact form | Name, work email, company, plan, your message, and optionally your role and Epicor version or notes. Your IP address is used to count attempts for rate limiting. | To reply to your enquiry and set up a Pilot. |
| Administrator sign-in | The email address, a one-time code (we keep only a hash of it), and a session token. | To confirm that the person signing in to /admin is on the allow list. |
| Epicor connections | A connection name and id, the Epicor REST address, the company id, and the API key, username and password the administrator enters. | So people can choose a connection, and KinetiX can call that Epicor instance. |
| Signing in to chat, the side panel or an MCP client | The Epicor username and password you type on KinetiX’s sign-in page, the connection you chose, the access you approved (read, or read and write), and the name of the app that asked. | To check the login against your Epicor, and to act as you in Epicor. |
| Chat and side panel | Your messages, the Epicor lookups the assistant runs, and the results Epicor returns. Your Epicor username and company id are added to the model’s instructions. | To answer your question and prepare changes for your approval. |
| Chrome extension | The address and title of the active tab, but only when it is a Kinetic page. The Kinetic view id and page title are then sent with your questions. | So “this order” or “this part” can mean the screen you have open. |
| MCP clients | The requests an MCP client such as Claude or ChatGPT makes to /mcp, and the Epicor results we return to it. | To run the Epicor tools you approved for that client. |
We do not sell personal information. The site has no advertising and no newsletter sign-up.
The epi command-line tool runs on your own machine and talks to Epicor directly. It does not send data to the KinetiX server.
How the assistant uses AI
The chat and side panel use a language model on Cloudflare Workers AI. The model is @cf/moonshotai/kimi-k2.6 unless we configure another one. For each turn, the KinetiX server sends the model:
- instructions that include your Epicor username, the company id and today’s date, and the Kinetic screen name and title when the extension supplies them;
- the conversation so far (up to the 60 most recent messages), held in your browser and sent back with each request;
- the results of Epicor lookups, cut to 8,000 characters each. These can contain whatever your Epicor user is allowed to see, including personal data about your customers, suppliers and staff.
Your Epicor password and API key are never put in the model’s instructions. The model can only ask KinetiX to run a fixed list of Epicor tools. A change to Epicor data waits for your approval and runs under your own Epicor account.
Cloudflare states that Workers AI does not use customer content to train AI models, and that for standard requests it does not retain inputs or outputs after the response is delivered. It may keep operational metadata such as timestamps, sizes and request counts. Read the details in Cloudflare’s Workers AI data usage page and Privacy Policy. Those are Cloudflare’s commitments, not ours, and they can change.
If you connect an MCP client such as Claude or ChatGPT instead, that client’s own model receives the Epicor results we return. That processing is governed by the client provider’s terms. Choose clients your company has approved.
A separate administrator console at /studio, used by OpexCG staff, sends its prompts to a language model endpoint that OpexCG configures. It is not part of the customer chat.
Where data is stored and for how long
The KinetiX server is stateless for chat. It keeps no conversation history: your browser holds the conversation and sends it back with each question. Everything the server does store is in Cloudflare KV and is listed here.
| Data | Where | How long |
|---|---|---|
| Epicor connection records. API key and password are encrypted with AES-256-GCM. | Cloudflare KV | Until an administrator deletes the connection. |
| Administrator one-time code (hash only, with an attempt counter) | Cloudflare KV | 10 minutes, or until used. Five wrong attempts block the code. |
| Administrator session (email address) | Cloudflare KV | 7 days. |
| Sign-in grant: Epicor username, connection id, approved access, and the Epicor password, which is kept encrypted by the OAuth library | Cloudflare KV | Up to 30 days from sign-in, or until you sign out and the grant is revoked. |
| Access token (hashed by the OAuth library) | Cloudflare KV | 1 hour. |
| Registered app (OAuth client) records | Cloudflare KV | Up to 90 days. |
| Sign-in step that binds the consent page to your browser | Cloudflare KV | 10 minutes. |
| Contact form attempt counter, keyed by IP address | Cloudflare KV | 1 hour. |
| Contact form message | Emailed to marketing@opexcg.com, then held in our mailbox | As long as needed to answer you and to keep a record of any resulting relationship. Ask us to delete yours at any time. |
| Request logs and Worker log messages | Cloudflare Workers Logs | For the retention period of our Cloudflare plan. We log sign-in error categories and email send failures, not chat messages or Epicor results. |
The token lifetimes are the defaults of the OAuth library we use (@cloudflare/workers-oauth-provider); the KinetiX code does not override them. We have not restricted processing to a single region, so Cloudflare may handle requests in any of its data centers.
Service providers
| Provider | What it does for KinetiX |
|---|---|
| Cloudflare, Inc. | Hosts the site and the KinetiX server (Workers and static assets), stores the data listed above (KV), runs the chat model (Workers AI), sends sign-in and enquiry email, and provides TLS and network protection. |
Two other parties are involved but are not our subprocessors. Your Epicor instance is the source of the data KinetiX reads and the place where approved changes run; your company operates it. An MCP client such as Claude or ChatGPT is chosen by you and has its own terms.
We also disclose information when the law requires it, or with your consent. If OpexCG is merged with or acquired by another organization, the information may transfer to it under this policy.
The Chrome extension
The extension opens KinetiX in Chrome’s side panel. It reads the address and title of your active tab to find out whether it is a Kinetic screen. If it is, it passes the Kinetic view id and page title to the assistant. For any other tab it passes nothing. It contacts only the KinetiX server you chose, signs you in with Chrome’s identity API using OAuth 2.1 and PKCE, and includes no analytics.
When you press Show me where on a walkthrough, the extension asks Chrome for permission to work on your Epicor site, the first time only. With it, the extension can open the screen in your Kinetic tab and draw a highlight around each field in turn. To find a field it looks at the page’s layout and labels. It does not read the values in your fields, and it sends nothing from the page anywhere. You can remove the permission at any time in Chrome’s extension settings.
Security
Stored connection secrets are encrypted at rest, sign-in uses OAuth 2.1 with PKCE, and changes to Epicor need your approval. The security page explains each control. No system is perfectly secure, and we cannot promise that no incident will ever occur.
Your rights and requests
Depending on where you live, you may have the right to ask us for a copy of your personal data, to correct it, to delete it, to object to or limit how we use it, or to receive it in a portable format. You may also withdraw consent where we rely on it.
Write to marketing@opexcg.com and tell us what you want. We will confirm who you are and reply. To remove a KinetiX sign-in, choose Sign out in the chat account menu, which asks the server to revoke the grant. For data inside your Epicor, contact the company that runs it; we hold no copy beyond what the sections above describe.
If you are in a place with a data protection authority and are unhappy with our answer, you may complain to that authority.
Children
KinetiX is a business tool for people who work in Epicor. It is not meant for anyone under 18, and we do not knowingly collect their personal information.
Changes to this policy
When we change what KinetiX collects or how it is handled, we update this page and its “Last updated” date. Continuing to use KinetiX after a change means you accept the updated policy. This version took effect on 30 October 2026.
Contact
Opex Consulting Group, Singapore
Email: marketing@opexcg.com
Website: opexcg.com