Privacy policy

Last updated: 22 October 2026

At a glance

This policy covers OYYO websites and services that link to it, including OYYO ONE AI and NotzUp. Product-specific notices may supplement it. Coverage does not mean every platform or feature is available today.
Captured content is designed for local-first AI processing on an authorized device. Raw recordings stay local by default; network features such as selected sync, sharing and connectors are separate choices.
Optional analytics require consent where required. We do not sell personal data or share it for cross-context behavioral advertising. Analytics events must exclude customer content and account details.
You can manage permissions, withdraw optional consent and request privacy rights through support@oyyo.one. This is a GDPR-centered global baseline, not a claim of universal legal compliance or certification.

Scope and product notices

This policy applies to OYYO websites, apps and services that link to it, including OYYO ONE AI and NotzUp on web, Windows, macOS, Linux, Android and iOS where provided. Product-specific notices explain additional features, providers or processing and may supplement this baseline. A feature described here is not a statement that it has shipped.

We explain our processing using GDPR principles as a baseline. Rights and obligations depend on the law that applies to you and the particular service; we do not claim compliance with every law or any certification.

Who is responsible

HRN INNOVATION TECHNOLOGIES LTD, identifier CL13683, Level 2, Innovation One, DIFC, Dubai, United Arab Emirates. Our official corporate/product website is https://oyyo.one. Contact support@oyyo.one.

HRN INNOVATION TECHNOLOGIES LTD is the operator and controller for processing it determines. When an organization uses a service, it may separately control its workspace content and member access. We may process that content on its instructions under applicable arrangements; its own notice can explain its responsibilities.

Data we process and its sources

The categories below apply only when you use the relevant available feature. Data comes from you, your authorized device, your organization or collaborators, and providers you authorize. We do not require all of these categories from every visitor.

Accounts and organizations: Account/profile and authentication information, sign-in provider identifiers, access/session records, and organizational membership, roles and invitations supplied by you, your organization or your sign-in provider.
Plans and transactions: Subscription, entitlement and transaction records when relevant to your service. Announced paid plans do not mean live payment collection: checkout may be disabled, and this policy does not state that payments are currently collected.
Devices and notifications: Device enrollment, app version and operating system, push tokens, notification preferences, and delivery/open state when enabled. These come from your app/device and notification providers.
Bookings and collaboration: Booking and calendar records, availability and collaboration/share recipient metadata that you, recipients or authorized calendar providers supply.
Enquiries and support: Fields and correspondence you provide for support, early access, sales, enterprise, investor, partner, press and general contact requests, such as name, email, organization, stated interest and message. Do not send unnecessary sensitive data.
Selected online content: Content and metadata you select for online storage, sync or sharing, including the access permissions needed to deliver those features. Captured local content is not automatically included.
Connectors: Authorization data such as OAuth tokens, granted scopes and connection identifiers, and content/metadata fetched only within permissions you explicitly grant.
Usage and reliability: Privacy-safe usage/reliability events, only after optional consent where required. By policy, analytics events exclude capture content, transcripts, notes, filenames, free-text errors and account details.
Security and audit: Security, fraud-prevention and audit data, such as access/activity records, technical request information and abuse signals necessary to protect the service. These are separate from optional usage analytics and are minimized for their purpose.

Local-first AI and network features

Recording, OCR, transcription, translation, analysis, embeddings, search and summaries are designed to run on an authorized device where supported. Raw recordings stay local by default. There is no silent cloud AI fallback for captured customer content.

This does not mean no data ever leaves a device. Explicitly selected sync, storage, sharing, connectors, notifications, account functions and support require network processing. Feature availability, permissions and product-specific notices explain those choices. Local content remains under your device controls; device access, permissions and backups matter.

ASK OYYO website assistant

ASK OYYO is a website assistant, separate from local processing of captured customer content. Active messages are sent to the Lovable AI gateway to generate answers. Do not submit confidential information or sensitive personal data.

The website does not store transcripts in website accounts, its database or browser storage. Conversation state stays in memory while navigating and ends on refresh or leaving the website. Operational provider logs may still apply under provider policies; this is not a promise that providers retain no operational data.

Consented assistant analytics may measure opening and source-link interactions, never question or answer text.

Selected online storage and Horno Network

When a product enables online storage, encrypted user-selected content may use Horno Network (https://horno.net), a decentralized, high-performance encrypted storage service. This applies only to selected online storage, not all content on your device.

Horno Network is described here as storage, not an AI inference provider. Storage and share metadata necessary to operate selected features may also be processed. Encryption does not remove the need for appropriate recipient permissions or device security.

Connector permissions

Where available, connectors may include Google, Microsoft, Zoom and Slack. Each connector requires separate OAuth authorization with minimal scopes for the selected function. Login consent is not connector consent; signing in does not authorize access to your calendar, files, calls or messages.

We fetch content and metadata only within explicitly granted scopes. You can revoke a connector in the product where available and through the provider's account settings. Revocation stops future authorized access; previously selected imports may remain until you delete them. Provider terms and privacy policies also apply.

Analytics and Google/Firebase services

Google Analytics 4, measurement ID G-4X6MC8JDDN, measures consented oyyo.one website usage. Optional website analytics stay off until affirmative consent. Cookie settings in the footer lets you reject or withdraw; withdrawal stops new optional measurement and removes first-party GA cookies where technically possible. See https://oyyo.one/cookies.

Where enabled in an app, Firebase Analytics is used for consented usage/reliability events. Firebase Cloud Messaging handles push tokens and device delivery for enabled notifications; necessary delivery processing is distinct from optional analytics consent.

By policy, website and app analytics events exclude capture content, transcripts, notes, filenames, free-text errors and account details. Analytics is not a channel for captured content or support messages. App privacy settings and product-specific notices describe enabled analytics; app analytics is distinct from website cookies. We do not use analytics for advertising or personalization.

Notifications and communications

Products may provide in-app and OS notifications, including optional link/image payloads. Device registration, tokens, preferences and delivery/open state may be processed to deliver and manage these notifications. Links or images may involve network requests when displayed or opened.

Use product controls and your OS permissions to manage notifications. Optional marketing requires separate consent where required and can be withdrawn. Necessary security/account messages may still be sent when allowed by law, even if optional marketing or analytics is disabled.

Purposes and lawful bases

Where GDPR or UK GDPR applies, the basis depends on the purpose, not simply on using the service. We use the following structured baseline and apply other applicable local requirements.

Contract / service delivery: Provide requested account, membership, booking, collaboration, entitlement and selected storage/sync/share functions, and necessary service communications. Process only what is needed to deliver the requested service.
Consent: Optional analytics and marketing, and connector access where consent is the applicable basis. Connector permissions are separately granted and revocable. You can withdraw consent without affecting the lawfulness of processing before withdrawal.
Legitimate interests: Security, abuse and fraud prevention, audit, responding to support and improving service reliability, subject to necessity, balancing and your rights. This does not override required optional analytics consent.
Legal obligation: Meet applicable legal, regulatory and accounting duties and respond to lawful requests. Required processing is limited to the applicable obligation.

International processing and transfers

Our company is established in the United Arab Emirates. Service providers may process data in other countries; we do not promise a specific processing region.

Where GDPR or UK GDPR applies to an international transfer, applicable transfer requirements must be met using recognized safeguards such as adequacy decisions or appropriate contractual clauses, as relevant. This policy does not assert that a specific unverified agreement is already signed. Applicable UAE cross-border protections also remain relevant. Contact support@oyyo.one for information about safeguards applicable to your service.

Retention and deletion

We retain data only for the relevant service purpose, applicable obligations or justified security needs. We do not state a universal numeric retention period; the appropriate duration depends on the category and circumstances.

Accounts, membership and online content: Kept while needed for the account, organization or selected feature. Account/content deletion removes or de-identifies eligible online data through the service's deletion process, subject to legal/security needs and organization or recipient-controlled copies.
Subscriptions and transactions: Retained as needed for entitlement administration and applicable accounting, tax, dispute or other legal duties, only where such records exist.
Device, notification, booking and share records: Kept while needed for enrollment, delivery, preferences, bookings or collaboration. Obsolete tokens and records are removed or de-identified when no longer necessary, subject to relevant audit needs.
Connector tokens and imports: Authorization tokens are deleted when the connection is removed, subject to necessary security records. Revoke access with the provider as well. Imported or shared content requires its own deletion; disconnecting does not erase recipient-controlled copies.
Support and contact requests: Kept for responding, managing the requested relationship and resolving related issues, then removed or de-identified when no longer needed, subject to legal/security retention.
Analytics and security records: Analytics retention is governed by configured provider controls and applicable consent/deletion settings. Security/audit records are kept only as needed for protection, investigation or legal duties. ASK OYYO has no website transcript archive; provider operational logs may have their own rules.
Backups and local content: Deleted online data may persist in protected backups until normal replacement/deletion cycles, with access limited and any restoration subject to deletion controls. Local content is controlled on your device and your own backups, not automatically removed by deleting a website account.

Security and minimization

We aim to minimize collection, limit permissions and access, and use appropriate technical and organizational safeguards for the risks, including encryption for selected storage and access controls. Keep devices, credentials, share permissions and recovery methods secure.

No system, device, network or encryption arrangement is absolutely secure. Contact support@oyyo.one if you suspect an account or privacy incident; do not send passwords or unnecessary sensitive content.

Your privacy rights

Contact support@oyyo.one to exercise rights. We may proportionately verify identity and authority without collecting unnecessary information. Rights depend on applicable law and may have lawful limitations; you can also complain to the competent supervisory authority.

GDPR / UK GDPR, where applicable: Request access, correction, deletion, restriction and portability; object to qualifying processing; withdraw consent; and complain to a competent supervisory authority. Withdrawal does not affect prior lawful processing. We preserve applicable statutory response requirements.
UAE PDPL, where applicable: Request correction and applicable restriction or stopping of processing, and exercise other available rights and cross-border protections. Applicable requirements and exceptions depend on the processing and law governing it.
California CCPA / CPRA, if applicable: If statutory thresholds and applicability requirements are met, eligible consumers may know/access, delete or correct data, opt out of sale/sharing, limit qualifying sensitive personal information use, and exercise rights without unlawful discrimination. We do not claim CCPA/CPRA applies unconditionally. We do not sell personal data or share it for targeted/cross-context behavioral advertising; Global Privacy Control (GPC) is honored where legally applicable. Necessary service processing is not a sale/advertising-sharing opt-out. Authorized agents may contact us, subject to lawful verification.

Automated decisions

Unless a specific product notice says otherwise, we do not make solely automated decisions that have legal or similarly significant effects on you. AI-generated notes, suggestions and summaries are tools for your review, not binding decisions.

Children

These services are not directed to children under 16. We do not knowingly collect their personal data. A parent or guardian who believes a child has provided data should contact support@oyyo.one so we can investigate and arrange appropriate removal.

Changes and contact

We may update this policy as services or legal requirements change. The last-updated date identifies the current notice; material changes receive notice where required. Product-specific notices may supplement this policy without reducing mandatory rights.

For privacy questions, requests or concerns, email support@oyyo.one. See https://oyyo.one/terms for service terms and https://oyyo.one/cookies for website storage and consent controls.