Privacy Policy

“Oleracore”, “we” and “us” mean [LEGAL ENTITY NAME AND REGISTERED ADDRESS TO BE ADDED]. We provide a customer support platform to businesses (“customers”). For the support conversations and customer records that a business keeps in Oleracore, that business decides what is collected and why, and we process the data on its behalf. For account, billing and security data about the people who use Oleracore, we are responsible for the data.

• Account details: your name, work email address, role, and a salted hash of your password (we never store the password itself). If you turn on two-factor authentication, we store an encrypted secret and hashed backup codes.
• Company details: your company name and the optional profile details you enter, such as its domain, support email, time zone and logo.
• Support content: tickets, messages, customer names and email addresses, knowledge-base articles and files that you or your team add to Oleracore.
• Billing details: your plan, subscription status and invoices. Card details are entered directly with our payment provider; they do not pass through our servers, and we only keep the card brand, last four digits and expiry date for display.
• Security and usage records: when you were last active, the browser and IP address of each signed-in session, and an audit log of changes made in your account.

To provide and secure the service, to send the emails the service needs (for example verification, password reset, invitations, and alerts you have switched on), to bill for paid plans, to answer your questions, and to keep the platform reliable. We do not sell personal data.

We use a single essential session cookie to keep you signed in. It is not used for advertising. At the time of writing we do not run advertising or third-party analytics trackers on the website. [REVIEW THIS SECTION IF THAT CHANGES.]

We use a small number of service providers to run Oleracore. They process data only to provide their service to us:

• Supabase, which hosts our database and private file storage (our database is in the EU, in Ireland).
• Stripe, which processes payments.
• Resend, which delivers the emails we send.
• Vercel and Railway, which host the website and the application servers.

[ADD DETAILS OF INTERNATIONAL TRANSFERS AND SAFEGUARDS WHERE PROVIDERS PROCESS DATA OUTSIDE YOUR REGION.]

We keep account and support data while your account is active. When a company is deleted it is deactivated immediately and can be restored for 30 days; after that its data is permanently erased. Deleted knowledge-base articles follow the same 30-day window. We keep invoice records for as long as accounting and tax rules require.

You can ask us to access, correct, export or delete personal data we hold about you, and to restrict or object to certain processing, subject to applicable law. Account owners can download an export of their company's data from the product. To make a request, contact us at the address below. If you believe we have mishandled your data you may also complain to your local data-protection authority.

We take reasonable technical and organisational measures to protect data. See our Security page for how the platform is protected. No system is perfectly secure, and we cannot guarantee absolute security.

We may update this policy and will change the date below when we do. Questions about privacy: [PRIVACY CONTACT EMAIL TO BE ADDED].

Last updated: [DATE TO BE ADDED].