Privacy Policy

Last updated 26 August 2026.

Who we are

Ovelin ("we", "us") provides a governance and audit-trail platform for AI agents. This policy explains what data we process and why.

Data we process

Account data: name, work email, and organization details you provide. Operational data: the AI agent metadata, audit-log events, oversight records, and security alerts your organization sends to us. Audit events may contain an actor identifier (e.g. an employee email) that you choose to include in your payloads.

How we use it

To provide the service: storing your audit trail, computing agent risk ratings, mapping records to framework requirements, generating evidence reports, and surfacing security alerts. We do not sell your data or use it to train models.

Legal basis & your rights (GDPR)

We process data to perform our contract with you and on the basis of legitimate interest in securing the service. You may request access, correction, export, or deletion of your data at any time by contacting us. Data is isolated per organization and protected with row-level security.

Data retention & security

Audit records are immutable and retained for the period you configure for compliance. Data is encrypted in transit, API keys are stored only as hashes, and audit records carry a tamper-evidence HMAC.

Cookies & browser storage

Cookies: only essential ones. A session cookie set by our authentication provider keeps you signed in, and agl-ledger-theme remembers whether you chose the light or dark appearance. We set no advertising or cross-site tracking cookies, and we do not sell or share data with ad networks. Your answer to the cookie notice is itself recorded in your browser’s local storage rather than in a cookie, so that asking you once does not require setting one.

Campaign attribution: if you arrive from a link carrying campaign parameters (utm_source and similar), we keep those values in your browser’s session storage — first-party, same-origin, and erased when you close the tab. They are sent to us only if you choose to submit the contact form, and only so we can see which channel a genuine enquiry came from. They are not a cookie, are never attached automatically to requests, are not used to build a profile, and are never stored at all if you do not write to us.

Sub-processors

We use Supabase (database & auth), Vercel (hosting), and Resend (transactional email). Each processes data only to deliver the service.

Contact

Questions about this policy:the contact form.