Privacy Policy

Last updated: 2026-07-27

This policy explains how ovellan handles personal data. It covers the business customers who use the dashboard and the website visitors who chat with a customer's bot.

Controller and processor

For visitor conversations, the business customer is the data controller and ovellan is the data processor. We process that data only on the customer's instructions. A Data Processing Agreement is available at /dpa.

Data we collect

• Account data: name, email, company name, and billing identifiers from Stripe.
• Bot configuration and knowledge base: the content a business uploads for its bot.
• Visitor conversations: the messages a visitor sends and the bot's replies, plus a random visitor identifier stored in the visitor's browser.
• Remembered visitor profile (when the business enables memory): details a visitor states about themselves in the chat, such as their name, interests and preferences, so a returning visitor is recognized and does not have to repeat them. Sensitive details are not requested; visitors are asked not to share them and can erase everything remembered at any time.
• Conversational insights (when the business enables them): an automated read of the visitor to help the business's team respond, for example tone, mood, sentiment, urgency, buying stage, satisfaction, stated concern, goal or budget, and language. These are shown only to the business, never to the visitor.
• Lead score and visitor analytics: an automated lead score and behavioural signals such as pages viewed, device, browser, approximate location and session activity, shown to the business.
• Bookings, reminders, waitlist and rebooking (when the business enables booking): the visitor's name, email and chosen time, used to schedule the appointment and, if the business turns on reminders, to email a reminder beforehand with a one-tap reschedule or cancel link. If the business runs a waitlist and a slot is full, a visitor who opts in gives their name, email and desired day so the business can email them a time-limited link to claim a spot when one opens up. If the business turns on rebooking, a set time after an appointment it may email that customer a link to book their next visit (skipped if they have already booked again); you can opt out by replying to that email. If the business turns on intake, after booking you may be invited to answer a few questions it has set so it can prepare for your visit; only answer what you're comfortable sharing.
• Lead and quote-request forms (when the business enables them): the fields the business configures, which may include contact details and free-text such as the service requested, project scope or postcode. If the business enables review invitations, a visitor who leaves a positive rating may be invited to leave a review at the business's own review link.
• Usage and billing metrics (for businesses on per-seat, per-resolution plans): counts of the AI resolutions the business's bot handles, broken down by the model tier used to answer each one (Standard, Smart or Premium), together with the number of active team seats. These are aggregate counts about the business account, used to calculate the invoice; they are not used to profile individual visitors.
• Technical data: standard server logs needed to run and secure the service.

Some of the above (the remembered profile, conversational insights and lead score) is produced by automated analysis of the conversation. It is used by the business to provide and improve support, not to make decisions producing legal or similarly significant effects. Please do not share sensitive personal information in the chat.

How we use data

We use data to provide the chat service: answering visitor questions from the business knowledge base, remembering returning visitors, deriving conversational insights and a lead score for the business's team, showing analytics to the business, scheduling and reminding about appointments and inviting reviews after a positive rating where the business enables them, processing subscriptions, and sending service email. Memory, insights and lead scoring run only when the business turns them on and are visible only to that business (the data controller). We do not sell personal data, we do not use visitor conversations to train our own models, and we do not use this data for advertising.

For businesses on per-seat, per-resolution plans, we also use usage and billing metrics (per-tier counts of AI resolutions and the number of active team seats) to meter usage and bill the account: to apply the included monthly allowance, to charge for any additional seats, and to bill for resolutions above the allowance. These counts are about the business account, not individual visitors.

Sub-processors

We use these third parties to run the service:

Where data is hosted

All application and database data is hosted in the European Union (Germany), on Hetzner and Strato infrastructure. Some sub-processors (Anthropic, Stripe, Resend) may process limited data outside the EU under appropriate safeguards.

Cookies and analytics

On our own website (ovellan.com) we use only essential, functional cookies by default: the ones that keep you signed in (session and security), remember your language choice, and store your cookie choice itself. These are needed for the site to work, so we do not ask consent for them. For everything else, the choice is yours.

Analytics with Google Analytics 4 (consent-based)

We measure how our own website is used with Google Analytics 4 to improve our pages. These analytics cookies load only after you consent to them. Until then, our consent banner blocks Google Analytics entirely: we use Google Consent Mode v2, which defaults to "denied", so no analytics tags load and no analytics cookies are set without your consent. If you consent, Google Analytics collects usage data such as the pages you view, the referring page, campaign parameters (UTM), coarse location derived from your IP address, and device and browser information, to build visit statistics. This data is processed by Google Ireland Ltd. on our behalf and may be transferred to Google in the United States. That transfer is covered by the EU-US Data Privacy Framework, under which Google is certified, and additionally by the EU Standard Contractual Clauses (SCCs). ovellan does not store your IP address; Google uses the IP address briefly to derive a coarse location. We do not use this analytics for advertising.

Session recordings (consent-based)

To find bugs and improve how our own website works, we make session recordings of visits using rrweb, an open-source recorder that runs entirely on our own EU servers; no third-party recording service is involved. A recording captures how the page looked and how you moved through it: page views, mouse movement, clicks, scrolling and any script errors, so we can replay a visit to see where something went wrong. These recordings start only after you consent to analytics; nothing is recorded before that, and bots that do not run JavaScript are therefore not recorded. Everything you type is masked at capture, so form fields, passwords and message contents are never recorded. We store no raw IP address, only a hashed value, plus coarse location and device and browser information derived from your request. Recordings are visible only to us, are never sold and are not used for advertising or to train models, and are deleted automatically (the recording itself within 30 days, the summary within a few months). Basis: your consent.

Our own anonymous, cookieless measurement

Separate from Google Analytics, we keep our own, fully anonymous measurement. It counts only aggregate statistics, such as how many times a page was viewed, the referring website or page (including which page of our own site a visit came from, so we can understand navigation), and campaign parameters (UTM), without setting any cookies and without storing anything that can identify you personally. In addition, we count per campaign how far visits get: how many read on beyond the landing page (a second page, staying around 30 seconds, or scrolling halfway), send a message to our chatbot, or reach the pricing or sign-up page. Those too are only per-campaign day counters: no visitor id, cookie or profile is stored, and individual visits cannot be linked to each other or to you. So we can see whether anyone is on the site right now, we also keep a short-lived activity counter: per minute (never per second) how many pages were viewed, which page, and which referring website. That contains no visitor id, cookie or IP address either, and those rows are deleted automatically; they exist only to show a current counter, not to keep a visit history. Since 27-07-2026 we also count per day which country, region and city visits came from. That coarse location is derived from the IP address by our network (Cloudflare) before the request reaches us; we do not store the IP address itself, nor coordinates or postal code. It stays a day counter: a row says “42 views from North Holland today” and never who. Because this measurement processes no personal data and uses no cookies, it runs regardless of your cookie choice; no consent is required for it in law.

Where your sign-up came from (first-touch)

If you consent to analytics, we remember the source of your first visit in a cookie, only a coarse source/medium/campaign (such as "capterra / referral" or "google / organic") plus the referring website and the landing page, not your full browsing behaviour. If you then sign up, we attach that single source to your account once, so we can see which channels actually produce customers. We record this once (never overwritten), store no IP address or full URL, and once the source is on your account we delete the cookie again. If you do not consent, this does not happen. Basis: your consent for the capture and our legitimate interest in knowing how customers find us.

Measuring our own ads (Google Ads)

If you reach our site via one of our own Google ads, Google appends a click identifier (gclid) to the URL. We store it once, first-party, solely to measure which of our ads actually lead to a free trial or a paid subscription. If you start a free trial or later become a customer, we report that conversion, for a payment the amount only, for a trial with no amount, back to Google Ads server-side, tied to that click id. We set no advertising cookies on your device for this, show you no personalised ads, and do not track you across other websites. The click id is deleted after at most 90 days. Basis: our legitimate interest in measuring the effectiveness of our own ads.

Partner referrals (affiliate program)

We run an affiliate program: independent partners can recommend ovellan using their own link and earn commission when someone becomes a customer through it. If you arrive through such a partner link and you consent to the "Partner referrals" category, we set one first-party cookie (ov_aff) containing nothing but a random, meaningless token, valid for 60 days. That token only records which partner sent you; it holds no name, email address, profile or browsing history. If you create an account within that period, we attach that one partner to your workspace once and permanently, so the commission is correct. If you do not consent, we set nothing: we then only count anonymously how many clicks a partner link produced, with no attribute that could be traced back to you. You can also type a referral code yourself at sign-up instead, which works entirely without cookies. We use no device fingerprinting. The partner never sees your name, email address, company name or payment details, only counts and amounts. Basis: your consent for the cookie, and our legitimate interest in paying partners correctly and preventing fraud.

If you are an affiliate partner

If you apply as a partner, we process the details you enter in the application form yourself (name, business name, email address, country, website, social profiles, your audience and your promotion plan), plus which version of the terms you accepted and when. Of your IP address we keep only an irreversible hash, purely to prevent abuse. For payouts we use Stripe Connect: you complete identity and bank verification directly with Stripe, and ovellan never receives or stores your bank details or identity documents. We store only Stripe's account id plus whether payouts are possible. Basis: performance of the agreement with you as a partner, and a legal obligation for financial records.

Review badges in our footer

At the bottom of our homepage we show badges from review platforms that list ovellan: SourceForge, Slashdot and TopBusinessSoftware. Each badge is essentially just a link to our page on that platform and works without cookies. The scripts that turn those links into graphical badges come from a single third party (SourceForge, which also serves Slashdot and TopBusinessSoftware), and we load them only after you have consented to analytics. Without consent you see only the text links and nothing from that party is loaded. If you click a badge you leave our site and that platform's privacy rules apply.

Giving and withdrawing consent

When you first visit our site, a cookie banner asks for your choice. There are two optional categories, which you can switch on or off independently: "Statistics" (Google Analytics) and "Partner referrals" (the affiliate cookie described above). You can change or withdraw your choice at any time via the "Cookie preferences" link, which re-opens the same banner. Withdrawing consent is as easy as giving it: switch a category off and it stops loading and its cookies are removed. Your choice does not affect the essential, functional cookies, which are always required for the site to work.

Data retention

Account and bot configuration data is kept while the account is active. Visitor conversations are retained for a configurable period and then deleted. When a business deletes its account, all associated data is removed.

One exception, called out because it survives deletion: the free trial is once per person. When you start a trial we keep an irreversible, salted hash of your email address and of the IP address you used, plus your address's domain. An address cannot be recovered from a hash, and we use it for nothing other than refusing a second free trial. If you delete your account your data is erased, but this hash remains for up to 24 months. Legal basis: our legitimate interest in preventing abuse of the free trial.

Affiliate program retention

• Raw, pseudonymous click data: 90 days.
• Aggregated click statistics (no visitor dimension): 24 months.
• Attribution records: 13 months after the last activity.
• Commission and payout records: 7 years, because Dutch law requires financial records to be kept for that long.
• Compliance and audit logs: 24 months after participation ends.

Security

All traffic is encrypted in transit with TLS (256-bit HTTPS). Access to production systems is restricted and key-based. Payments are handled by Stripe, which is PCI DSS compliant; we never receive or store card numbers.

Your rights

Businesses can exercise GDPR rights directly from the dashboard:

• Access and portability: export all your data as JSON from the dashboard.
• Erasure: delete your account and all associated data from the dashboard.
• Rectification, restriction, objection: contact us and we will action your request.

Visitors who want their conversation data removed should contact the business they chatted with (the data controller); we will assist that business with the request. A visitor can also erase everything the bot remembers about them at any time by typing "forget me" in the chat.

Cookies and widget storage

The chat widget stores a random visitor identifier in the visitor's browser so a conversation can continue across visits and returning visitors can be recognized. The widget can be configured to disable visitor tracking until a business has collected the consent it requires. The dashboard uses a single session cookie to keep you logged in. For the cookies and analytics on our own website, see Cookies and analytics.

Contact

Questions about privacy or data requests: [email protected].