1. Who is responsible
The controller of personal data processed through OCIS is Ozeaon OÜ (Registry Code 17484775), Tornimäe tn 5, 10145 Tallinn, Kesklinna linnaosa, Harju maakond, Estonia. Privacy contact: privacy@ozeaon.com.
This policy covers OCIS. The Ozeaon website (ozeaon.com) and Ozeaon Platform (app.ozeaon.com) have their own privacy policies, which apply when you use them, including when you confirm a mailing list subscription on the Ozeaon website.
2. Personal data we collect
Depending on the features you use, we process:
- Account data: name, email address, hashed password, account and session records, persona choice (project creator, company or both), and the date and version of the Terms and Privacy Policy you accepted.
- Ozeaon sign-in data: if you sign in with Ozeaon, the basic profile details Ozeaon shares with OCIS.
- Profile and organisation data: company name, sector and details you add to your profile.
- Project and monitoring data: project descriptions, locations and site-area polygons, dMRV reports, sensor device names and readings, ocean intelligence records, evidence files and uploaded images.
- Company and footprint data: footprint assessment inputs, funding amounts, budgets, and the resulting estimates and reports.
- AI usage data: prompts, questions and articles you submit to AI features, the generated output, and usage counts used for allowances.
- System test and backtest data: the profiles, coordinates and date ranges you test, results and report downloads.
- Mailing list data: whether you asked to join at sign-up or later, and the email address forwarded to the Ozeaon mailing list.
- Billing data: subscription status, plan and Stripe customer references. Card details are collected and stored by Stripe, not by OCIS.
- Technical data: IP address, browser and device information, request logs, security and abuse-prevention signals, and a cookie storing your theme preference.
We do not intentionally collect special category data (such as health, religion or political opinions). Please do not submit it.
3. Why we use it and our legal bases
- To create and secure your account and provide the features you use: performance of a contract.
- To process payments and manage subscriptions: performance of a contract, and legal obligations for tax and accounting records.
- To forward your address to the Ozeaon mailing list and send marketing updates: your consent, given by ticking the box at sign-up or joining later. You can withdraw it at any time by unsubscribing.
- To record your acceptance of the Terms and Privacy Policy: legitimate interests in keeping evidence of the agreement.
- To protect OCIS from bots, fraud and abuse, including captcha checks and rate limits: legitimate interests.
- To enforce free-run allowances and reuse previously computed results so identical requests do not consume AI tokens and compute twice: legitimate interests in operating efficiently.
- To improve reliability and fix errors using logs: legitimate interests.
- To comply with law and respond to lawful requests: legal obligation.
4. AI features
When you use AI features, the content you submit is sent to AI model providers through the Vercel AI Gateway to generate a response. We pass only what the feature needs. Inputs pass through automated guardrails that may redact personal data such as email addresses and phone numbers before a model sees them. We do not use your content to train AI models.
OCIS does not make decisions with legal or similarly significant effects about you based solely on automated processing.
5. What is public
Projects you publish, including their location and site area, and the profile details you choose to show in the member directory are visible to anyone. Assessments, footprint reports, system tests, sensor keys, billing information and your email address are private to your account.
Results computed for the shared hypothetical system-test profile contain no personal data and may be reused for other accounts requesting the same inputs.
6. Service providers we use
We share personal data only with providers that help us run OCIS, under data processing terms:
- Vercel Inc. (United States): hosting, delivery, serverless functions, file storage (Vercel Blob) and the AI Gateway.
- AI model providers reached through the Vercel AI Gateway: generating AI responses.
- Neon (database hosting): storage of account and application data.
- Stripe (Ireland / United States): payments and subscription billing.
- Cloudflare, Inc. (United States): Turnstile bot protection on sign-in and sign-up.
- Resend (United States): transactional emails such as password resets.
- Ozeaon website (ozeaon.com), operated by the same controller: mailing list double opt-in, only if you ask to join.
- Map and data providers such as Esri basemap tiles and Copernicus Marine Service: your browser or our servers request map tiles and ocean data for coordinates; no account information is sent.
Authentication runs on Better Auth, self-hosted on our own infrastructure. We do not sell personal data or share it for advertising.
7. International transfers
Some providers process data outside the European Economic Area, including in the United States. Where they do, we rely on safeguards such as the EU-U.S. Data Privacy Framework, Standard Contractual Clauses or adequacy decisions. Contact us for details of the safeguard for a given provider.
9. How long we keep data
- Account, project, assessment and report data: for the life of your account. Deleting your account removes your projects, assessments, dMRV reports, summaries and bookmarks, subject to backups that expire on a rolling basis.
- Billing records: as long as required by accounting and tax law (generally 7 years in Estonia).
- Terms acceptance records: for the life of the account and up to 3 years afterwards, to evidence the agreement.
- Technical and security logs: up to 12 months, unless needed longer for an active investigation.
- Mailing list data: held by the Ozeaon website until you unsubscribe, as described in its privacy policy.
10. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you
- correct inaccurate data
- delete your data, including by deleting your account in settings
- restrict or object to certain processing, including processing based on legitimate interests
- withdraw consent at any time, for example by unsubscribing from the mailing list
- receive your data in a portable format, including through the CSV exports in your dashboard
Contact privacy@ozeaon.com to exercise these rights. We reply within one month, extendable by two months for complex requests, and may need to verify your identity.
You may also complain to a data protection authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia.
11. Security
We use encrypted connections, hashed passwords and sensor keys, owner-scoped database queries, bot protection and baseline security headers. No system is perfectly secure; if you believe your account is compromised, contact us immediately.
12. Children
OCIS is not intended for anyone under 18 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
13. Changes to this policy
We will update this policy as OCIS develops, including before launching features that process personal data in new ways. The "last updated" date shows the current version, and we will notify you of material changes.