Privacy Policy

Effective November 8, 2026, version 2026-11-08.2

This Privacy Policy explains how [Company legal name] ("Ovelo", "we", "us") collects, uses and protects personal data when you use the Ovelo website, app, public review pages and NFC cards. It applies to two groups of people: business customers who create an account, and visitors who open a business's Ovelo page (for example, by tapping a card).

1. Our role

For business customers' account data, we are the controller. For private feedback that visitors send to a business through its page, the business is the controller and we are its processor, acting on its instructions under our Data Processing Addendum. If you sent private feedback to a business, you can also contact that business directly about your data.

2. What we collect

From business customers

• Account details: email address, your name and business name (optional), and your password, which we store only as a one-way encrypted hash.
• Page content: what you put on your pages, such as text, logos, colours, settings and review-site links.
• Card details: the codes of NFC cards you add and the pages they point to.
• Account activity: when you signed up and last signed in, your plan and subscription status, and your acceptance of these policies (version and date).
• Billing details (once online payments launch): handled by our payment provider. We receive confirmation of payments and limited details such as card type and last four digits, never your full card number.
• Messages you send us, for example support emails.

From visitors to a business's page

• Counts, not profiles: we count page visits, review-button taps and card taps per page per day. We don't store your IP address, set tracking cookies or build a profile of you on public pages.
• Private feedback (only if you choose to send it): your message, and optionally your name and a phone number or email if you want a reply, plus the page language. This goes to the business that owns the page.
• Technical data handled by our host: like any website, our hosting provider (Cloudflare) receives your IP address and device information to deliver the page and protect it from abuse. Pages also load fonts from Google Fonts, which receives your IP address to send the fonts.

When you tap a review button, you go to the review site you chose (such as Google). That site's own privacy policy applies to anything you do there; we don't receive your review or account details from it.

3. How we use data, and our legal bases

• To provide the Service (accounts, pages, cards, statistics, feedback inbox): to perform our contract with business customers.
• To deliver private feedback to the business: on the business's instructions, as its processor.
• To keep the Service secure (for example limiting sign-in attempts, preventing spam and abuse, enforcing our policies): our legitimate interests.
• To improve the Service using aggregated counts across the platform: our legitimate interests.
• To communicate with you about your account, billing, policy changes and support: contract and legitimate interests. We'll only send marketing emails where the law allows, and you can opt out at any time.
• To meet legal obligations, such as tax and accounting records or lawful requests from authorities.

We don't sell personal data, and we don't use it for third-party advertising.

4. Who we share data with

We share data only with service providers that help us run Ovelo, under contracts that require them to protect it, and only as needed:

• Cloudflare: hosting, database and security.
• Google Fonts: font delivery on pages.
• Payment provider (once online payments launch): processing subscription payments.
• Email provider (once email features launch): sending account and notification emails.

We may also disclose data if the law requires it, to protect rights, safety or property, or as part of a merger, acquisition or sale of assets (in which case we'll ask the new owner to honour this policy). The Ovelo owners can see aggregated usage counts for every account to run the business, but not the text of private feedback.

5. International transfers

We and our providers may process data in countries other than yours, including the United States. Where the law requires, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6. How long we keep data

• Account data and page content: while your account is open. When you delete your account, we delete your account, pages, statistics and feedback straight away, and remove them from backups within 30 days.
• Private feedback: until the business deletes its account (or the page it came from), or asks us to delete it.
• Daily counts: while the page exists.
• Sign-in sessions: up to 30 days. Failed sign-in records: 15 minutes.
• Billing records: as long as tax and accounting law requires (often 5–10 years).

7. Security

We use encrypted connections (HTTPS), store passwords only as salted hashes, keep each business's data separate, limit repeated sign-in attempts and restrict who can access data. No system is perfectly secure; if a breach affects your personal data, we will tell you and the relevant authorities as the law requires.

8. Your rights

Depending on where you live (for example under the EU and UK GDPR, California law, or Qatar's Personal Data Privacy Protection Law), you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent. Business customers can update or delete their data at any time from the app, including deleting their whole account from the Account page. For anything else, email ovationreviews.ca@gmail.com. We'll respond within 30 days and may need to confirm your identity. If you sent private feedback to a business, we may pass your request to that business. You also have the right to complain to your local data protection authority.

9. Cookies and similar technology

See our Cookie Policy. In short: public pages use no cookies, and the app stores only what it needs to keep you signed in.

10. Children

The Service is for businesses and isn't directed at children. We don't knowingly collect personal data from anyone under 16. If you think a child has sent us personal data, contact us and we'll delete it.

11. Changes

We'll post any changes here with a new effective date, and ask business customers to review material changes in the app.

12. Contact

[Company legal name], [Registered business address]. Email: ovationreviews.ca@gmail.com.