# Privacy Policy

Version 2026-10-20

This policy explains what personal data Ollav collects when you use ollav.app, app.ollav.app, content.ollav.app, the API and the MCP server, why we collect it, and what your rights are under the EU General Data Protection Regulation (GDPR).

## Who we are

The data controller is **[LEGAL ENTITY NAME]**, of [REGISTERED ADDRESS], Ireland. Ollav is run by Darragh Flood. For anything about your data, write to **[PRIVACY EMAIL]**.

[TODO: Darragh to confirm whether a Data Protection Officer is required; if one is appointed, add their contact details here.]

When a workspace owner uses Ollav for their organisation, the documents and comments in that workspace belong to them. [TODO: lawyer to confirm whether Ollav acts as a processor for workspace content and needs a Data Processing Agreement for business customers.]

## What we collect

**Account data**

- Your **email address**. With Google sign-in we ask Google for your basic profile (`openid email profile`) and check that your email address is verified. We store only the email address, not your name or profile picture.
- With email sign-in, we send you a single-use link that expires after 15 minutes.
- The names of workspaces you create, your memberships and roles, invitations you send or accept (including the invited email address), and which version of these Terms and this Privacy Policy you agreed to, and when.

**Your content**

- The **HTML documents** you upload, with every version, their titles and file names and when they were uploaded.
- **Comments**, replies, reactions, the images you attach to comments, and the page state saved with a comment so a reviewer can see what you saw.

**API keys and agent access**

- For each API key: its name, the first 12 characters, a one-way hash of the key (never the key itself), its scopes, live or test mode, when it was created and last used, and when it was revoked. OAuth connections from AI clients create the same kind of key.

**Usage and technical data**

- Sign-in sessions: when each started, when it was last used and when it expires.
- Counters used to limit how often actions can be repeated (for example, sign-in links per email address, API calls per day).
- An audit log of exports and deletions, which holds ids and counts, never content.
- Our hosting provider, Cloudflare, processes your **IP address**, browser details and the requests you make, to deliver the service and protect it from attacks. Our own database doesn't store IP addresses, except briefly in a counter that limits password sign-in attempts. Error logs can contain request details. [TODO: Darragh to confirm which Cloudflare logs are kept, and for how long.]

**Billing data**

- Paid plans are sold by **Stripe** as merchant of record. Stripe collects and holds your payment details, billing address and tax information; we never see your full card number. We keep the Stripe customer and subscription ids, the plan, its status, seat count and billing period for the workspace.

**Emails**

- When email is enabled, we send sign-in links, invitations, notifications about comments on documents, and warnings before a document expires.

We don't use analytics, advertising or tracking tools, and we don't sell your data. We don't use your content to train AI models, and we don't send it to model providers.

## Why we use it, and the legal basis

| Purpose | Legal basis |
|---|---|
| Creating your account, signing you in, hosting and showing your documents, comments, sharing, the API and MCP server, sending emails the service depends on | Performance of our contract with you (Art. 6(1)(b)) |
| Billing, tax and accounting records | Performance of contract, and legal obligation (Art. 6(1)(c)) |
| Keeping the service secure: rate limits, preventing abuse, enforcing the Acceptable Use rules, audit logs, backups | Our legitimate interest in running a safe, reliable service (Art. 6(1)(f)) |
| Responding to your requests and complying with the law | Legal obligation (Art. 6(1)(c)) |

## Who processes your data

We use these providers. Each processes data only as needed for its part of the service:

- **Cloudflare** (hosting, database, file storage, security): [privacy policy](https://www.cloudflare.com/privacypolicy/)
- **Stripe** (payments, tax; merchant of record for paid plans, so it is responsible for the payment data it collects): [privacy policy](https://stripe.com/privacy)
- **Google** (Google sign-in): [privacy policy](https://policies.google.com/privacy)
- **Resend** (sending email): [privacy policy](https://resend.com/legal/privacy-policy)
- **GitHub** (runs the nightly database backup job; the backup passes through a GitHub-hosted runner on its way to our EU storage and isn't kept there): [privacy statement](https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement)

When your own AI agent reads your Ollav content with your API key, the company that runs that agent handles it under your agreement with them, not ours.

[TODO: Darragh to confirm the final list of processors and sign a Data Processing Agreement with each.]

## Where your data is stored

Documents, comment images, the database and its backups are stored by Cloudflare in the **European Union** (EU jurisdiction for R2 and D1). Cloudflare, Stripe, Google, Resend and GitHub are, or belong to, US companies, so some data (for example, request data passing through Cloudflare's network, emails sent through Resend and the backup passing through GitHub) can be processed outside the EU. Where that happens, the transfer is covered by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses. [TODO: Darragh to confirm the transfer safeguard for each provider, and Resend's sending region.]

## How long we keep it

- **Your account and content**: for as long as you keep them. You can delete documents, workspaces and your account yourself.
- **Documents**: a live document expires 90 days after upload unless you extend it or mark it permanent. When email is enabled, we send a warning first. An expired document is archived: it is no longer served, but it stays stored until you delete it or delete your account. [TODO: Darragh to decide whether archived documents are deleted after a set time.]
- **Test documents** (uploaded with an `ol_test_` key) are **deleted automatically 30 days after upload**.
- **Sessions** last up to 30 days; sign-in links 15 minutes; data export links 15 minutes.
- **Deletion**: when you delete a document, a workspace or your account, its database records are removed at once, and its stored files are removed straight away (any that fail are retried every night). Deleting your account also cancels your workspaces' subscriptions, and removes your sandboxes and your comments. A top-level comment someone else replied to is kept as "[deleted]" by "Deleted user", so the reply still makes sense. You can't delete your account while you're the only owner of a workspace other people use: transfer it first.
- **Backups** are kept for 28 days, so deleted data leaves them within 30 days.
- **Audit log** entries (ids and counts, no content) are kept for 365 days.
- **Billing records** are kept by Stripe, and by us as long as the law requires for tax and accounting. [TODO: Darragh to confirm retention periods for billing records and logs.]

## Your rights

Under the GDPR you have the right to:

- **access** the personal data we hold about you, and get a copy;
- **export** it in a machine-readable format (portability);
- have it **corrected** if it is wrong;
- have it **deleted**;
- **restrict** or **object to** our use of it, including use based on our legitimate interests.

Most of this is self-serve: **Account → Download my data** gives you a ZIP of your profile, documents and every version, comments, reactions and images, and **Account → Delete my account** deletes it. For anything else, write to **[PRIVACY EMAIL]**. We'll reply within one month, and may need to confirm it's you first.

You also have the right to complain to the **Data Protection Commission** in Ireland ([dataprotection.ie](https://www.dataprotection.ie)), or to the data protection authority where you live. We'd appreciate the chance to sort it out with you first.

## Cookies and local storage

Ollav uses only what it needs to work. There are no analytics or advertising cookies, so we don't ask for cookie consent.

| Name | Where | What it does | How long |
|---|---|---|---|
| `ollav_session` | app.ollav.app | Keeps you signed in | Until you sign out or close the browser, at most 30 days |
| `ollav_oauth` | app.ollav.app | Protects the Google sign-in step | 10 minutes |
| `ollav_onboard` | app.ollav.app | Remembers you between signing in and agreeing to these terms | 30 minutes |
| `ollav_view_{document}` | content.ollav.app | Lets you view a document that isn't public | Until you close the browser |
| `ol-theme` (local storage) | your browser | Remembers light or dark mode | Until you clear it |
| `ol-emoji-recent` (local storage) | your browser | Remembers emoji you used recently | Until you clear it |

Uploaded documents are other people's HTML and may set their own cookies or load third-party content; that is outside our control. Stripe's checkout and billing pages set their own cookies under Stripe's policy.

[TODO: Darragh to confirm no analytics or other cookies are added before launch.]

## Children

Ollav isn't meant for children. You must be at least [MINIMUM AGE] to use it.

## Changes to this policy

If we change this policy in a way that matters, we'll ask you to agree to the new version the next time you sign in, and update the version at the top of this page.

## Contact

[LEGAL ENTITY NAME], [REGISTERED ADDRESS], Ireland. Email: **[PRIVACY EMAIL]**. See also the [Terms of Service](https://ollav.app/terms) and our [security overview](https://ollav.app/security).