Status: In force Effective date: 6 September 2026 Version: 1.0
This Privacy Policy explains how ovioapp S.r.l. ("OVIO", "we", "us", or "our") collects, uses, shares, and retains personal data when people use OVIO.
1. Controller and Contact Details
Controller for OVIO platform operations:
- Legal entity: ovioapp S.r.l.
- Registered address: Corso Piemonte, Settimo Torinese (TO), Italy
- Privacy contact: support@ovioapp.com
- Support contact: support@ovioapp.com
- Data Protection Officer: not appointed; OVIO's processing does not require one
- EU representative: not required, because OVIO is established in the European Union
Independent businesses using OVIO may also be separate controllers for their own service delivery, customer relationships, marketing, tax, accounting, legal, and professional obligations.
Where a business uses OVIO to process personal data on the business's instructions, OVIO may act as processor for that business under the Data Processing Addendum. OVIO remains controller for platform operations such as account administration, marketplace integrity, security, billing, legal compliance, analytics consent, and fraud prevention.
2. Personal Data We Collect
OVIO may collect:
- Account data: name, email, phone, authentication data, language, preferences, user type, and account settings.
- Profile data: customer profile details, business profile details, photos, descriptions, links, and public profile information.
- Business identity data: legal name, trading name, registered address, business contact details, country, business type, tax/VAT identifiers where applicable, representatives, and credentials for regulated categories.
- Booking and order data: services, products, dates, times, duration, location, staff, status, notes, attendance, cancellation, no-show, deposit, refund, and receipt information.
- Payment metadata: Stripe customer/session/payment identifiers, payment status, amount, currency, tax/fee metadata, refund/dispute metadata, subscription status, and payout-readiness metadata. OVIO does not store full card numbers.
- Communication data: messages, notifications, email events, support requests, report/appeal records, and marketing preferences.
- Location data: addresses, service areas, business locations, map coordinates, and approximate location where used for discovery or directions.
- Device and usage data: IP address, device/browser information, logs, pages viewed, actions taken, performance data, and security events.
- Cookie and consent data: cookie preferences, analytics consent, marketing opt-ins and opt-outs, unsubscribe records, and consent timestamps.
- Support, safety, and moderation data: reports, evidence, decisions, appeal records, abuse-prevention signals, and fraud-prevention signals.
3. Sensitive Data and Regulated Services
OVIO does not intend to collect special-category personal data unless a product flow, business category, or support request requires it and OVIO has completed the required legal review.
Some businesses may provide services that involve health, wellness, beauty, children, transport, food, accommodation, events, or other regulated categories. Those categories may create additional legal obligations for the business and may require OVIO to restrict or review features before launch.
Users and businesses should not send unnecessary sensitive information through OVIO messages, listings, notes, or support channels.
4. How We Use Personal Data
OVIO uses personal data to:
- Create and manage accounts.
- Provide marketplace discovery, profiles, bookings, orders, queues, events, reminders, messages, receipts, and business tools.
- Show business listings and service information.
- Process payments, refunds, subscriptions, invoices, payout-readiness checks, and payment support through Stripe where enabled.
- Provide customer and business support.
- Send transactional notifications.
- Send marketing only where permitted by law and user choices.
- Manage cookie and analytics preferences.
- Improve OVIO, measure performance, and understand aggregate usage where analytics is enabled.
- Prevent fraud, spam, abuse, unauthorized access, and platform misuse.
- Enforce OVIO's terms and marketplace rules.
- Comply with legal, tax, accounting, regulatory, reporting, and dispute obligations.
5. Legal Bases for EEA/UK Users
Where GDPR-style laws apply, OVIO relies on these legal bases:
| Purpose | Legal basis |
|---|---|
| Account creation and core service delivery | Contract necessity |
| Bookings, orders, queues, events, receipts, and support | Contract necessity or legitimate interests |
| Business identity, seller transparency, tax, and legal records | Legal obligation or legitimate interests |
| Payment metadata, fraud prevention, and dispute handling | Contract necessity, legal obligation, or legitimate interests |
| Security, abuse prevention, moderation, and platform integrity | Legitimate interests or legal obligation |
| Transactional notifications | Contract necessity or legitimate interests |
| Marketing | Consent or another lawful basis where permitted |
| Analytics cookies or similar analytics storage | Consent where required |
| Ordering what you see from your own activity (bookings, searches, saved places) | Legitimate interests — you can object at any time in Account → Personalization |
| Learning what you like from swiping cards on Home | Consent — off unless you turn it on, and withdrawable at any time |
| Compliance with law and legal requests | Legal obligation or legitimate interests |
Where OVIO relies on legitimate interests, those interests include operating and protecting the marketplace, preventing fraud and abuse, supporting users and businesses, improving the service, and enforcing policies. You may have the right to object as explained below.
6. How We Share Personal Data
OVIO may share personal data with:
- Businesses, when needed for booking, service delivery, communication, support, cancellation, refund, or customer relationship purposes.
- Customers, where needed to show business information, booking status, service policy, location, contact route, or support updates.
- Stripe and payment providers, for payments, subscriptions, refunds, disputes, fraud prevention, tax support, and connected-account onboarding.
- Supabase, for database, authentication, and storage services.
- Resend or other email providers, for transactional and permitted marketing email.
- Vercel or other hosting providers, for hosting, deployment, logs, and operational security.
- Google Analytics and Vercel Web Analytics, only where configured and permitted by consent choices.
- Mapbox, where map or geocoding features are used.
- Professional advisers, insurers, auditors, and legal representatives.
- Public authorities or third parties where required by law, court order, regulatory request, tax obligation, safety issue, fraud investigation, or to protect rights.
- Successors in a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate protections.
OVIO does not sell personal data for money. If a future analytics or advertising configuration is considered a "sale" or "sharing" under certain privacy laws, OVIO will provide required notices and opt-out controls before using that configuration.
7. International Transfers
OVIO and its service providers may process personal data in countries other than where you live. Where required, OVIO uses appropriate transfer safeguards, such as adequacy decisions, Standard Contractual Clauses, Data Privacy Framework certifications where applicable, or other lawful transfer mechanisms.
OVIO's application hosting and its database are located in the European Union. Where a provider processes personal data outside the European Economic Area, OVIO relies on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) together with a transfer risk assessment, or on an adequacy decision where one applies. The current provider list and the regions each one uses are set out in the Subprocessors & Security document.
8. Retention
OVIO keeps personal data only as long as needed for the purposes described in this Policy, unless a longer period is required or permitted by law.
Retention criteria include:
| Data | Baseline retention criteria |
|---|---|
| Account profile | Kept while the account is active and for a limited period after closure where needed for legal, security, support, or audit purposes |
| Bookings, orders, receipts, and payment metadata | Kept as needed for transaction records, accounting, fraud prevention, disputes, chargebacks, tax, and legal obligations |
| Business identity | Kept while the business uses OVIO and as needed for marketplace, tax, legal, safety, and audit obligations |
| Marketing consent and suppression records | Kept while active and as needed to prove consent, honor opt-outs, or prevent unwanted marketing |
| Support and moderation records | Kept as needed for safety, dispute, legal, platform integrity, and abuse-prevention purposes |
| Analytics data | Kept according to configured analytics retention and consent choices |
OVIO may retain backup copies for a limited period before deletion from backup systems.
8.1 Account closure and the recovery window
Account holders can close a personal account, and business owners can close a business, from within OVIO. Closure works in two stages:
- Recovery window (30 days). On closure the account stops being visible anywhere on OVIO — it cannot be found, contacted, or booked, and a closed business is removed from search and every public page. Nothing is deleted yet: signing in during this window restores the account exactly as it was.
- Erasure (after 30 days). Personal data is then erased irreversibly. Where nothing else depends on the record, the account is deleted outright. Where transaction history exists, the personal data is erased and the remaining records are kept without the details that identify the person, in line with the accounting and tax retention criteria in the table above. For a closed business, contact details, tax and registration identifiers, and any customer marketing list are deleted; retained booking and payment records continue to carry the business's trade name.
Closure cannot be completed while the account has upcoming bookings, because those represent commitments to another party; OVIO does not cancel them on the account holder's behalf.
9. Your Privacy Rights
Depending on where you live, you may have rights to:
- Access personal data.
- Correct inaccurate personal data.
- Delete personal data.
- Restrict processing.
- Object to processing.
- Receive a portable copy of personal data.
- Withdraw consent where processing is based on consent.
- Opt out of certain marketing.
- Lodge a complaint with a data-protection authority.
To exercise rights, contact support@ovioapp.com. OVIO may need to verify your identity before responding.
If your request relates to data controlled by an independent business, OVIO may direct you to that business or assist the business in responding where OVIO acts as processor.
10. California and US State Privacy Notices
Where applicable, California and other US state privacy laws may provide rights to know, access, delete, correct, opt out of certain sale/sharing or targeted advertising, limit certain sensitive personal information uses, and not be discriminated against for exercising privacy rights.
OVIO does not currently meet the thresholds that make the California Consumer Privacy Act or comparable US state privacy laws apply to it, and OVIO does not sell or share personal data as those laws define those terms. If that changes, OVIO will update this Policy and add the disclosures those laws require.
11. Marketing Choices
You can unsubscribe from marketing emails using the unsubscribe link or by contacting support@ovioapp.com. Transactional emails about bookings, orders, payments, security, account activity, and support may still be sent where needed.
Businesses must honor customer marketing choices and must not use OVIO customer data for unrelated marketing without a valid legal basis.
12. Cookies and Analytics
OVIO uses cookies and similar technologies as described in the Cookie Policy. Analytics is optional where consent is required and should be off until you allow it.
13. Automated Decision-Making and Ranking
OVIO may use rules, ranking, filters, search logic, risk signals, or automation to operate discovery, booking availability, fraud prevention, moderation, security, and business-readiness checks.
OVIO does not make solely automated decisions that produce legal or similarly significant effects about you. Ranking changes the ORDER in which you see things. It never changes a price, a deposit, a cancellation rule, whether a time is available to you, or whether you may book — those are the same for everyone.
13.1 The main parameters of our recommender systems
The order of the Explore feed and of the cards on Home is decided by, in descending order of influence:
- What you have booked. A business you have booked before, and categories you book, rank higher than ones you have not.
- What you searched for recently, and the categories those searches landed on.
- Places you saved.
- Interests you chose when you set up your account.
- Distance and how soon something is available — the base order everything else adjusts.
- Ratings, once a business has at least three of them.
- What you liked or passed on by swiping, if — and only if — you turned that on. This is the weakest of the seven and is capped so that it can move a card by roughly ten positions. It can never remove anything from your feed.
Sponsored placements are labelled and are never selected or ordered using any of the above, including anything learned from your swipes.
13.2 Changing it
Account → Personalization lets you turn off learning from swipes, object to personalization from your other activity, see what OVIO currently believes you like, and delete it. Turning learning off deletes what was already learned.
Where a decision does have a legal or similarly significant effect, you may ask for human review by contacting support@ovioapp.com.
14. Security
OVIO uses technical and organizational measures designed to protect personal data. These measures may include access controls, authentication, encryption in transit, logging, environment separation, service-role restrictions, webhook signature checks, and vendor security controls.
No online service can guarantee absolute security. If you believe your account or data has been affected by a security issue, contact support@ovioapp.com.
15. Children's Privacy
OVIO is not intended for children under 16. If you believe a child has provided personal data to OVIO without required permission, contact support@ovioapp.com.
16. Changes to This Policy
OVIO may update this Privacy Policy. If changes are material, OVIO will take reasonable steps to notify users or businesses before or when the changes take effect, unless urgent legal, security, or operational reasons require faster changes.
17. Contact
- Privacy: support@ovioapp.com
- Support: support@ovioapp.com
- Postal address: Corso Piemonte, Settimo Torinese (TO), Italy