Privacy Policy
Last updated 21 October 2026. Draft pending legal review.
This policy explains what Occanovo does with personal data. It covers two different things, and keeping them apart is the point of the document: data about you, our customer, and data about your customers, which you put into the product and we only hold on your behalf.
1. Who we are, and our two roles
Occanovo is the trading name of Occanovo Limited. Where this policy says we are the controller, that is Occanovo Limited. You can reach us at privacy@occanovo.com.
| Whose data | Our role | Who decides | |
|---|---|---|---|
| Your account | You and your colleagues | Controller | Us |
| Your business records | Your own customers, leads and staff | Processor | You |
When you sign up, we decide what to collect about you and why, so we are the controller and this policy governs it. When you enter a customer’s details to book their event, you decide that. We hold it for you and do nothing else with it, and your own privacy notice governs it.
2. What we collect about you
When you register: your name, business name, email address, and the country and currency your business trades in.
When you subscribe: billing details and a payment record. Card numbers go directly to our payment provider and never reach our servers.
When you use the service: sign-in times, the IP address a sign-in came from, and the pages and actions you take, to run the service, spot abuse and investigate faults.
When you contact us: whatever you put in the message, and our reply.
Integration credentials you choose to connect are stored encrypted and used only to make that integration work.
We do not buy personal data about you, and we do not profile you for advertising.
3. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Provide the service and your account | Performance of a contract |
| Take payment and keep billing records | Contract, and legal obligation for tax records |
| Security: sign-in records, abuse prevention | Legitimate interests |
| Support you when you ask | Contract |
| Tell you about changes affecting your service | Contract and legitimate interests |
| Improve the product from how it is used | Legitimate interests, using aggregated data where possible |
| Marketing email about Occanovo | Consent, or the existing-customer exemption |
We do not use automated decision-making producing legal effects. We do not sell your personal data. We do not use your data, or your customers’ data, to train AI models.
4. Data your business puts in
When you run your business in Occanovo you enter details about your own customers, leads and staff. You are the controller of all of it. We hold and process it on your instructions and nothing more. In practice:
- we do not contact your customers;
- we do not market to them;
- we do not use their data to improve the product, train models or build any profile;
- we do not share it except with the providers in section 5;
- your workspace is separated from every other business’s.
If one of your customers asks us directly about their data, we will point them to you and tell you they asked.
Your obligations. You need your own privacy notice and a lawful basis for holding your customers’ data. Occanovo is a tool; it does not make you compliant.
5. Who else is involved
| Provider | What it does | Where |
|---|---|---|
| Hostinger | Runs the servers and stores the database | United Kingdom (backups: Germany) |
| Stripe | Processes subscription payments, and your own customers’ card payments where you connect your own Stripe account | EU / US |
| Hostinger | Sends transactional email such as invitations and password resets, through the same hosting platform | United Kingdom |
| Meta (Facebook and Instagram lead ads) | Only where you connect a Facebook page: we receive the answers people give in that page’s lead forms, and keep an encrypted access key for the page until you disconnect | EU / US |
| Meta (WhatsApp Business) | Only where you choose to connect a WhatsApp number | EU / US |
| Google (Analytics and Ads) and Meta (Pixel) | Only on our website, and only if you accept cookies there: which adverts and pages brought you to us | EU / US |
| OpenAI | Answers questions typed into the chat on our website and the Help chat in the app, reads a business’s own website at sign-up to fill in its details, and matches spreadsheet columns on import. We send the question, or masked column headings, not your customers’ details, and we do not store website chat questions | US |
We give notice before adding a provider, and you may object on reasonable data protection grounds.
We may disclose data where the law requires it, or to establish or defend legal claims. If compelled, we will tell you unless legally prevented.
International transfers. Where personal data goes outside the EEA we rely on an adequacy decision or Standard Contractual Clauses.
6. How long we keep it
| What | Kept for |
|---|---|
| Your account and business records | While your subscription is active |
| Your data after you leave | 30 days for export, then deleted |
| Backups containing deleted data | Overwritten within 90 days. Backups are held in Germany |
| Billing and tax records | Six years, as Irish tax law requires |
| Sign-in and security logs | 12 months |
| Support correspondence | Two years |
7. Your rights, cookies and complaints
Your rights. You can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, take it elsewhere, or withdraw consent where consent is what we relied on. Email privacy@occanovo.com and we will respond within one month. You can also export your business data yourself at any time from inside the product.
Facebook data. How to remove what Occanovo holds from a connected Facebook page is set out on our data deletion page.
Cookies. Inside the Occanovo app we use only cookies that are strictly necessary to keep you signed in and the service secure. These do not need consent, and the app sets no advertising cookies. On our website, occanovo.com, we ask before setting any analytics or advertising cookies. If you accept, Google Analytics, Google Ads and the Meta Pixel may set cookies that tell us which of our adverts brought you to us and whether you went on to start a trial. If you reject them, none are set. You can change your mind at any time with Cookie settings at the foot of every page of the website.
Complaints. Tell us first and we will try to put it right. You can also complain to the Irish Data Protection Commission at dataprotection.ie, or to the supervisory authority where you live.
Changes. We will post any change here and update the date at the top. For a material change we will email you.