Privacy Policy

Last updated: 2026-10-30

This policy explains what personal data OIO collects, why, who else sees it, how long we keep it and what you can do about it. It covers the oio.app website and the OIO app (the "Service"). We wrote it to meet the EU General Data Protection Regulation (GDPR), the UK GDPR and the Polish data protection act.

1. Who we are

The controller of your personal data is Damian Mathew Bishop, a sole trader running OIO, ul. Wierzbięcice 44a/40A, 61-568 Poznań, Poland, NIP 7773472578, REGON 545258794. Email: privacy@oio.app.

We have not appointed a data protection officer, because the law does not require one for a business of our size and type. Write to the address above with anything about your data.

2. When we are not the controller

For personal data in a customer's workspace, including its client spaces, the customer determines the purposes and lawful basis of processing. OIO processes that data on the customer's documented instructions under the Data Processing Agreement (DPA), which is part of our Terms. If the customer acts for another controller, OIO acts as its sub-processor.

Invited clients, signers and collaborators do not become parties to the customer's paid subscription merely by accessing shared content.

OIO separately acts as controller where it determines its own purposes, such as account administration, billing, security and lawful product measurement. Those activities and their legal bases are described in this Privacy Policy.

Requests about workspace content should normally go to the relevant customer; OIO assists them. Requests about OIO's own controller processing may be sent directly to privacy@oio.app.

3. What we collect and why

For each purpose, this is the data, the legal basis under Art. 6 GDPR and how long we keep it.

Your account

Data: email, name, password hash (or your Google account id if you sign in with Google), 2FA settings, language, theme and business profile details you enter.
Why: to create your account, sign you in and run the Service.
Basis: contract (Art. 6(1)(b)).
Kept: while the account exists. Deleted when you delete the account (see section 7).

What you put in the Service

Data: projects, clients, tasks, notes, documents, invoices, files, recordings and transcripts, whiteboards, calendar entries, chat messages, lead forms and their answers.
Why: to store, show, share and process it as you ask.
Basis: contract (Art. 6(1)(b)). For data about other people, we act as your processor (section 2).
Kept: until you delete it. Deleted items stay in the Trash for 30 days and are then deleted from active systems, files included. Backup copies expire within a further 30 days (section 7).

AI features

Data: what you type or say to the assistant and the parts of your workspace it needs to answer (for example a project's tasks), audio you send for transcription, images you attach.
Why: to produce the answer, summary, transcript or task list you asked for.
Basis: contract (Art. 6(1)(b)). AI is part of the paid plans and only runs when you use it.
Kept: your chat history and transcripts stay in your workspace until you delete them. What the AI providers keep is described in section 5.

Signing a document someone sent you

Data: your name and email (as the sender entered them), your signature and initials (drawn or typed, stored as images), what you fill in on the document, whether you agreed to sign electronically, your IP address and browser, and when the link was sent, opened, signed or declined, with your reason if you give one.
Why: to let you sign, and to keep a record that shows who signed what and when (the audit trail and the certificate page on the signed PDF), so the signature can be relied on later.
Who decides: the business that sent you the document is the controller; we process it for them (section 2). Questions about your data go to them first.
Kept: with the document, for as long as the sender keeps it in OIO. The signed PDF and its certificate also go to everyone who signed. Unused signing links stop working after 30 days.

Calendar link and Google Calendar sync

Data: for the private calendar link, a scrambled copy (hash) of the link, your time zone and when a calendar app last read it. The link itself carries titles, project names and dates of your tickets, deadlines, reminders and events to whoever has it, so keep it private and make a new one if it leaks. For Google Calendar sync (only if you connect it), an encrypted Google access token, the id of the separate "OIO" calendar we create in your Google account, and which OIO item belongs to which event there.
What we read from Google: only the events in that OIO calendar, to see which ones you moved or deleted. We do not see or touch your other calendars, your Google contacts or your email.
Why: to show your OIO dates in the calendar you use, and to move an item in OIO when you move it there.
Basis: contract (Art. 6(1)(b)). Both are off until you turn them on.
Kept: until you turn the link off, disconnect Google Calendar or delete your account. Disconnecting deletes the OIO calendar in Google, revokes our access and deletes the token.

Payments and billing

Data: name, billing address, country, tax id if you give one, plan, payment status, transaction ids. Card details go straight to Stripe; we never see or store the full card number.
Why: to charge you, issue receipts and invoices, handle refunds and keep the books.
Basis: contract (Art. 6(1)(b)) and legal obligation under Polish tax and accounting law (Art. 6(1)(c)).
Kept: while you subscribe, then for 5 years from the end of the calendar year in which the tax payment deadline for that payment fell, as Polish tax law requires.

Emails from us

Data: your email and name, and which emails we sent you.
Why: service emails (sign-in links, security alerts, invoices, invitations, billing and trial notices) and a small number of emails about using OIO, for example a note when your trial is about to end or when an invoice is still a draft.
Basis: necessary service messages are sent to provide the Service or meet legal duties. Promotional messages, including onboarding messages that constitute direct marketing, are sent only with any consent required by applicable electronic-marketing law. GDPR legitimate interests do not replace that consent. Emails that point you at a paid plan (when you reach a plan limit, or a checkout you left unfinished) go out only if you turned on "Offers and plan reminders" in Settings, and you can turn it off there at any time. Every one of these emails has an unsubscribe link and we honour it at once. We do not send newsletters or third-party offers.
Kept: the send log while the account exists.

Security and abuse prevention

Data: IP address, browser and device details, timestamps, error reports, rate-limit counters, bot-check results.
Why: to keep the Service up, find bugs, stop spam, fraud and attacks.
Basis: legitimate interest (Art. 6(1)(f)) in a secure, working Service.
Kept: server and security logs for up to 90 days.

Product usage

Data: which parts of the app you open and for how long, linked to your account, and the country you signed up from (worked out from your IP address at sign-up; only the country is kept).
Why: to see what works and what to fix. We collect it ourselves on our servers. The one third-party tool inside the app is Microsoft Clarity, and only for an account's first 7 days: it records clicks, scrolls and page layout, with all text and everything you type masked, so it never sees your projects, clients or messages. It needs Analytics consent, as described under sign-up measurement below, and is linked to a random account id, never your name or email.
Basis: legitimate interest (Art. 6(1)(f)) in improving the product. You can object (section 8).
Kept: up to 24 months.

Sign-up measurement and ads

Data: which step of sign-up a visit reached, the device type (phone, tablet, computer), the ad or site that sent you, and, where allowed (see Basis), a random visitor id, the ad click id that brought you, the cookies of Google Ads and Meta, and Microsoft Clarity's record of how you use our public and sign-up pages and, for an account's first 7 days, the app (clicks, scrolls, page views; typed text is masked, and inside the app all text is masked too).
Why: to know which ads bring people who sign up, stop paying for the ones that do not, and see where our pages are unclear.
Basis: we obtain consent before non-essential device storage or access and advertising measurement wherever required by applicable law. This includes relevant visitor identifiers, advertising cookies and server-side advertising events linked to them. Calling measurement first-party does not remove applicable consent requirements.
You can refuse or withdraw consent through (the link is also in the footer of every public page). Withdrawal stops future consent-based collection and transmission. We apply required opt-outs and recognized preference signals in jurisdictions where they apply.
Where processing does not require consent and relies on legitimate interests, we assess necessity and its effect on your rights, explain the processing and provide the applicable right to object.
How this works today: in the EEA, the UK and Switzerland, and when we cannot tell your country, a cookie banner asks first. Until you accept, the Google Ads tag, the Meta Pixel and Microsoft Clarity do not load, no Conversions API event goes to Meta, and no measurement cookie is set. "Analytics" covers the visitor id and Microsoft Clarity; "Advertising" covers Google Ads, Meta (Pixel and the server-side Conversions API) and the ad click id. Elsewhere these run unless you refuse them in Cookie settings. Details and the full cookie list are in our Cookie Policy.
Kept: our own funnel records up to 24 months. Google, Meta and Microsoft keep their data under their own policies.

Free invoice and quote tools

Data: when you download a PDF from the invoice, quote or crypto invoice generator: your email, the document you made (your and your client's details, the lines, totals, dates and notes, not the logo), whether you ticked the box for tips and reminders, and the ad or site that sent you. Filling in the form sends nothing.
Why: to email you a copy of the PDF, to let you open the document in OIO with one click, and, only if you ticked the box, two short follow-up emails about it.
Basis: your request (Art. 6(1)(b)) for the copy and the one-click import; your consent (Art. 6(1)(a)) for the follow-up emails, which you can take back with the unsubscribe link in each of them.
Kept: 12 months from the download. If you open the document in OIO it becomes part of your account and is kept like the rest of it.

The client tips sheet

Data: when you ask for the 10 client tips on /tips: your email, whether you ticked the box for the follow-up emails and when, and the ad or site that sent you.
Why: to email you the sheet, and, only if you ticked the box, four short follow-up emails about running client jobs, about one a week.
Basis: your request (Art. 6(1)(b)) for the sheet; your consent (Art. 6(1)(a)) for the follow-up emails, which you can take back with the unsubscribe link in each of them.
Kept: 12 months from the request.

Founding studio applications

Data: when you apply on /founding: your name, email, agency, team size, the tool you use now, what you write about your client work, and the ad or site that sent you.
Why: to read your application, reply to it and set up the call. No newsletter and no marketing emails come from it.
Basis: steps you asked for before a possible contract (Art. 6(1)(b)).
Kept: up to 24 months, or until you ask us to delete it.

Affiliates and applicants

Data: for affiliate applicants, name, email, channel link, audience size and what you write. For affiliates, the payout details you give us (bank account or PayPal) and the commission ledger. People who click an affiliate link: counted per day, nothing stored about them.
Why: to review applications, run the program and pay commission.
Basis: steps before a contract and the contract itself (Art. 6(1)(b)); legal obligation for payout records (Art. 6(1)(c)).
Kept: rejected applications 12 months. Payout records for 5 years from the end of the calendar year in which the related tax payment deadline fell.

Support and legal requests

Data: what you write to us and our replies.
Why: to answer you, handle complaints, refunds, withdrawals, content notices and legal claims.
Basis: contract, legal obligation, and legitimate interest in defending legal claims (Art. 6(1)(b), (c), (f)).
Kept: up to 3 years after the matter is closed, longer only while a claim is open.

Giving us your email is needed to have an account. Everything else is up to you, but some features do not work without it (no billing address, no paid plan).

4. Who else handles your data

We do not sell personal data for money. Where permitted by law and your applicable choices, we disclose advertising-event data to Google and Meta as described below. Those disclosures may qualify as "sharing" or targeted advertising under applicable US state laws.

We use these service providers. Each only gets what its job needs. The ones that process data for us are bound by a data processing agreement; where a provider acts as its own controller, or we have no processor contract with it, that is noted.

Supabase Inc. (USA): database, sign-in, realtime. Our database runs in the EU (Ireland, eu-west-1). Supabase staff and sub-processors outside the EU may access it for support. Safeguard: EU Standard Contractual Clauses (SCCs) in Supabase's DPA.
Cloudflare, Inc. (USA): hosting and edge network, file storage (R2), PDF rendering and bot checks (Turnstile). Safeguard: EU-US Data Privacy Framework (DPF) certification plus SCCs.
Stripe (Stripe Payments Europe, Ltd., Ireland, with Stripe, Inc., USA): payments, subscriptions, receipts. Stripe is also an independent controller for its own fraud checks and legal duties. Safeguard for US transfers: DPF plus SCCs.
Anthropic, PBC (USA): the main AI model behind the assistant, and all image requests. Under its commercial terms Anthropic does not train models on our inputs or outputs. Safeguard: SCCs in Anthropic's DPA.
Groq, Inc. (USA): speech-to-text for recordings and voice messages, and a second AI model for text requests (note clean-up, recording summaries, and the assistant when the main model is unavailable). Groq does not train on customer data and does not keep inference data by default; it may hold it for up to 30 days only to investigate faults or abuse. Safeguard: SCCs in Groq's DPA.
Resend, Inc. (USA): sending our emails. Safeguard: DPF plus SCCs.
Microsoft Ireland Operations Ltd. / Microsoft Corporation: Microsoft Clarity on our public and sign-up pages and in the app for an account's first 7 days (all text and inputs masked), in the EEA, UK and Switzerland only after you accept Analytics. Microsoft processes it under its own privacy statement. Safeguard: DPF.
Google LLC / Google Ireland Ltd.: Google sign-in if you choose it; Google Ads measurement (in the EEA, UK and Switzerland only after you accept Advertising cookies; we use Google Consent Mode to pass your choice to Google); Google Calendar, only if you connect it, where your OIO dates are stored in the OIO calendar under Google's own terms and privacy policy. Safeguard: DPF.
Meta Platforms Ireland Ltd. / Meta Platforms, Inc.: Meta Pixel and Conversions API, in the EEA, UK and Switzerland only after you accept Advertising cookies. For this, Meta and we are joint controllers for the collection, and Meta is its own controller afterwards. Safeguard: DPF.
Telegram: only if you connect Telegram for reminders; the reminder text goes through Telegram's bot API. No processor contract; Telegram's own terms apply.
KLIPY: the GIF picker in chat. Your search words and a one-way pseudonymous id (not your account id, name or email) go to KLIPY, and your browser loads the GIFs from KLIPY's servers, which see your IP address. Only when you use the GIF picker or view a GIF someone posted. No processor contract; KLIPY's own terms apply.
Push services of your browser maker (Google, Mozilla, Apple, Microsoft): only if you turn on push notifications; they carry the notification to your device under their own terms.

Google user data. OIO's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain words: we use the Google Calendar access only to keep the OIO calendar in sync for you, we never sell it, never use it for ads, never use it to train AI models, and no person at OIO reads it unless you ask us to for support, the law requires it, or it is needed for security.

Until 5 October 2026 the assistant also used DeepSeek (China) for some text requests. We removed it. No AI request goes to China any more. Removing it does not mean that data sent to DeepSeek before then has been deleted by DeepSeek.

We may also disclose data when the law makes us, for example to a court or tax authority, and to our accountant or lawyer under a duty of confidentiality. The current list of providers that process customer data for us, and how we announce changes, is on the DPA page.

5. AI providers, training and retention

We do not use your content to train any AI model, and we do not let our providers do it.
Anthropic: under its commercial terms it does not train models on inputs or outputs from its API. How long Anthropic keeps API inputs and outputs follows its commercial terms and data processing addendum. We have no special zero-retention arrangement with it.
Groq: it does not train on inputs or outputs and does not retain inference data by default. It may log them for up to 30 days to fix reliability problems or investigate abuse, unless the law requires longer. See Your Data in GroqCloud.
What the assistant, transcripts and summaries produce is stored in your workspace and kept as described in section 3.

AI answers are generated by a model and can be wrong. The assistant is labelled as AI in the app. It does not make decisions about you that have legal or similarly significant effects; you decide what to do with its output.

6. Transfers outside the EEA

Some providers above are in the USA, or can access data from there. For the USA we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (and the UK Addendum for UK data). You can ask us for a copy of the safeguards at privacy@oio.app.

7. Deleting your account

You can delete your account in Settings. Account deletion does not create a new Trash period: deletion of your content, billing profile and account from active systems begins on that request, and uploaded files are removed from storage by a background job. Backup copies (database snapshots and file copies) expire within 30 days. Backups awaiting expiry are used only for recovery and security; if one is restored, applicable deletions are applied again.
Issued invoices follow the account-deletion process unless you have separately instructed us, and we have agreed, to retain a defined archive under the DPA. Your own tax-retention duties do not automatically require OIO to keep a copy for ten years.
Export what you need before deleting. Settings has an export of your data: all records as a file, and your uploaded files as a list with download links, which stop working once the account is deleted. We cannot restore a deleted account.
Our own billing records about you (what you paid us) are kept for the tax period in section 3.

8. Your rights

Under the GDPR you can:

Access your data and get a copy.
Correct data that is wrong or incomplete.
Delete your data, within the limits in section 7.
Restrict how we use it, for example while a dispute is open.
Port it: Settings gives you a machine-readable export.
Object to processing based on legitimate interest, including product usage measurement. You can object to direct marketing at any time, with no reason needed.
Withdraw consent where we rely on it, without affecting what happened before.

Write to privacy@oio.app. We answer within one month, and tell you if we need up to two more months for a complex request. We may ask you to confirm who you are.

You can also complain to a data protection authority. Ours is the President of the Personal Data Protection Office (Prezes UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, uodo.gov.pl. You can also go to the authority where you live or work.

9. Security

Data is encrypted in transit and at rest at our providers, the database enforces row-level access rules so each account only sees its own data and what was shared with it, files sit in private storage behind short-lived signed links, and 2FA is available. More on our Security page.

When we act as a processor, we notify the relevant customer as required by the DPA. When we act as controller, we notify the competent authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to create a risk to people's rights and freedoms. Where notification is late, we explain why. We notify affected individuals without undue delay where required because the risk is high. We document breaches and provide further information as it becomes available.

10. Cookies

Inside the app we only use cookies and browser storage needed to sign you in and remember your settings. On our public pages and the first-run setup page we also use measurement and ad cookies: in the EEA, the UK and Switzerland only if you accept them in the cookie banner, elsewhere unless you refuse them. You can change your choice at any time in , also linked in the footer of every public page and on the Cookie Policy page. The full list, with names and lifetimes, is in our Cookie Policy.

11. Children

OIO is a work tool. You must be at least 16 to have an account, and we do not knowingly create accounts for younger people. If we learn that an account belongs to someone under 16, we close it and delete its data. This is about who may hold an account. Data that customers put into their workspace may be about anyone, including children; the customer is responsible for it as controller (section 2).

12. California and other US states

We do not sell personal information. Outside the EEA, UK and Switzerland, the Google Ads and Meta tags on our public pages may count as "sharing" for cross-context advertising under some US state laws. You can opt out in (in the footer of every public page; turn Advertising off), by blocking third-party cookies, or by writing to privacy@oio.app.

13. Changes

When we change this policy we update the date at the top. If the change matters for how your data is used, we tell signed-in users by email or in the app at least 14 days before it applies.

14. Contact

privacy@oio.app, or by post to the address in section 1.