Privacy policy

Oister ("we", "us") is based in Cyprus. We are the controller of the personal data described in this policy.

For anything about your data, email [email protected]. We do not have a data protection officer; the founder handles every request.

Your account. Your email address and the password you choose. The password is handled by our login provider and stored only as a one-way hash; we never see it. We also record when the account was created and when you confirmed your email.

Billing. Payments are handled by our payment processor. Your card details go to it directly and never reach our servers. To work out tax, it also asks for your billing address and, if you buy as a business, its name and VAT number. We keep your customer number with the processor, your plan, its status and its dates, and the number of site slots you pay for.

Your websites. The addresses you add, what our agent understood about each site (its type, what it sells, its audience, country and goal, which you can correct), the platform it runs on, and the results of every check: facts about your public pages such as titles, headings, word counts, links and status codes. We do not store the raw HTML of your pages. We also keep the keywords you watch, their positions on Google, your competitors, the history of every run, and the notes the agent keeps about your site.

The free scan. If you scan a site without an account, we keep the address you entered, the result, and a one-way hash of your IP address. The hash lets us limit how many free scans one person can run; it cannot be turned back into your IP address.

Your choices. Your email preferences, and a record of your marketing consent: whether you ticked the box, the exact words next to it, when, and where.

About other people. The public pages we check can name people, for example on an About page. We keep facts about pages, such as their titles and headings, not the pages themselves. If your name is on a page we checked and you want it removed from our records, email [email protected].

Messages. If you email us or message us on X, we keep the conversation so we can answer and follow up.

Technical data. Like every website, our hosting provider receives your IP address, browser type and the pages you request, to deliver the site and protect it from attacks.

You need to give an email address and a password to create an account; without them we cannot run one for you. Marketing email is optional, and so is everything you tell us about your site.

We do not ask for, and ask you not to send us, sensitive data such as health or financial information, and we never ask for access to your code, your site's admin or your passwords.

• To provide the service you signed up for: checking your sites, writing your fixes, tracking your keywords, showing your results and running your account. Legal basis: performance of our contract with you.
• To take payment and keep invoices. Legal basis: our contract with you, and our legal obligations under tax and accounting law.
• To keep the service safe and affordable: limiting free scans, preventing abuse, fixing errors and watching what each run costs. Legal basis: our legitimate interest in running a secure service that does not lose money to misuse.
• To send marketing email (SEO tips and product news), only if you ticked the box at sign-up or turned it on in Settings. Legal basis: your consent, which you can withdraw at any time in Settings or with the unsubscribe link.
• To answer you when you contact us. Legal basis: our legitimate interest in replying, or our contract with you if you are a customer.

Oister uses AI models to understand your site and to explain each problem and write its fix. To do this we send the model facts about your public pages and the description of your site. We do not send your email address, your name, your payment details or anything else that identifies you.

The models are run by AI providers under contracts that do not let them use what we send for anything else. We do not use your data to train AI models.

The agent ranks the problems it finds by how much they are likely to matter. It makes no decision about you that has a legal or similarly significant effect.

We share personal data only with the companies that run parts of the service for us, under contracts that limit them to doing so:

• a login provider, for sign-in and account confirmation;
• a payment processor, for payments, invoices and the billing page;
• hosting and server providers, which run Oister, protect it from attacks and keep encrypted backups;
• an SEO data provider, which crawls your public pages and provides keyword and ranking data. It receives your site addresses and keywords, not your personal details;
• AI providers, as described above;
• an email provider, for account emails such as the sign-up confirmation and password reset.

We may also disclose data if the law requires it, or to a buyer if Oister is sold, in which case this policy continues to apply. We do not sell your personal data, and we do not share it for advertising.

Some of the providers above are based in the United States. When personal data from the European Economic Area, the United Kingdom or Switzerland goes to them, it is protected by the EU-US Data Privacy Framework where the provider is certified, or by the European Commission's standard contractual clauses (and the UK addendum). You can ask us for a copy of the relevant safeguards at [email protected].

• Your account and your sites: for as long as you have an account.
• When you delete your account: it closes at once, and your data is erased within 30 days. Our payment processor keeps your customer record, with your email address, for invoices; we use it only to check whether an email has already had the first-month price.
• When you remove a site: its data is erased 30 days later. When you switch a site to a new address, the old site's history is erased straight away.
• Backups: kept for 30 days, then overwritten.
• Free scans without an account: kept for 30 days, then deleted.
• Invoices and payment records: as long as tax and accounting law requires, even after your account is deleted.
• Your marketing consent record: as long as you have an account, so we can show what you agreed to.

We do not use advertising or analytics cookies, and we do not track you across other websites.

When you sign in, your browser stores a sign-in token so you stay logged in. The app also keeps two things in your browser: the result of your last free scan, so your account can show it after you sign up, and which of your sites you are viewing. Our hosting provider may set a cookie that protects the site from bots. All of these are strictly necessary for the site to work, so they do not need your consent.

Depending on where you live, and always if you are in the European Economic Area or the United Kingdom, you have the right to:

• get a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to how we use it, including where we rely on legitimate interests;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting what we did before.

You can do most of this yourself: Settings lets you download everything we store about you as one file, change your email preferences and delete your account. For anything else, email [email protected]. We answer within one month, and may ask you to confirm your identity first.

If you think we have handled your data wrongly, you can complain to the data protection authority where you live or work. We would appreciate the chance to fix it first.

In the last 12 months we have collected the categories of personal information described in "What we collect": identifiers (email address, IP address), commercial information (your plan and payments), internet activity (your use of the app) and the details of your websites. We collect them for the purposes in "Why we use it" and share them only with the service providers listed above.

We collect it from you, from your use of the app, and from the public pages of the sites you check.

We do not sell or share your personal information as those terms are defined in California law, and we do not use or disclose sensitive personal information. We honour Global Privacy Control signals, though there is nothing for them to switch off.

You have the right to know what we collect, to have it deleted or corrected, and not to be treated differently for using these rights. To use them, email [email protected]; we answer within 45 days. You may use an authorized agent, and we may ask them for proof that you appointed them.

Every connection to Oister is encrypted. Passwords are handled by our login provider and card details by our payment processor, so neither is stored on our servers. Access to customer data is limited to the founder, for running and supporting the service. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

Oister is a business tool and is not meant for anyone under 16. We do not knowingly collect data from children. If you think a child has given us their data, email [email protected] and we will delete it.

If we change this policy, we update the date at the top. If a change matters for how we use your data, we tell you in the app before it takes effect.

Email: [email protected].