Privacy Policy

This Policy covers personal information we handle as a business — for example, information about website visitors, prospects, and the individual users of a customer account.

Data that a customer uploads to the platform to generate certificates and reports ("Customer Data") is processed on the customer's behalf and under the customer's instructions. For that Customer Data, the customer is the controller and Olycor acts as a processor; our handling of it is governed by our agreement with the customer (including any data processing addendum) rather than this Policy. If you are an individual whose information appears in Customer Data, please contact the relevant customer.

We collect information in the following ways:

• Information you provide — account details (name, work email, organization, role), quote and contact requests, support communications, and content you submit.
• Customer Data — receivables and related data submitted to the platform to produce Output; handled as described in Section 1.
• Automatically collected — usage and device information such as IP address, browser type, pages viewed, timestamps, and diagnostic logs, collected to operate and secure the Service.
• Cookies and similar technologies — used for authentication, security, preferences, and analytics, as described in Section 8.

• To provide, operate, secure, maintain, and improve the Service;
• To authenticate users, prevent fraud and abuse, and enforce our Terms;
• To respond to quote requests, inquiries, and support;
• To send service, security, and administrative communications, and — where permitted — relevant updates you can opt out of;
• To produce anonymized, aggregated insights that do not identify you; and
• To comply with legal obligations and protect the rights, safety, and property of Olycor, our customers, and others.

Where the GDPR or similar laws apply, we process personal information on the bases of performance of a contract, our legitimate interests (such as securing and improving the Service), your consent (where required, for example certain cookies or marketing), and compliance with legal obligations.

We do not sell personal information. We share information only as follows:

• Service providers / sub-processors — vetted vendors (such as cloud hosting and infrastructure providers) who process information on our behalf under confidentiality and data-protection obligations;
• Legal and safety — when required by law, regulation, legal process, or to protect rights, safety, and the integrity of the Service;
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy; and
• With your direction or consent.

We retain personal information for as long as needed to provide the Service, comply with legal, accounting, or reporting obligations, resolve disputes, and enforce agreements. Customer Data is retained and deleted according to our agreement with the relevant customer. When information is no longer needed, we delete or de-identify it.

We use technical and organizational measures appropriate to the sensitivity of the data, including encryption in transit and at rest, role-based access controls, tenant isolation, audit logging, and least-privilege practices. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security; you are responsible for safeguarding your credentials.

We use strictly necessary cookies for authentication and security, and may use limited analytics to understand and improve usage. You can control non-essential cookies through your browser settings; disabling some cookies may affect functionality.

We may process and store information in countries other than where you are located. Where required, we use appropriate safeguards (such as standard contractual clauses) for cross-border transfers of personal information.

Depending on your location, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing or withdraw consent. You may also opt out of marketing communications at any time. To exercise these rights, contact us using the details below; we will respond consistent with applicable law. If we process your information as a processor on a customer's behalf, we will refer your request to that customer.

The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from anyone under 18.

We may update this Policy from time to time. We will revise the "Last updated" date and, for material changes, provide additional notice where appropriate.

For privacy questions or requests, contact privacy@olycor.com.