Privacy Policy

1. Who we are

Oye is operated by an individual, based in Lagos, Nigeria. For privacy questions, contact us at abrahamalabi1@gmail.com.

2. What we collect

We collect the following categories of data:

• • Account data: your name, email address, password (stored hashed), country, and preferences (voice, playback speed, theme).
• • Content you upload: documents (PDF, DOCX, ePub, Markdown) and the text extracted from them.
• • Derived data: audio files we generate, AI-generated debriefs (summaries, takeaways, reflection questions), and the knowledge blocks you save.
• • Usage data: how far into a document you've listened, which chapters you visit, moments you've flagged, session timestamps. We use this to resume your sessions and surface your progress.
• • Payment data: we do not store your card details. Paystack and Lemon Squeezy handle payment processing and store the card data on their own PCI-compliant infrastructure. We receive only the subscription status and a customer reference.
• • Technical data: limited logs (timestamps, request paths, IP-derived country) used to diagnose errors and prevent abuse. We do not run analytics tracking pixels at this time.

3. Why we collect it (lawful basis)

• • To deliver the service you signed up for (contract). Without your name, email, and uploaded content, we can't function.
• • To bill you (contract + legitimate interest).
• • To respond to you when you contact us (legitimate interest).
• • To prevent abuse and fraud (legitimate interest).
• • To comply with the law (legal obligation — e.g., retaining payment records for tax purposes).

4. Who we share with (sub-processors)

We don't sell your data. We share data only with the infrastructure providers required to run Oye:

• • Supabase (database, authentication, file storage) — US/EU regions.
• • Vercel (hosting, serverless compute) — global edge.
• • Inngest (background job processing) — US.
• • Deepgram (AI voice generation) — US. Your document text is sent to Deepgram in chunks to generate audio. Per Deepgram's data policy, your content is not used to train their models.
• • Anthropic (Claude) (AI comprehension) — US. Your document text is sent to Claude to generate debriefs. Per Anthropic's API terms, your content is not used to train their models.
• • Paystack (payment processing for Nigerian users) — Nigeria.
• • Lemon Squeezy (payment processing and merchant of record for international users) — US.

We may add or change sub-processors as the service evolves. Material changes will be reflected here.

5. International data transfers

If you're in the European Economic Area (EEA), the United Kingdom, or Nigeria, your data may be transferred to and processed in countries (primarily the United States) that have different data protection rules. Where required, we rely on Standard Contractual Clauses or equivalent safeguards published by our sub-processors.

6. How long we keep your data

The retention pattern reflects Oye's ownership promise:

• • Knowledge Bank, debriefs, source documents, session history: kept indefinitely until you delete them or your account.
• • Audio files (for cancelled Pro users): kept for 90 days after subscription end (grace period), then deleted.
• • Payment records: retained for as long as required by tax and accounting law (typically 6 years in Nigeria).
• • Server logs: rotated within 30 days.

When you delete your account, we delete your personal data within 30 days, except for records we're legally required to retain.

7. Your rights

Under GDPR (EU/UK), NDPR (Nigeria), and similar laws, you have the right to:

• • Access the personal data we hold about you
• • Correct inaccurate data
• • Delete your account and associated data
• • Export your data in a portable format (CSV/JSON — already available from your Knowledge Bank)
• • Object to processing in some circumstances
• • Withdraw consent where consent is the legal basis
• • Lodge a complaint with a data-protection authority (NITDA in Nigeria; your national authority in the EU)

You can exercise most of these rights directly from your Account page. For anything that needs human action, write to abrahamalabi1@gmail.com and we'll respond within 30 days.

8. Cookies and tracking

We use only essential cookies — the ones required for authentication (your login session) and to remember your preferences (theme, voice choice, playback speed). We do not currently run advertising, tracking, or analytics cookies on Oye. If we add analytics in the future, we'll update this policy and ask for consent where required.

9. Security

We take reasonable steps to protect your data: encrypted connections (HTTPS), passwords stored as hashes (not plaintext), row-level security on every database table, and signed-URL access to your files. No system is perfectly secure. If we discover a breach that affects your data, we'll notify you and the relevant authority as required by law.

10. Children's privacy

Oye is not directed at children under 18. We don't knowingly collect personal data from children. If you're a parent or guardian and believe your child has signed up, contact us and we'll delete the account.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes (for example, adding a new sub-processor that materially affects how your data is processed), we'll notify you by email and in-app at least 30 days before the change takes effect.

12. Contact

For privacy questions, data access requests, or complaints, contact abrahamalabi1@gmail.com.