Privacy notice
Last updated 13 November 2026
Owoeyo is run by Owoeyo. This notice explains what personal data we handle when you use owoeyo.app, and what we do with it. Write to [email protected] with any question.
The short version
- We collect what you give us to run your invoices and jobs, and nothing else. No advertising, no tracking, no analytics, and we never sell data.
- Documents you make without an account stay in your browser. Nothing is uploaded unless you sign in and choose to save them.
- Bank statement lines you save are encrypted. Forwarded bank-alert emails are read for the payment's details and never kept.
- A contract you ask us to review is sent to our AI provider for that review only, and isn't kept, by us or used to train any model.
- Delete your account in Settings and everything in it is deleted at once.
Two roles
For your own account (your email, your sign-in, your plan) we are the controller. For the details you put in about your clients (their names, emails, addresses, and the invoices and jobs you share with them) you are the controller and we are your processor: we handle them only to run Owoeyo for you.
What we collect, and why
- Your account: your email address and name, to sign you in with a one-time code and to send you what you ask for. Lawful basis: our contract with you.
- What you put in: your business details, logo and bank details, your clients, invoices, quotes, projects, hours, bills and payments. Lawful basis: our contract with you.
- Bank statements you save: each line is read on your device, matched on our server, and stored encrypted with a key for your account alone.
- Forwarded bank alerts and payment emails (to your private address at in.owoeyo.app): we read the amount, date and payer, keep those facts as evidence that a payment arrived, and discard the email itself.
- What your clients do on their link: when they open it, sign, approve, ask a question, promise a date or report a problem, so you can see it. They don't need an account.
- Payment for Owoeyo: handled by Polar, who is the seller of record. We learn your plan and whether it's paid; we never see your card.
- Keeping it working: your IP address is used, in memory only, to limit how fast requests can come; error reports have email addresses, links, codes and long numbers removed before they leave the server. Lawful basis: our legitimate interest in a secure, working service.
On your device only
Without an account, the documents you make, your business details and logo, and the timer are kept in your browser's storage, not on our servers. When you sign in we ask before copying any of them to your account. See Storage and cookies.
Who helps us run Owoeyo
These companies process personal data for us, each only for the task named, under a contract that requires them to protect it:
- Datalix: the servers Owoeyo runs on, in Germany.
- Cloudflare: our domain's DNS, and the encrypted copies of our backups (stored in the EU).
- Resend: sending email (sign-in codes, and on Pro, the invoices, proposals and reminders you send to clients), and receiving forwarded bank alerts.
- Polar: taking payment for Owoeyo plans and credits, as seller of record.
- Normfluss: making an invoice's PDF accessible, when you or your client ask for that.
- Anthropic, through our own AI gateway: reading a contract you ask us to review. See the AI disclosure.
Some of these are based outside the UK and EU. Where data leaves them, it's covered by the UK and EU standard contractual clauses or an adequacy decision. We'll update this list before adding anyone new.
How long we keep it
- Your account and everything in it: until you delete it. Deleting is immediate.
- Backups: copies of the database are kept for up to six months. If one is ever restored, every account deleted since is deleted again before anyone can use it: we keep a one-way fingerprint of the deleted account's email for this, never the email itself.
- Sign-in codes expire after 10 minutes; a sign-in lasts 30 days unless you sign out.
- Records of emails sent for you stay with your account, so you can see what was sent and when.
Your rights
You can see and correct everything in your account at any time, and export it (every invoice as CSV, and the accountant pack). You can delete your account and everything in it from Settings. You can also ask us for a copy of your data, to correct or erase it, to restrict or object to how we use it, or to move it elsewhere: write to [email protected] and we'll answer within a month.
If your client asks about data you hold about them in Owoeyo, that's for you to answer as their controller; we'll help. You can also complain to your data protection authority: the ICO in the UK, the Nigeria Data Protection Commission in Nigeria, or the authority where you live in the EU.
Security
Everything travels over HTTPS. Statement lines are encrypted at rest with a key per account. Invoices are signed, so a changed copy can be detected. Access to the servers is by key only. If something ever goes wrong with your data, we'll tell you and the authority as the law requires.
Children
Owoeyo is for people running a business, aged 18 or over.
Changes
When this notice changes in a way that matters, we'll email account holders before it takes effect.