1. Who we are
Ooky is a product of CloudWeld LLC ("CloudWeld", "we", "us"). We operate the ooky.ai marketing site, the Ooky web application, and the edge infrastructure that serves structured brand intelligence to AI bots.
For privacy questions, the data controller of record is CloudWeld LLC. Reach us at hello@ooky.ai.
2. What we collect
Account and billing data
When you create an account we store:
- Your name, work email, and (via Firebase Authentication) a password hash or federated identity token.
- Your organization name, role, and team membership.
- Billing contact details and subscription status. Payment card data is handled by our payments processor: we never see or store it.
Product usage data
- Domains you connect, crawl settings, declared facts, and generated brand intelligence.
- Crawled pages from domains you explicitly add: public content only, fetched with a standard user agent, respecting
robots.txt. - Audit logs of actions inside your workspace.
Edge / bot-event data
The Ooky Cloudflare Worker sits on your domain and logs requests from AI bots (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, etc.). For each bot request we record:
- Timestamp, path requested, user agent, and the response Ooky served.
- A hashed IP prefix for abuse detection. We do not store full IPs.
- Human page traffic passes through to your origin unchanged. When a person arrives from a recognized AI service, Ooky may record a referral event containing the destination path, classified AI source, country when supplied by the edge, and the referrer's origin only; query strings and fragments are discarded.
Marketing-site data
When you visit ooky.ai we collect standard analytics events and basic
device info (browser, OS, referrer). If you submit a form (contact, demo, newsletter)
we collect the fields you fill in. See Sub-processors
for the exact tools.
3. How we use it
- Run the product: authenticate you, generate and serve intelligence, operate the edge.
- Bill you: process subscriptions, issue invoices, prevent fraud.
- Support you: respond to questions, debug issues, send service-related emails.
- Improve the product: aggregated usage metrics to prioritize features.
- Comply with law: meet tax, accounting, and legal-request obligations.
We do not sell personal data, share it with data brokers, or use your declared intelligence or crawl data to train third-party AI models.
4. Legal basis (GDPR)
If you're in the EU or UK, we rely on the following legal bases:
- Contract: to deliver the service you signed up for.
- Legitimate interests: to secure our systems, prevent abuse, and improve the product.
- Consent: for non-essential analytics, marketing cookies, and marketing email. You can withdraw consent at any time.
- Legal obligation: to comply with tax, accounting, and law-enforcement requirements.
5. Sub-processors and third parties
We use the following service providers to run Ooky. Each is contractually bound to process data only on our instructions and to industry-standard security terms.
| Provider | Purpose | Data handled | Region |
|---|---|---|---|
| Google Cloud Platform | Application hosting, managed Postgres, object storage, Vertex AI / Gemini for intelligence generation. | Account data, crawl data, generated intelligence. | US / EU |
| Firebase (Google) | Authentication (sign-up, sign-in, password reset, SSO). | Email, password hash or federated token, sign-in metadata. | US |
| Cloudflare | Edge Worker, R2 object storage, KV, CDN, DDoS and bot-abuse protection, WAF, form spam prevention (Turnstile). | Request metadata, hashed IP prefixes, served intelligence payloads. | Global edge |
| Stripe | Subscription billing, payment processing, invoicing. | Billing contact, payment-method token, invoice history. Card data stays with Stripe. | US / EU |
| HubSpot | CRM, sales and marketing communications, contact and demo form handling. | Name, work email, company, message content, marketing-consent state. | US / EU |
| Google Analytics 4 & Google Tag Manager | Marketing-site traffic analytics and conversion measurement. | Pseudonymous visitor IDs, page views, referrer, device metadata. | US |
| Transactional email provider | Verification, password-reset, billing receipts, service notifications. | Email address and message content. | US / EU |
A current list lives at ooky.ai/subprocessors (coming soon). We notify customers in advance when we add or change a sub-processor that touches customer data.
7. Security
- TLS 1.2+ everywhere. No plaintext traffic.
- Data at rest encrypted with provider-managed keys (GCP CMEK, Cloudflare R2 SSE).
- Least-privilege access; admin actions logged and reviewed.
- Secrets managed via Google Secret Manager and Cloudflare secret bindings, rotated on incident.
- Payment data never touches our servers: it goes directly to Stripe via their hosted forms.
Report a security issue to security@ooky.ai. We appreciate coordinated disclosure.
8. Data retention
- Account data: retained while your account is active. An accepted self-service deletion request immediately revokes access and authentication factors; identity-provider cleanup and local anonymization are retried automatically and completed within 30 days. A contactless pseudonymous actor record may remain where needed to preserve workspace audit integrity.
- Crawled pages and generated intelligence: retained while the workspace is active. Disconnecting a domain removes active credentials and edge delivery but archives its content; deleting the workspace starts customer-content deletion as soon as external teardown is confirmed, with completion within 90 days.
- Bot-event logs: retained according to the workspace plan, with a hard maximum of 13 months including the deletion grace period, then the raw rows are deleted.
- Invoices and tax records: a minimal accounting ledger is retained for 7 years, as required by law; customer-authored invoice metadata is not copied into that ledger.
- Administrative audit records: rich audit rows are deleted with workspace content. A detached record containing only the action type, object type, timestamp, and a one-way workspace fingerprint is retained until the action is 12 months old; actor, object ID, request, IP address, user agent, and details are not copied.
- Backups: records already present in provider-managed backups age out on the provider's protected backup cycle and are not restored into the live product after deletion.
- Marketing-site analytics: GA4 default of 14 months; HubSpot per your cookie choices.
9. Your rights
Under GDPR, UK GDPR, CCPA, and similar laws, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Delete your data ("right to be forgotten").
- Export your data in a portable format.
- Object to or restrict certain processing.
- Opt out of sale/sharing (we don't sell, but you may opt out of marketing tools).
- Lodge a complaint with a supervisory authority.
You can export and request deletion from your in-product profile. For access, correction, restriction, portability, or a request you cannot complete in-product, email hello@ooky.ai. We respond within 30 days.
10. International transfers
Our systems are hosted in the United States and the European Union, with edge processing on Cloudflare's global network. When we transfer personal data out of the EU/UK, we rely on the EU Standard Contractual Clauses (and the UK addendum) and the EU-US Data Privacy Framework where applicable.
11. Children's privacy
Ooky is a B2B product not directed at children. We don't knowingly collect personal data from anyone under 16. If we learn we have, we'll delete it.
12. Changes to this policy
We'll post any changes here with a new "Last updated" date. If the change is material, we'll also email account holders at least 30 days before it takes effect.
13. Contact
Privacy questions, data requests, complaints: hello@ooky.ai.
CloudWeld LLC: mailing address on request.