Privacy Policy

The data controller is Asidik Ltd, registered at The Old School, Burford Road, Black Bourton, Bampton, Oxfordshire, United Kingdom, OX18 2PF (company number 10264436, registered in England and Wales).

OhYeh provides operations, task, client, reminder, and team workflow software for small businesses. This Privacy Policy explains how we collect and use information when you visit ohyeh.io, create an account, or use the OhYeh application.

Information we collect

• Account information: your name, email address, profile image, and sign-in details from Google authentication.
• Workspace information: organizations, team members, roles, permissions, tasks, clients, entities, notes, reminders, checklists, alert settings, and related content you add to OhYeh.
• Billing information: subscription tier, billing status, customer and subscription identifiers, invoices, and payment events from Stripe. We do not store full payment card numbers.
• Communications: support requests, feedback, invitations, notification preferences, email delivery logs, and messages needed to operate the service.
• Technical and usage information: device, browser, pages viewed, product interactions, approximate location from network data, logs, analytics events, and campaign attribution such as UTM fields or ad click identifiers when analytics are enabled.

How we use information

We use information to:

• provide, secure, and maintain the service;
• authenticate users and keep them signed in;
• support organizations, team permissions, task assignment, reminders, and notifications;
• process subscriptions, trials, invoices, cancellations, and billing support;
• send transactional emails such as invitations, reminders, alerts, and account messages;
• understand and improve product performance, reliability, and usability;
• detect abuse, investigate security issues, and enforce our Terms of Service; and
• comply with legal obligations.

Cookies and analytics

We use cookies and similar technologies for authentication, organization selection, security, and preferences. Optional PostHog browser analytics is off unless you explicitly allow it. If allowed, we collect sanitized page templates without URL queries or fragments, selected product interactions, coarse performance measurements, stable account and workspace identifiers, and campaign attribution. Sensitive routes such as invitation acceptance are excluded. Authenticated-app autocapture, form-text capture, and session replay are disabled. We do not intentionally send names, email addresses, organization names, task titles, notes, invite tokens, error messages, or stack traces to browser analytics. See our Cookie Policy for more detail.

Legal bases

Where UK or EEA data-protection law applies, we rely on: performance of a contract to provide accounts, workspaces, billing, and requested communications; legitimate interests to secure and improve the service and prevent abuse, balanced against your rights; legal obligations for records we must keep; and consent for optional PostHog browser analytics. You can withdraw analytics consent at any time without affecting earlier lawful processing.

How we share information

We do not sell personal information. We share information with service providers only as needed to operate OhYeh, including Cloudflare for hosting, storage, and security; Google for authentication; Stripe for billing; Resend for email delivery; PostHog for analytics when enabled; and Payload CMS for marketing content.

We may also disclose information if required by law, to protect rights and safety, to investigate abuse or security incidents, or as part of a business transfer such as a merger or acquisition.

Data retention

We keep account and workspace information while your account or organization is active. We may retain some information for longer where needed for security, backups, legal obligations, dispute resolution, billing, or legitimate business records. Browser campaign attribution and PostHog persistence are configured for up to 90 days. Under the standard PostHog Cloud setting, analytics events are retained for up to 12 months and may be deleted earlier. You may request deletion by contacting us, subject to legal and operational retention requirements.

Security

We use technical and organizational safeguards designed to protect personal information, including access controls, encryption in transit, provider-level storage protections, and least-privilege operational access. No internet service can guarantee perfect security, but we work to reduce risk and respond promptly to issues.

Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, export, or object to certain uses of your personal information. You can update some information in the product, change notification preferences, change optional analytics in Settings → Privacy & analytics, disable cookies in your browser, or contact us for help. You may also have the right to restrict processing, withdraw consent, and complain to a supervisory authority. In the UK, this is the Information Commissioner's Office at ico.org.uk.

There is no self-service personal-data or workspace-data export control. To make a privacy rights request, email hello@ohyeh.io from the email address on your OhYeh account where possible and describe the request. We may ask for information needed to verify your identity and will respond within the time required by applicable law.

A manual export of workspace content is separate from an individual privacy rights request. Before access ends, a workspace owner should email the same address with the workspace name and the data needed. We will verify their authority and confirm the available scope, format, secure delivery method, and timing. Cancelling a subscription does not automatically submit an export or deletion request.

International processing

OhYeh and its service providers may process information in the United States, United Kingdom, European Union, and other locations where our providers operate. Where required, we use appropriate safeguards such as an adequacy decision or approved contractual protections.

Children

OhYeh is not intended for children under 13, and we do not knowingly collect personal information from children.

Changes

We may update this Privacy Policy as the service changes. If changes are material, we will take reasonable steps to notify users, such as updating this page or sending an account notice.

Contact

Questions or requests about privacy: hello@ohyeh.io, or write to The Old School, Burford Road, Black Bourton, Bampton, Oxfordshire, United Kingdom, OX18 2PF.