Privacy Policy
Effective date: [15 July, 2026] | Last Updated: [05 October, 2026]
1. Introduction and Scope
Ovelah ("Ovelah", "we", "us", "our") provides business operations software that helps companies manage clients, locations, jobs, quotations, invoices, expenses, assets and reporting. This Privacy Policy explains how we collect, use, store, share and protect information when you:
- visit our website at ovelah.com ("Website");
- request a demo, contact us, or start a free trial; and
- use the Ovelah software, including the Ovelah ERP platform ("Services").
By using the Website or the Services, you acknowledge that you have read this Policy. If you do not agree with it, please do not use them.
This Policy applies to information about our visitors, prospects, and customer account holders and their authorized users. It does not cover information held by third-party websites we may link to.
2. Who We Are and Our Role
Ovelah
Islamabad, Pakistan
Operated by [ADD OWNER / OPERATOR FULL NAME]. Business registration is currently pending. [UPDATE WITH LEGAL ENTITY NAME AND REGISTRATION NUMBER ONCE REGISTERED]
Email: contact@ovelah.com
We act in two different roles, depending on the data involved:
- As a data controller, for information about our own website visitors, prospects, customer account holders and billing contacts. We decide why and how this information is used.
- As a data processor (service provider), for the business data our customers store in the Services, such as their own clients' names, addresses, job details, quotations and invoices ("Customer Content"). Our customer decides what is stored and why. We process Customer Content only to provide the Services, following the customer's instructions and our agreement with them.
If you are a client of one of our customers, that business is responsible for how your information is collected and used. Please contact them directly for requests about your data.
3. Information We Collect
3.1 Information you give us directly
- Account and profile information: name, work email address, phone number, company name, job title, role, and login credentials.
- Demo, contact and trial requests: the details you enter in our forms and anything you write in your message.
- Billing information: billing name, billing address, tax or registration numbers, subscription plan, and payment status. No payment card details are required to start a free trial. [CONFIRM HOW PAID SUBSCRIPTIONS ARE COLLECTED, e.g., bank transfer or invoice. If a card or payment processor is introduced later, this Policy will be updated and the processor added to Section 7.1.]
- Communications: emails, support requests, feedback and survey responses you send us.
3.2 Customer Content
Customer Content is information that customers and their authorized users enter into the Services. Depending on how the customer uses Ovelah, it may include:
- client and contact records (names, phone numbers, email addresses);
- site and location details, including addresses and map coordinates;
- jobs, work notes, schedules and technical documentation;
- quotations, invoices, balances, expenses and asset records;
- uploaded files or attachments. [CONFIRM IF FILE UPLOAD EXISTS]
Customer Content is stored in encrypted form. See Section 4.
3.3 Information collected automatically
When you use the Website or the Services, our systems and our infrastructure provider may automatically record limited technical data, such as:
- IP address and approximate location derived from it;
- browser type, device type and operating system;
- pages visited, referring page, and date and time of requests;
- security and error logs, and diagnostic information.
We use this to keep the Services secure, diagnose problems and understand basic usage.
3.4 Cookies and similar technologies
At the time of this Policy, our Website does not use cookies for advertising, analytics or tracking. If that changes, we will update this Policy and, where required by law, ask for your consent first. See Section 9.
3.5 Information we do not intentionally collect
We do not ask for sensitive personal data such as health information, biometric data, political or religious beliefs, or national identity numbers. Please do not enter this kind of information into the Services unless it is genuinely necessary for your business and lawful for you to do so. We do not knowingly collect information from anyone under 18 (see Section 14).
4. Encryption of Customer Content
We designed the Services so that Customer Content is stored in encrypted form, and Ovelah staff cannot read it in the ordinary course of providing the Services.
To be transparent about what this means and where its limits are:
- What is protected: the content of your business records (Section 3.2) is encrypted before it is stored. [CONFIRM THE TECHNICAL DESIGN: whether encryption is end-to-end or client-side, who holds the keys, and which fields are encrypted.]
- What is not covered: certain operational data must remain readable by our systems for the Services to work, such as account email addresses, subscription and billing status, and technical logs. This data is handled under the rest of this Policy.
- Access: we do not access Customer Content except where (i) the customer gives us explicit permission to troubleshoot an issue, (ii) it is strictly required to maintain the security or integrity of the Services, or (iii) we are legally compelled to do so. Because of the encryption design, we may be technically unable to provide readable Customer Content even if asked. [CONFIRM]
- Lost access: if encryption credentials or keys controlled by a customer are lost, Ovelah may be unable to recover the data. [CONFIRM AND CROSS-CHECK WITH TERMS OF SERVICE]
No system is completely secure, and we cannot promise absolute security, but we take the protection of Customer Content seriously.
5. How We Use Information
We use information for the following purposes:
| Purpose | Examples |
|---|---|
| Provide the Services | Create and manage accounts, host and process Customer Content, enable features |
| Onboarding and support | Run demos and trials, respond to questions, troubleshoot |
| Billing | Manage subscriptions, invoices, refunds and taxes |
| Security and fraud prevention | Detect abuse, protect accounts, investigate incidents |
| Improve the Services | Fix bugs, plan features, analyze aggregated, non-content usage |
| Communications | Service notices, security alerts, policy updates, and (where permitted) product updates |
| Legal compliance | Meet legal, tax and regulatory duties, and respond to lawful requests |
We do not sell personal information. We do not use Customer Content for advertising, and we do not use it to train AI models. [CONFIRM]
6. Legal Bases for Processing
Where applicable data protection laws require a legal basis (for example, the GDPR or UK GDPR for users in those regions), we rely on:
- Contract: processing needed to deliver the Services you signed up for;
- Legitimate interests: securing and improving the Services, preventing fraud, and communicating with business contacts, balanced against your rights;
- Legal obligation: compliance with tax, accounting and other laws; and
- Consent: where required, for example optional marketing or non-essential cookies, which you can withdraw at any time.
7. How We Share Information
We share information only as described below.
7.1 Service providers (sub-processors)
We use trusted third parties to operate the Services. They may process data only on our instructions and under confidentiality and security obligations.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Cloudflare, Inc. | Hosting, content delivery, network security, data storage | Encrypted Customer Content, account data, technical logs | Japan (Asia region) |
Cloudflare is currently the only third-party platform that hosts or processes our data. We do not currently use separate providers for analytics, advertising, payment processing or error tracking. If we add a provider in the future, we will add it to this list and notify customers of material changes. [NOTE: Emails you send to contact@ovelah.com are also handled by whichever email service hosts that mailbox. ADD IT HERE IF IT IS A THIRD PARTY.]
7.2 Legal and safety reasons
We may disclose information if we believe in good faith that it is required by law, court order or government request, or necessary to protect the rights, property or safety of Ovelah, our customers or others. Where we receive such a request for Customer Content, we will, where lawful, direct the requester to the relevant customer, and note that readable access may not be technically possible (Section 4).
7.3 Business transfers
If Ovelah is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction. We will give notice before personal information becomes subject to a materially different privacy policy.
7.4 With your consent
We may share information for other purposes when you ask us to or give consent.
8. Data Hosting and International Transfers
Our data is hosted on Cloudflare infrastructure in Japan, within the Asia region. We chose an Asian hosting region to serve our customers in Pakistan and the wider region with good performance.
Ovelah is based in Pakistan, and our customers may be located in Pakistan or in other countries. This means your information may be transferred to, stored in, and accessed from countries other than your own, including Pakistan and Japan, which may have different data protection laws than your country.
Where required by law, we use appropriate safeguards for international transfers, such as contractual protections with our providers. [ADD: standard contractual clauses or equivalent mechanisms if you serve EU/UK customers.]
9. Cookies and Similar Technologies
Our Website currently does not set cookies for analytics, advertising or tracking. Our infrastructure provider may use security-related or technically necessary mechanisms (such as those used to protect against attacks), and the Services may use strictly necessary browser storage to keep you signed in. [CONFIRM]
If we introduce analytics or other non-essential cookies, we will update this Policy and, where legally required, request your consent through a clear banner before setting them.
10. Data Retention and Deletion
| Data | How long we keep it |
|---|---|
| Customer Content | While the account is active. After cancellation or termination, it remains stored but locked and inaccessible for 30 days, giving the customer time to reactivate or request export. After that, it is permanently deleted. |
| Account and billing records | While the account is active and afterward for as long as needed for tax, accounting and legal requirements [ADD PERIOD, e.g., 6 years] |
| Demo and contact requests | Up to [ADD PERIOD, e.g., 24 months] from the last interaction, unless you become a customer |
| Security and technical logs | [ADD PERIOD, e.g., 90 days] |
| Backups | Deleted copies may persist in backups for up to [ADD PERIOD, e.g., 30 days] before being overwritten |
Free trial accounts that are not converted to a paid plan are handled in the same way as cancelled accounts. We may keep anonymized or aggregated information that can no longer identify a person.
If a customer needs an export of their data, they should ask us before the 30-day period ends. [CONFIRM EXPORT PROCESS]
11. Security
We use technical and organizational measures designed to protect information, including:
- encryption of Customer Content at rest [CONFIRM], and encryption of data in transit using TLS;
- access controls and the principle of least privilege for our team;
- infrastructure-level protections provided by Cloudflare;
- monitoring for suspicious activity; and
- confidentiality commitments from our personnel and providers.
You also play a part: keep your password and any encryption credentials confidential, use strong unique passwords, and tell us immediately if you suspect unauthorized access.
Data breaches: If we become aware of a breach affecting personal information, we will investigate promptly, take steps to contain it, and notify affected customers and, where legally required, authorities, without undue delay. [CONFIRM TARGET NOTIFICATION TIME, e.g., within 72 hours of confirmation]
12. Your Rights and Choices
Depending on where you live and the law that applies, you may have the right to:
- Access the personal information we hold about you;
- Correct inaccurate or incomplete information;
- Delete your information, subject to legal retention duties;
- Restrict or object to certain processing;
- Data portability, meaning receive your data in a usable format;
- Withdraw consent where processing is based on consent; and
- Complain to a data protection authority in your country.
How to exercise them: email contact@ovelah.com with the subject "Privacy Request". We may need to verify your identity. We aim to respond within 30 days, and will let you know if we need more time. We will not charge a fee unless requests are clearly excessive or repetitive.
Customer Content: if your request concerns information that a customer of ours stored about you, we will redirect you to that customer, because they control that data.
Marketing: you can unsubscribe from marketing emails at any time using the link in the message or by contacting us. We will still send essential service notices.
13. Customer Responsibilities for Customer Content
Customers that use the Services to store information about their own clients and staff are responsible for:
- having a lawful basis and any required consents or notices to collect and use that information;
- ensuring it is accurate and used lawfully; and
- responding to requests from the people whose data they hold.
Our Terms of Service describe these responsibilities in more detail. Customers that need a data processing agreement can request one at contact@ovelah.com.
14. Children's Privacy
The Website and Services are for businesses and are intended for people 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with information, contact us and we will delete it.
15. Third-Party Links
The Website may link to other sites, including social platforms. We do not control them and are not responsible for their privacy practices. Please read their policies.
16. Changes to This Policy
We may update this Policy from time to time. We will post the new version here with a new "Last updated" date. For material changes, we will give notice, for example by email to account holders or a notice on the Website, before the change takes effect where practicable. Continued use after the effective date means you accept the updated Policy.
17. Governing Law
This Policy is governed by the laws of Pakistan, without limiting any mandatory data protection rights you have under the laws of your own country.
18. Contact Us
Ovelah
Islamabad, Pakistan
Email: contact@ovelah.com
For privacy questions, requests or complaints, write to the email above with the subject line "Privacy".