Privacy Policy
1. Who is responsible
[to be completed: company legal name] (tax ID [to be completed: tax ID (CIF/NIF)]), [to be completed: registered address], Spain is the controller of the account, billing and operational data described in section 2, and the processor of the content your organisation puts into its workspace (section 3). We have not appointed a data protection officer, as the law does not require one for our activities; write to [to be completed: privacy contact email] for anything about your data.
2. Data we control: accounts, billing, operations
| Data | Why | Legal basis (GDPR art. 6) | Kept |
|---|---|---|---|
| Name, work email, password hash; if you sign in with Google or Microsoft, the name, email and account identifier they send us | Create and secure your account; sign you in | Contract | Until you delete your account; then deleted or anonymised |
| Workspace membership, role, licences; which version of the terms you accepted, and when | Access control; proof of acceptance | Contract; legal obligation | Account lifetime; acceptances 5 years after |
| Billing contact, address, VAT number, invoices, payment status (card details are held by Stripe, never by us) | Charge for the Service; tax and accounting | Contract; legal obligation | 10 years (tax and commercial law) |
| Usage events (sign-ins, features used, AI calls and their cost, errors); IP address and browser in server logs | Operate, secure and improve the Service; support you; measure plan allowances | Legitimate interest in running a secure, reliable service | Events 13 months; server logs 1 month |
| Support conversations and notes | Help you | Legitimate interest | 3 years |
| Emails we send (invitations, password resets, notices) and their delivery status | Operate the Service | Contract | 90 days at the email provider |
| Cookie choices: a random identifier, your choices, the policy version and the time (no IP address or account) | Show that consent was given or refused | Legal obligation (GDPR art. 7(1)) | 3 years |
| Demo requests from the website: name, work email, company, team size, message | Answer your request | Steps at your request before a contract; legitimate interest | 2 years, or until you ask us to delete it |
We do not sell personal data, do not use it for advertising, and do not use it to train AI models.
3. Data we process for your organisation: workspace content
When your organisation connects tools (such as Freshdesk, Jira, Confluence, Slack or Google Docs) or uploads documents, Ovenbird reads tickets, issues, comments, messages and process documents to produce guidance, answers, training and suggested edits. This content can include personal data about your colleagues, customers and others. For it, your organisation is the controller and we act on its instructions under the Data Processing Agreement; questions about it are best sent to your organisation first. In short:
- It is stored in Amazon Web Services' Ireland region (eu-west-1), encrypted in transit and at rest. Integration credentials are additionally encrypted with a separate key.
- To generate answers we send the relevant content to Anthropic (Claude models) through its API. Anthropic processes it to return the answer, does not use it to train models, and keeps it only for the limited period its commercial terms allow for trust and safety.
- Chats, learning records and lessons are kept while the workspace exists. Admins can export or delete them, and each person can export or delete their own.
- When a workspace is closed, its content is deleted 30 days later, and from backups within a further 35 days.
4. AI and automated decisions
Ovenbird uses AI to generate suggestions. It takes no decisions about you that produce legal or similarly significant effects (GDPR art. 22): people decide what to do with its suggestions. Learning records show which processes a person has practised and how well; they are shown to that person and to their workspace's owners and admins, to support training. Our terms forbid customers from using them as the sole or decisive basis for employment decisions.
5. Who we share data with
Only providers that help us run the Service, under contracts that limit what they may do: hosting (Amazon Web Services), AI (Anthropic), payments (Stripe) and email (Resend). The sub-processor list gives their locations and safeguards. If you sign in with Google or Microsoft, they process your sign-in under their own privacy policies. We may disclose data where the law requires it, and to a successor if our business is transferred (you would be told).
6. International transfers
Our hosting is in the EU. Anthropic, Stripe and Resend may process data in the United States. Those transfers rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses, with supplementary measures where needed. You can ask us for a copy of the safeguards.
7. Your rights
You can ask us to access, correct, delete or restrict your personal data, to object to processing based on legitimate interest, to receive your data in a portable format, and to withdraw consent at any time without affecting earlier processing. In the Service, Manage → Workspace → Your account lets you download your data and delete your account. For anything else write to [to be completed: privacy contact email]; we reply within one month (extendable by two months for complex requests) and may ask you to confirm your identity. If you are unhappy with our answer you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es), or to the authority where you live or work.
8. California residents
In the last 12 months we collected the categories in sections 2 and 3: identifiers (name, email, account identifiers, IP address), commercial information (plan and billing), internet activity (usage events), and professional information contained in workspace content. We collect them for the purposes in section 2 and keep them for the periods stated there. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics. We honour the Global Privacy Control signal as an opt-out. You may ask to know, delete or correct your information, personally or through an authorised agent, by writing to [to be completed: privacy contact email]; we will not discriminate against you for doing so.
9. Cookies
We use only strictly necessary cookies unless you choose otherwise; optional preferences are off until you turn them on. We use no analytics, advertising or third-party cookies, and our fonts are served from our own servers. Details are in the Cookie Policy, and you can change your choice at any time: Cookie settings.
10. Security
Encryption in transit (TLS) and at rest, encrypted integration credentials, workspace isolation, role-based access, hashed passwords, sign-in rate limiting, a record of support actions, and least-privilege access for our staff. If a personal-data breach affects you we will tell you and, where required, the AEPD within 72 hours; customers whose workspace content is affected are notified within 48 hours of our confirming it.
11. Children
The Service is for business users. It is not directed at children, and we do not knowingly collect data from anyone under 16.
12. Changes
We will announce material changes by email to workspace owners and in the Service, and ask you to accept again where required. Earlier versions are available on request.