OVRIT

Privacy Notice

Last updated: 21 July 2026

This Privacy Notice explains how [LEGAL NAME — please update in src/lib/legal.ts] ("we", "us", "our"), operator of OVRIT, collects and uses your personal data.[LEGAL NAME — please update in src/lib/legal.ts] is the data controller for personal data processed through the Service.

1. What we collect

  • Account data: email address and authentication identifiers when you sign in (including via Google if you use social sign-in).
  • Service content you create: relationships you add, reasons, situation notes, daily check-ins, reality-check answers, urge events, unsent messages, safety plans and contacts, reminders, and preferences.
  • Usage & device data: IP address, device identifiers, browser type, timestamps, and basic telemetry needed to run the Service and prevent abuse.
  • Support communications: anything you send us by email.

We do not collect payment card details ourselves — those are processed by Paddle (see "Data sharing" below).

2. Why we use it (purposes and legal bases)

  • Provide the Service (create your account, save your entries, run assessments, generate AI insights) — legal basis: performance of a contract.
  • Security & fraud prevention (rate limiting, abuse detection) — legitimate interests.
  • Product improvement (aggregated, non-identifying analytics) — legitimate interests.
  • Customer support — performance of a contract.
  • Legal compliance (accounting, responding to lawful requests) — legal obligation.

3. Data sharing

We share personal data only with:

  • Infrastructure & hosting subprocessors that host the Service, its database, authentication, and AI inference.
  • Paddle, our Merchant of Record for the sale of subscriptions. Paddle processes payments, manages billing and invoicing, and handles tax compliance. Paddle acts as an independent controller for its own payment records; refer to Paddle's Privacy Notice for details.
  • Professional advisers (legal, accounting) under confidentiality.
  • Authorities where we are required to do so by law.

We do not sell your personal data.

4. AI processing

When you request AI-generated content (for example a Pattern Map, exit script, or reflection), we send the relevant context you provided to an AI provider through a gateway service. Prompts and outputs are not used to train third-party foundation models. AI outputs are generated for your personal reflection only.

5. International transfers

Personal data may be processed in countries outside your own. Where transfers involve the UK or the EEA, we rely on adequacy decisions or Standard Contractual Clauses where required.

6. Retention

We keep your account data for as long as your account is active. Most service content (check-ins, reality checks, notes) is kept for the life of your account so trends work. You can export or delete your data from Settings at any time. When you delete your account we remove or anonymise personal data within 30 days, except where we must keep it longer for legal or accounting reasons.

7. Your rights

Subject to local law you have the right to access, rectify, delete, restrict, port, or object to processing of your personal data, and to withdraw consent where processing is based on consent. If you are in the UK or EEA, you can also complain to your local supervisory authority. To exercise a right, email us at support@getovrit.com. We aim to respond within one month.

8. Security

We use appropriate technical and organisational measures — including encryption in transit, row-level access controls, and least-privilege credentials — to protect personal data. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.

9. Cookies

The Service uses only strictly necessary cookies and local storage for authentication, session, and preferences (such as your theme). We do not use advertising cookies. If we add analytics cookies, we will surface a preference control before setting them.

10. Children

The Service is not directed to children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes

We may update this Notice. Material changes will be surfaced inside the Service.

12. Contact

Data controller: [LEGAL NAME — please update in src/lib/legal.ts]. Email: support@getovrit.com.