Privacy Policy

Information we collect

• Business and staff account information — name, business name, email address, phone number, role, login credentials, and business settings such as hours, services, and pricing.
• Client contact information — names, phone numbers, email addresses, and any notes or preferences a Business records about its clients.
• Appointment and service data — bookings, cancellations, waitlists, consultations, forms and consents, service history, and photos a Business chooses to upload.
• Messages and communications — the content and metadata of messages exchanged through the platform over SMS, web chat, Facebook Messenger, and Instagram, as well as email notifications and voice receptionist call records and transcripts where enabled.
• Payment records — transaction amounts, dates, deposit and invoice status, and limited card metadata (such as brand and last four digits). Full card numbers are handled by our third-party payment processors and are not stored by ooviie.
• Technical and usage data — IP address, device and browser information, log data, and product usage events used for security, diagnostics, and reliability.

How we use information

• Provide the Service: scheduling and managing appointments, client records, and payments.
• Send and receive messages on behalf of a Business, including confirmations, reminders, and replies.
• Generate AI assistant and virtual receptionist responses for the connected Business.
• Deliver notifications to Businesses and their clients across email, SMS, chat, and push.
• Provide reporting and analytics to the Business about its own operations.
• Maintain security, prevent fraud and abuse, troubleshoot, and comply with legal obligations.

We do not sell personal data, and we do not use client message content for advertising or to train general-purpose AI models.

Third-party services

We share data with service providers only as needed to run the platform:

• Meta Platforms, Inc. — to send and receive Facebook Messenger and Instagram direct messages for a connected Business Page or account.
• SMS and voice providers (Twilio-class carriers and telephony vendors) — to deliver text messages and phone calls.
• Payment processors — to process card payments, deposits, and payouts. These providers act as independent controllers of the payment data they collect.
• AI providers — to generate assistant and receptionist responses. Message content is sent to these providers only to produce a response for the Business.
• Email delivery, hosting, database, and error-monitoring providers — to host and operate the platform.

We may also disclose information when required by law, to enforce our terms, or in connection with a merger, acquisition, or sale of assets (with continued protection of personal data).

Data received from Meta Platforms

When a Business connects its Facebook Page or Instagram professional account, we receive data from Meta Platforms including message content, sender-scoped IDs (PSID/IGSID), the sender's public profile name and picture where provided, timestamps, and Page or account identifiers.

This data is used solely to provide messaging services to the connected Business — displaying conversations in that Business's inbox, generating and sending replies, and creating or updating the related client record and appointment. We do not sell this data, do not share it with data brokers, do not use it for advertising or profiling, and do not use it to train general-purpose AI models. Data received from Meta Platforms is handled in accordance with the Meta Platform Terms, the Messenger Platform Policy, and Instagram Messaging policies, and is deleted on request or when the connection is removed, as described below. A Business can disconnect its Facebook or Instagram channel at any time from the Channels settings page, which stops further data collection from Meta.

Data retention

We retain personal data for as long as the Business's account is active and the data is needed to provide the Service. When a Business closes its account, we delete or de-identify its data within 90 days, except where a longer period is required for legal, tax, accounting, or fraud-prevention purposes. Message and call logs are retained for operational and dispute-resolution purposes and then deleted on a rolling schedule. Backups are purged on their normal cycle.

Data Deletion

You may request deletion of your personal data at any time. If you are a client of a Business, you can email that Business directly, or email us at hello@ooviie.com and we will route your request to the Business that holds your record. Businesses may email the same address to request deletion of their workspace.

What happens after you request deletion:

• We verify the request and identify the records associated with you.
• We delete your personal data from the platform — including contact details, appointment history, uploaded photos and forms, and message content received from SMS, web chat, Facebook, and Instagram — within 30 days of a verified request.
• We instruct our service providers to delete data they hold on our behalf where applicable.
• We may retain a limited set of records where required by law — for example transaction and tax records, consent and opt-out records needed to honor your preferences, and security logs. These are kept only as long as legally required and are not used for any other purpose.

To request deletion of data associated with a Facebook or Instagram conversation specifically, email hello@ooviie.com with the subject "Meta data deletion" and the Page or account you messaged; we will confirm once deletion is complete.

Your choices and rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can exercise these rights by emailing hello@ooviie.com. You can opt out of marketing messages at any time by replying STOP to a text message or using the unsubscribe link in an email; transactional messages such as appointment confirmations may continue unless you ask the Business to stop them.

Security

We use encryption in transit and at rest, access controls, tenant isolation, and least-privilege credentials to protect personal data. Access tokens for connected channels are stored encrypted. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify affected parties as required by law.

Children

The Service is not directed to children under 13, and we do not knowingly collect their personal data. A Business may record a minor client's appointment details with parental consent; those records are the Business's responsibility.

International users

ooviie is operated from the United States, and personal data is processed there. If you access the Service from outside the United States, you understand your data may be transferred to and processed in the United States.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a new effective date.

Contact

ooviie LLC — hello@ooviie.com
See also our Terms of Service.