Privacy Policy

This policy explains what personal data OIO collects, why, who else sees it, how long we keep it and what you can do about it. It covers the oio.app website and the OIO app (the "Service"). We wrote it to meet the EU General Data Protection Regulation (GDPR), the UK GDPR and the Polish data protection act.

1. Who we are

The controller of your personal data is Damian Mathew Bishop, a sole trader running OIO, ul. Wierzbięcice 44a/40A, 61-568 Poznań, Poland, NIP 7773472578, REGON 545258794. Email: [email protected].

We have not appointed a data protection officer, because the law does not require one for a business of our size and type. Write to the address above with anything about your data.

2. When we are not the controller

OIO is a tool for freelancers and studios. The data you put in about your clients, contacts, team and leads (names, emails, invoices, files, notes, form answers) is yours to control. For that data you are the controller and we are your processor: we only handle it to run the Service for you, under our Data Processing Agreement, which is part of our Terms. If you are one of our users' clients and want to use your rights over that data, contact the business that holds it. We will help them answer you.

3. What we collect and why

For each purpose, this is the data, the legal basis under Art. 6 GDPR and how long we keep it.

Your account

• Data: email, name, password hash (or your Google account id if you sign in with Google), 2FA settings, language, theme and business profile details you enter.
• Why: to create your account, sign you in and run the Service.
• Basis: contract (Art. 6(1)(b)).
• Kept: while the account exists. Deleted when you delete the account (see section 7).

What you put in the Service

• Data: projects, clients, tasks, notes, documents, invoices, files, recordings and transcripts, whiteboards, calendar entries, chat messages, lead forms and their answers.
• Why: to store, show, share and process it as you ask.
• Basis: contract (Art. 6(1)(b)). For data about other people, we act as your processor (section 2).
• Kept: until you delete it. Deleted items sit in the Trash for 30 days and are then erased for good, files included.

AI features

• Data: what you type or say to the assistant and the parts of your workspace it needs to answer (for example a project's tasks), audio you send for transcription, images you attach.
• Why: to produce the answer, summary, transcript or task list you asked for.
• Basis: contract (Art. 6(1)(b)). AI is part of the paid plans and only runs when you use it.
• Kept: your chat history and transcripts stay in your workspace until you delete them. What the AI providers keep is described in section 5.

Signing a document someone sent you

• Data: your name and email (as the sender entered them), your signature and initials (drawn or typed, stored as images), what you fill in on the document, whether you agreed to sign electronically, your IP address and browser, and when the link was sent, opened, signed or declined, with your reason if you give one.
• Why: to let you sign, and to keep a record that shows who signed what and when (the audit trail and the certificate page on the signed PDF), so the signature can be relied on later.
• Who decides: the business that sent you the document is the controller; we process it for them (section 2). Questions about your data go to them first.
• Kept: with the document, for as long as the sender keeps it in OIO. The signed PDF and its certificate also go to everyone who signed. Unused signing links stop working after 30 days.

Calendar link and Google Calendar sync

• Data: for the private calendar link, a scrambled copy (hash) of the link, your time zone and when a calendar app last read it. The link itself carries titles, project names and dates of your tickets, deadlines, reminders and events to whoever has it, so keep it private and make a new one if it leaks. For Google Calendar sync (only if you connect it), an encrypted Google access token, the id of the separate "OIO" calendar we create in your Google account, and which OIO item belongs to which event there.
• What we read from Google: only the events in that OIO calendar, to see which ones you moved or deleted. We do not see or touch your other calendars, your Google contacts or your email.
• Why: to show your OIO dates in the calendar you use, and to move an item in OIO when you move it there.
• Basis: contract (Art. 6(1)(b)). Both are off until you turn them on.
• Kept: until you turn the link off, disconnect Google Calendar or delete your account. Disconnecting deletes the OIO calendar in Google, revokes our access and deletes the token.

Payments and billing

• Data: name, billing address, country, tax id if you give one, plan, payment status, transaction ids. Card details go straight to Stripe; we never see or store the full card number.
• Why: to charge you, issue receipts and invoices, handle refunds and keep the books.
• Basis: contract (Art. 6(1)(b)) and legal obligation under Polish tax and accounting law (Art. 6(1)(c)).
• Kept: while you subscribe, then 5 years from the end of the year of the payment, as Polish tax law requires.

Emails from us

• Data: your email and name, and which emails we sent you.
• Why: service emails (sign-in links, security alerts, invoices, invitations, billing and trial notices) and a small number of emails about using OIO, for example a note when your trial is about to end or when an invoice is still a draft.
• Basis: contract for service emails. Legitimate interest (Art. 6(1)(f)) in helping you get going with the product you signed up for, for the getting-started notes. Emails that point you at a paid plan (when you reach a plan limit, or a checkout you left unfinished) go out only if you turned on "Offers and plan reminders" in Settings: your consent, which you can take back there at any time. Every one of these emails has an unsubscribe link and we honour it at once. We do not send newsletters or third-party offers.
• Kept: the send log while the account exists.

Security and abuse prevention

• Data: IP address, browser and device details, timestamps, error reports, rate-limit counters, bot-check results.
• Why: to keep the Service up, find bugs, stop spam, fraud and attacks.
• Basis: legitimate interest (Art. 6(1)(f)) in a secure, working Service.
• Kept: server and security logs for up to 90 days.

Product usage

• Data: which parts of the app you open and for how long, linked to your account.
• Why: to see what works and what to fix. We collect it ourselves; no third-party analytics run inside the app.
• Basis: legitimate interest (Art. 6(1)(f)) in improving the product. You can object (section 8).
• Kept: up to 24 months.

Sign-up measurement and ads

• Data: which step of sign-up a visit reached, the device type (phone, tablet, computer), the ad or site that sent you, and, where allowed (see Basis), a random visitor id, the ad click id that brought you, and the cookies of Google Ads and Meta.
• Why: to know which ads bring people who sign up, and stop paying for the ones that do not.
• Basis: in the EEA, the UK and Switzerland (and when we cannot tell your country), your consent (Art. 6(1)(a) GDPR and the ePrivacy rules on cookies): a cookie banner asks first, and until you accept, the Google Ads tag and the Meta Pixel do not load at all (no request goes to Google or Meta) and no measurement cookie is set. "Analytics" covers the visitor id, "Advertising" covers Google Ads, Meta (Pixel and the server-side Conversions API) and the ad click id. You can change your mind at any time in Cookie settings. Everywhere else, legitimate interest (Art. 6(1)(f)), and you can still refuse in the same settings. Details and the full cookie list are in our Cookie Policy.
• Kept: our own funnel records up to 24 months. Google and Meta keep their data under their own policies.

Affiliates and applicants

• Data: for affiliate applicants, name, email, channel link, audience size and what you write. For affiliates, the payout details you give us (bank account or PayPal) and the commission ledger. People who click an affiliate link: counted per day, nothing stored about them.
• Why: to review applications, run the program and pay commission.
• Basis: steps before a contract and the contract itself (Art. 6(1)(b)); legal obligation for payout records (Art. 6(1)(c)).
• Kept: rejected applications 12 months. Payout records 5 years from the end of the year of payment.

Support and legal requests

• Data: what you write to us and our replies.
• Why: to answer you, handle complaints, refunds, withdrawals, content notices and legal claims.
• Basis: contract, legal obligation, and legitimate interest in defending legal claims (Art. 6(1)(b), (c), (f)).
• Kept: up to 3 years after the matter is closed, longer only while a claim is open.

Giving us your email is needed to have an account. Everything else is up to you, but some features do not work without it (no billing address, no paid plan).

4. Who else handles your data

We do not sell personal data and we do not share it for other companies' advertising. We use these service providers. Each is bound by a data processing agreement, except where noted, and only gets what its job needs.

• Supabase Inc. (USA): database, sign-in, realtime. Our database runs in the EU (Ireland, eu-west-1). Supabase staff and sub-processors outside the EU may access it for support. Safeguard: EU Standard Contractual Clauses (SCCs) in Supabase's DPA.
• Cloudflare, Inc. (USA): hosting and edge network, file storage (R2), PDF rendering, bot checks (Turnstile), and cookieless traffic statistics. Safeguard: EU-US Data Privacy Framework (DPF) certification plus SCCs.
• Stripe (Stripe Payments Europe, Ltd., Ireland, with Stripe, Inc., USA): payments, subscriptions, receipts. Stripe is also an independent controller for its own fraud checks and legal duties. Safeguard for US transfers: DPF plus SCCs.
• Anthropic, PBC (USA): the main AI model behind the assistant, and all image requests. Under its commercial terms Anthropic does not train models on our inputs or outputs. Safeguard: SCCs in Anthropic's DPA.
• Groq, Inc. (USA): speech-to-text for recordings and voice messages, and a second AI model for text requests (note clean-up, recording summaries, and the assistant when the main model is unavailable). Groq does not train on customer data and does not keep inference data by default; it may hold it for up to 30 days only to investigate faults or abuse. Safeguard: SCCs in Groq's DPA.
• Resend, Inc. (USA): sending our emails. Safeguard: DPF plus SCCs.
• Google LLC / Google Ireland Ltd.: Google sign-in if you choose it; Google Ads measurement (in the EEA, UK and Switzerland only after you accept Advertising cookies; we use Google Consent Mode to pass your choice to Google); Google Calendar, only if you connect it, where your OIO dates are stored in the OIO calendar under Google's own terms and privacy policy. Safeguard: DPF.
• Meta Platforms Ireland Ltd. / Meta Platforms, Inc.: Meta Pixel and Conversions API, in the EEA, UK and Switzerland only after you accept Advertising cookies. For this, Meta and we are joint controllers for the collection, and Meta is its own controller afterwards. Safeguard: DPF.
• Telegram: only if you connect Telegram for reminders; the reminder text goes through Telegram's bot API.
• KLIPY: the GIF picker in chat. Your search words and a one-way pseudonymous id (not your account id, name or email) go to KLIPY, and your browser loads the GIFs from KLIPY's servers, which see your IP address. Only when you use the GIF picker or view a GIF someone posted.
• Push services of your browser maker (Google, Mozilla, Apple, Microsoft): only if you turn on push notifications; they carry the notification to your device.

Google user data. OIO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: we use the Google Calendar access only to keep the OIO calendar in sync for you, we never sell it, never use it for ads, never use it to train AI models, and no person at OIO reads it unless you ask us to for support, the law requires it, or it is needed for security.

Until 5 October 2026 the assistant also used DeepSeek (China) for some text requests. We removed it. No AI request goes to China any more.

We may also disclose data when the law makes us, for example to a court or tax authority, and to our accountant or lawyer under a duty of confidentiality. The current list of providers that process customer data for us, and how we announce changes, is on the DPA page.

5. AI providers and training

• We do not use your content to train any AI model, and we do not let our providers do it.
• Anthropic: by default it does not use inputs or outputs from its commercial API to train models.
• Groq: its services agreement does not allow it to use inputs or outputs for training, and it does not retain inference data by default.

AI answers are generated by a model and can be wrong. The assistant is labelled as AI in the app. It does not make decisions about you that have legal or similarly significant effects; you decide what to do with its output.

6. Transfers outside the EEA

Some providers above are in the USA, or can access data from there. For the USA we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (and the UK Addendum for UK data). You can ask us for a copy of the safeguards at [email protected].

7. Deleting your account

• You can delete your account in Settings. Your content, billing profile and account are erased right away; uploaded files are removed from storage by a background job, normally within the hour. Copies in our backups (database snapshots and file copies) roll off within 30 days.
• Issued invoices are the exception. An invoice you issued from OIO is a tax record, and most countries make the seller keep those for years. So when you delete your account we keep your issued invoices, with the seller and buyer details printed on them, detached from your account and closed to every user, for 10 years from the end of the year they were issued, and then delete them. We keep them on your behalf as your processor, so you or a tax authority can get a copy if you need one. Drafts are deleted with the account. If you have kept your own copies and want these deleted too, write to [email protected].
• Export what you need before deleting. Settings has an export of your data: all records as a file, and your uploaded files as a list with download links, which stop working once the account is deleted. We cannot restore a deleted account.
• Our own billing records about you (what you paid us) are kept for the tax period in section 3.

8. Your rights

Under the GDPR you can:

• Access your data and get a copy.
• Correct data that is wrong or incomplete.
• Delete your data, within the limits in section 7.
• Restrict how we use it, for example while a dispute is open.
• Port it: Settings gives you a machine-readable export.
• Object to processing based on legitimate interest, including product usage measurement. You can object to direct marketing at any time, with no reason needed.
• Withdraw consent where we rely on it, without affecting what happened before.

Write to [email protected]. We answer within one month, and tell you if we need up to two more months for a complex request. We may ask you to confirm who you are.

You can also complain to a data protection authority. Ours is the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl. You can also go to the authority where you live or work.

9. Security

Data is encrypted in transit and at rest at our providers, the database enforces row-level access rules so each account only sees its own data and what was shared with it, files sit in private storage behind short-lived signed links, and 2FA is available. More on our Security page. If a breach is likely to put your rights at risk, we report it to the authority within 72 hours of finding out, and tell you without undue delay when the risk is high.

10. Cookies

Inside the app we only use cookies and browser storage needed to sign you in and remember your settings. On our public pages and the first-run setup page we also use measurement and ad cookies: in the EEA, the UK and Switzerland only if you accept them in the cookie banner, elsewhere unless you refuse them. You can change your choice at any time in Cookie settings. The full list, with names and lifetimes, is in our Cookie Policy.

11. Children

OIO is a work tool and not meant for anyone under 16. We do not knowingly collect data from children. If we learn that we have, we delete it.

12. California and other US states

We do not sell personal information. Outside the EEA, UK and Switzerland, the Google Ads and Meta tags on our public pages may count as "sharing" for cross-context advertising under some US state laws. You can opt out in Cookie settings (turn Advertising off), by blocking third-party cookies, or by writing to [email protected].

13. Changes

When we change this policy we update the date at the top. If the change matters for how your data is used, we tell signed-in users by email or in the app at least 14 days before it applies.

14. Contact

[email protected], or by post to the address in section 1.