Privacy Policy

Last updated: September 2026

Our commitment

myOolala is built on a simple principle: your data is yours. We do not sell, rent, or share your personal information with third parties for advertising purposes.

Data controller

The data controller for the personal data processed through myOolala is Oolala Next FZ-LLC, a free-zone limited liability company registered in Ras Al Khaimah, United Arab Emirates. You can reach us for any privacy-related question at privacy@myoolala.com.

What we collect

• Account data — Email address and password (hashed) for authentication. Optionally, if you sign in with Google or Apple, we receive the identifiers those providers return (email, name, provider user id).
• Profile data — Display name, handle, bio, avatar, country flags, links, socials, phone numbers, and any other content you choose to publish on your public profile.
• Wallet pass data — When you generate an Apple Wallet or Google Wallet pass, a per-device registration record is created (push token, serial number, view identifier) so we can push updates to the pass on your card.
• Payment data — If you subscribe to a paid plan or make a purchase, payments are handled by our processor Stripe. We store only a Stripe customer identifier and a subscription identifier on our side; we never store your card details.
• Usage analytics — Anonymous, aggregate page views via Plausible Analytics (no cookies, no personal tracking, no cross-site fingerprinting).
• Technical logs — Server-side logs of requests and errors (timestamp, HTTP status, endpoint, non-identifying request metadata) kept for a short retention window for security and debugging.

What we do NOT collect

• No cookies for tracking or advertising.
• No third-party trackers (Google Analytics, Facebook Pixel, etc.).
• No fingerprinting or cross-site tracking.
• No selling of personal data to third parties.

Legal basis for processing (GDPR Article 6)

• Performance of a contract (Art. 6.1.b) — account creation, authentication, profile hosting, wallet pass generation, and paid-plan billing are necessary to provide the service you asked for.
• Legitimate interest (Art. 6.1.f) — server logs, security monitoring and anonymous aggregate analytics via Plausible, to keep the service running, secure, and understand overall usage. You may object at any time (see "Your rights" below).
• Consent (Art. 6.1.a) — for any optional processing you actively opt into (for example enabling a specific integration in your dashboard). Consent can be withdrawn at any time without affecting the lawfulness of prior processing.
• Legal obligation (Art. 6.1.c) — retention of billing records where applicable tax or accounting law requires it.

Retention

• Account and profile data — kept for as long as your account exists. Deletion of your account removes this data from our production database (see "Your rights" below).
• Wallet pass registrations — kept while the pass is installed on a device. Unregistration by the device or account deletion removes the record.
• Payment / billing records — kept for the duration required by applicable tax and accounting law (typically up to 10 years for invoicing records in the EU), then deleted.
• Server logs — kept for a short operational window (typically 30 days) for security and debugging, then rotated out.
• Backups — encrypted daily backups are kept by our hosting provider on a rolling window (typically 7 days) and cannot be individually redacted; residual data in a backup is overwritten as the window rolls forward.

Sub-processors

We rely on the following processors to operate the service. Each of them acts under a written data processing agreement and provides its own privacy documentation:

• Supabase — database, authentication, edge functions, file storage.
• Vercel — static hosting, CDN, edge routing.
• Stripe — payment processing.
• Plausible — cookieless analytics.
• Apple — Apple Wallet pass delivery and Apple push notifications (if you install a pass on an Apple device).
• Google — Google Wallet pass delivery and Google authentication (if you use those features).

Data storage

Your data is hosted on Supabase infrastructure (AWS), in the eu-central-2 region (Zurich, Switzerland). All data is encrypted in transit (TLS) and at rest.

International data transfers

Because our hosting region is located in Switzerland — outside the European Union and European Economic Area — your personal data is transferred to a third country within the meaning of Articles 44 et seq. of the GDPR. The legal basis for this transfer is the European Commission's adequacy decision for Switzerland (Article 45 GDPR), which recognises Switzerland as providing a level of data protection essentially equivalent to that guaranteed in the EU/EEA.

Some of our sub-processors (Stripe, Vercel, Apple, Google) may process limited technical data in other jurisdictions. Where they do, they operate under Standard Contractual Clauses (Article 46 GDPR) or their own adequacy framework.

Your rights under the GDPR

If the GDPR (or an equivalent law in your country) applies to you, you have the following rights over your personal data:

• Right of access (Art. 15) — obtain confirmation whether we process your data and receive a copy of it.
• Right to rectification (Art. 16) — correct inaccurate or incomplete data. Most fields can be updated directly from your dashboard.
• Right to erasure (Art. 17) — request deletion of your account and associated data. Available in one click from the dashboard (Settings → Delete account).
• Right to restriction of processing (Art. 18) — ask us to limit processing in specific circumstances.
• Right to data portability (Art. 20) — receive your profile data in a structured, machine-readable format. Available on request at privacy@myoolala.com.
• Right to object (Art. 21) — object to processing based on legitimate interest, including profiling.
• Right to withdraw consent (Art. 7.3) — for any processing based on consent, at any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint (Art. 77) — with the data protection authority of your country of residence. In France, that authority is the Commission Nationale de l'Informatique et des Libertés (CNIL).

To exercise any of these rights, email privacy@myoolala.com. We reply within 30 days (extendable by two months for complex requests, with an interim explanation). No specific form is required; a plain-text email stating what you want is enough.

Data Protection Officer

We are not required to appoint a Data Protection Officer under Article 37 GDPR at our current scale. Privacy questions are handled directly by the company's management at privacy@myoolala.com.

Security

We rely on TLS 1.2+ for data in transit, encryption at rest for the database and backups, row-level security policies for all user tables, and strict least-privilege access on our infrastructure. Passwords are hashed and stored by our authentication provider (Supabase Auth); we never see or store them in clear text.

Children

myOolala is not directed to children under 16. We do not knowingly collect personal data from a child under 16. If you become aware that a child has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time to reflect changes in the service, our sub-processors, or applicable law. Substantive changes will be flagged with an updated "Last updated" date at the top of this page and, where required, communicated to registered users.

Contact

Questions about privacy? Email privacy@myoolala.com.