Status: draft for counsel review Effective date: [TO FILL BEFORE PUBLICATION] Version: 0.1-launch-draft
This Privacy Policy explains how [OVIO LEGAL ENTITY NAME] ("OVIO", "we", "us", or "our") collects, uses, shares, and retains personal data when people use OVIO.
Do not publish this document until counsel has approved it, all bracketed items are complete, and the controller/processor role split has been confirmed for each product flow.
1. Controller and Contact Details
Controller for OVIO platform operations:
- Legal entity: [OVIO LEGAL ENTITY NAME]
- Registered address: [REGISTERED ADDRESS]
- Privacy contact: [PRIVACY EMAIL]
- Support contact: [SUPPORT EMAIL]
- Data Protection Officer: [DPO DETAILS OR "not appointed"]
- EU/UK representative, if required: [REPRESENTATIVE DETAILS OR "not appointed"]
Independent businesses using OVIO may also be separate controllers for their own service delivery, customer relationships, marketing, tax, accounting, legal, and professional obligations.
Where a business uses OVIO to process personal data on the business's instructions, OVIO may act as processor for that business under the Data Processing Addendum. OVIO remains controller for platform operations such as account administration, marketplace integrity, security, billing, legal compliance, analytics consent, and fraud prevention.
2. Personal Data We Collect
OVIO may collect:
- Account data: name, email, phone, authentication data, language, preferences, user type, and account settings.
- Profile data: customer profile details, business profile details, photos, descriptions, links, and public profile information.
- Business identity data: legal name, trading name, registered address, business contact details, country, business type, tax/VAT identifiers where applicable, representatives, and credentials for regulated categories.
- Booking and order data: services, products, dates, times, duration, location, staff, status, notes, attendance, cancellation, no-show, deposit, refund, and receipt information.
- Payment metadata: Stripe customer/session/payment identifiers, payment status, amount, currency, tax/fee metadata, refund/dispute metadata, subscription status, and payout-readiness metadata. OVIO does not store full card numbers.
- Communication data: messages, notifications, email events, support requests, report/appeal records, and marketing preferences.
- Location data: addresses, service areas, business locations, map coordinates, and approximate location where used for discovery or directions.
- Device and usage data: IP address, device/browser information, logs, pages viewed, actions taken, performance data, and security events.
- Cookie and consent data: cookie preferences, analytics consent, marketing opt-ins and opt-outs, unsubscribe records, and consent timestamps.
- Support, safety, and moderation data: reports, evidence, decisions, appeal records, abuse-prevention signals, and fraud-prevention signals.
3. Sensitive Data and Regulated Services
OVIO does not intend to collect special-category personal data unless a product flow, business category, or support request requires it and OVIO has completed the required legal review.
Some businesses may provide services that involve health, wellness, beauty, children, transport, food, accommodation, events, or other regulated categories. Those categories may create additional legal obligations for the business and may require OVIO to restrict or review features before launch.
Users and businesses should not send unnecessary sensitive information through OVIO messages, listings, notes, or support channels.
4. How We Use Personal Data
OVIO uses personal data to:
- Create and manage accounts.
- Provide marketplace discovery, profiles, bookings, orders, queues, events, reminders, messages, receipts, and business tools.
- Show business listings and service information.
- Process payments, refunds, subscriptions, invoices, payout-readiness checks, and payment support through Stripe where enabled.
- Provide customer and business support.
- Send transactional notifications.
- Send marketing only where permitted by law and user choices.
- Manage cookie and analytics preferences.
- Improve OVIO, measure performance, and understand aggregate usage where analytics is enabled.
- Prevent fraud, spam, abuse, unauthorized access, and platform misuse.
- Enforce OVIO's terms and marketplace rules.
- Comply with legal, tax, accounting, regulatory, reporting, and dispute obligations.
5. Legal Bases for EEA/UK Users
Where GDPR-style laws apply, OVIO relies on these legal bases:
| Purpose | Legal basis |
|---|---|
| Account creation and core service delivery | Contract necessity |
| Bookings, orders, queues, events, receipts, and support | Contract necessity or legitimate interests |
| Business identity, seller transparency, tax, and legal records | Legal obligation or legitimate interests |
| Payment metadata, fraud prevention, and dispute handling | Contract necessity, legal obligation, or legitimate interests |
| Security, abuse prevention, moderation, and platform integrity | Legitimate interests or legal obligation |
| Transactional notifications | Contract necessity or legitimate interests |
| Marketing | Consent or another lawful basis where permitted |
| Analytics cookies or similar analytics storage | Consent where required |
| Compliance with law and legal requests | Legal obligation or legitimate interests |
Where OVIO relies on legitimate interests, those interests include operating and protecting the marketplace, preventing fraud and abuse, supporting users and businesses, improving the service, and enforcing policies. You may have the right to object as explained below.
6. How We Share Personal Data
OVIO may share personal data with:
- Businesses, when needed for booking, service delivery, communication, support, cancellation, refund, or customer relationship purposes.
- Customers, where needed to show business information, booking status, service policy, location, contact route, or support updates.
- Stripe and payment providers, for payments, subscriptions, refunds, disputes, fraud prevention, tax support, and connected-account onboarding.
- Supabase, for database, authentication, and storage services.
- Resend or other email providers, for transactional and permitted marketing email.
- Vercel or other hosting providers, for hosting, deployment, logs, and operational security.
- Google Analytics and Vercel Web Analytics, only where configured and permitted by consent choices.
- Mapbox, where map or geocoding features are used.
- Professional advisers, insurers, auditors, and legal representatives.
- Public authorities or third parties where required by law, court order, regulatory request, tax obligation, safety issue, fraud investigation, or to protect rights.
- Successors in a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate protections.
OVIO does not sell personal data for money. If a future analytics or advertising configuration is considered a "sale" or "sharing" under certain privacy laws, OVIO will provide required notices and opt-out controls before using that configuration.
7. International Transfers
OVIO and its service providers may process personal data in countries other than where you live. Where required, OVIO uses appropriate transfer safeguards, such as adequacy decisions, Standard Contractual Clauses, Data Privacy Framework certifications where applicable, or other lawful transfer mechanisms.
[COUNSEL: Confirm final transfer mechanisms and vendor regions before publication.]
8. Retention
OVIO keeps personal data only as long as needed for the purposes described in this Policy, unless a longer period is required or permitted by law.
Retention criteria include:
| Data | Baseline retention criteria |
|---|---|
| Account profile | Kept while the account is active and for a limited period after closure where needed for legal, security, support, or audit purposes |
| Bookings, orders, receipts, and payment metadata | Kept as needed for transaction records, accounting, fraud prevention, disputes, chargebacks, tax, and legal obligations |
| Business identity | Kept while the business uses OVIO and as needed for marketplace, tax, legal, safety, and audit obligations |
| Marketing consent and suppression records | Kept while active and as needed to prove consent, honor opt-outs, or prevent unwanted marketing |
| Support and moderation records | Kept as needed for safety, dispute, legal, platform integrity, and abuse-prevention purposes |
| Analytics data | Kept according to configured analytics retention and consent choices |
OVIO may retain backup copies for a limited period before deletion from backup systems.
9. Your Privacy Rights
Depending on where you live, you may have rights to:
- Access personal data.
- Correct inaccurate personal data.
- Delete personal data.
- Restrict processing.
- Object to processing.
- Receive a portable copy of personal data.
- Withdraw consent where processing is based on consent.
- Opt out of certain marketing.
- Lodge a complaint with a data-protection authority.
To exercise rights, contact [PRIVACY EMAIL]. OVIO may need to verify your identity before responding.
If your request relates to data controlled by an independent business, OVIO may direct you to that business or assist the business in responding where OVIO acts as processor.
10. California and US State Privacy Notices
Where applicable, California and other US state privacy laws may provide rights to know, access, delete, correct, opt out of certain sale/sharing or targeted advertising, limit certain sensitive personal information uses, and not be discriminated against for exercising privacy rights.
[COUNSEL: Confirm whether OVIO meets CCPA/CPRA or other US state thresholds before publication. If yes, add the required categories, lookback periods, appeal process, and "Do Not Sell or Share" / GPC wording.]
11. Marketing Choices
You can unsubscribe from marketing emails using the unsubscribe link or by contacting [SUPPORT EMAIL]. Transactional emails about bookings, orders, payments, security, account activity, and support may still be sent where needed.
Businesses must honor customer marketing choices and must not use OVIO customer data for unrelated marketing without a valid legal basis.
12. Cookies and Analytics
OVIO uses cookies and similar technologies as described in the Cookie Policy. Analytics is optional where consent is required and should be off until you allow it.
13. Automated Decision-Making and Ranking
OVIO may use rules, ranking, filters, search logic, risk signals, or automation to operate discovery, booking availability, fraud prevention, moderation, security, and business-readiness checks.
OVIO does not intend to make solely automated decisions that produce legal or similarly significant effects without human review unless permitted by law and properly disclosed.
[COUNSEL/PRODUCT: Confirm final automated decision-making statement before publication.]
14. Security
OVIO uses technical and organizational measures designed to protect personal data. These measures may include access controls, authentication, encryption in transit, logging, environment separation, service-role restrictions, webhook signature checks, and vendor security controls.
No online service can guarantee absolute security. If you believe your account or data has been affected by a security issue, contact [SECURITY EMAIL].
15. Children's Privacy
OVIO is not intended for children under [AGE]. If you believe a child has provided personal data to OVIO without required permission, contact [PRIVACY EMAIL].
16. Changes to This Policy
OVIO may update this Privacy Policy. If changes are material, OVIO will take reasonable steps to notify users or businesses before or when the changes take effect, unless urgent legal, security, or operational reasons require faster changes.
17. Contact
- Privacy: [PRIVACY EMAIL]
- Support: [SUPPORT EMAIL]
- Postal address: [REGISTERED ADDRESS]