Privacy Policy

01. Privacy Charter & Overview#

This Privacy Policy (“Policy”) details how Olama Labs (“Oogla”, “we”, “us”, or “our”) collects, processes, secures, and discloses personal information through:

• Our marketing and customer-facing websites, including oogla.olamalabs.com;
• The Oogla administrative dashboard, analytics suites, and developer APIs; and
• The Oogla embeddable website widget (widget.js) deployed on our customers’ websites to deliver conversational AI customer service and sales engagement.

Olama Labs is a technology organization based in and operating from the Federal Republic of Nigeria. We are committed to operating with complete transparency, implementing rigorous data minimization, and upholding the highest standards of modern data protection, including the Nigeria Data Protection Act 2023 (NDPA), the General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA).

02. Data Controller vs. Processor Roles#

Under applicable data protection frameworks, the entity responsible for determining how and why personal data is processed is differentiated into two principal roles:

03. Information We Collect#

Depending on how you interact with our platform, we collect information in the following categories:

A. Customer Account & Billing Information

• Registration Data: Name, work email address, encrypted password hash, company name, and time zone.
• Payment Information: Billing address, subscription tier, and masked card identifiers. Full payment card numbers are processed directly by PCI-DSS Level 1 compliant gateways (e.g. Stripe) and are never stored on Oogla servers.
• Site Configuration: Whitelisted domain names, agent persona names, welcome greetings, and WhatsApp notification numbers.

B. End-User Data Collected via the Embedded Widget

• Conversational Transcripts: Real-time text inquiries, responses, conversation timestamps, and sentiment indicators.
• Captured Lead Details: Contact attributes volunteered by the visitor during chat (e.g., name, business email, phone number, company size, project requirements).
• Session Telemetry: Anonymous visitor session UUIDs, device type, browser user agent, referring URL, and approximate geographic location (country and city derived from truncated IP addresses).

C. Customer Knowledge Base & Domain Content

• Crawled Webpage Content: Public HTML text, product catalogs, FAQ content, and documentation crawled from Customer-approved domains to generate vector embeddings.

04. How We Use Your Information#

We process collected data exclusively for the following legitimate commercial and operational purposes:

• Delivering Autonomous Agent Capabilities: Formulating real-time responses to visitor questions using Retrieval-Augmented Generation (RAG).
• Lead Routing & Pipeline Acceleration: Forwarding verified prospect leads to Customer dashboards, notification emails, and WhatsApp webhooks.
• Token Metering & Billing: Accurately calculating token consumption, monthly subscription refills, and Top-Up pack usage.
• Security & Abuse Prevention: Detecting distributed denial-of-service (DDoS) attacks, prompt injection exploits, scraping attempts, and fraudulent card transactions.
• Platform Optimization: Measuring widget load performance, caching frequent queries, and ensuring high service availability.

05. AI Model Training & Zero Data Retention#

When an AI Employee processes a conversation, text context is transmitted to upstream enterprise inference providers via private, stateless API endpoints governed by strict Zero Data Retention (ZDR) agreements. Upstream inference providers do not retain prompts or completions on persistent storage for model training.

Furthermore, customer knowledge base embeddings are stored in isolated vector database namespaces protected by row-level security (RLS), preventing cross-tenant data contamination.

06. Legal Bases for Processing (GDPR)#

Under GDPR Article 6, we process personal data under the following recognized legal grounds:

• Performance of a Contract: To provision the Oogla service, authenticate users, process subscription billing, and deliver the conversational agent functionality requested by Customer.
• Legitimate Interests: To maintain system security, detect fraudulent abuse, enforce domain whitelisting, and optimize platform uptime.
• Consent: Where an End-User explicitly provides contact details to receive a follow-up or quote from the website owner.
• Legal Compliance: To comply with financial reporting, tax accounting, and statutory legal requests.

07. Cookies & Local Storage Technologies#

Oogla uses minimal, privacy-centric storage mechanisms. We do not employ third-party advertising cookies or cross-site tracking pixels within the embedded widget.

08. Third-Party Sub-processors & Infrastructure#

To provide our globally distributed, low-latency AI platform, Olama Labs engages trusted third-party sub-processors subject to strict data processing agreements (DPAs) and confidentiality safeguards:

09. Data Retention & Automated Deletion#

We retain personal data only for as long as necessary to fulfill the purposes outlined in this Policy, or as specifically instructed by our Customers:

• Visitor Chat Transcripts: Stored in the Customer’s dashboard for the retention period selected by the Customer (default: 180 days). Customers can export or purge transcripts at any time.
• Qualified Leads: Maintained until the Customer deletes the lead record from their dashboard or terminates their account.
• Transient AI Inference Logs: Ephemeral server debugging logs containing token counts and latency metrics are automatically pruned after thirty (30) days.
• Terminated Accounts: Upon verified account deletion request, all associated vector embeddings, chat logs, and credentials are permanently expunged from production databases within thirty (30) days.

10. Technical & Organizational Security#

Olama Labs implements defense-in-depth security architecture designed to safeguard personal data against unauthorized disclosure, alteration, or loss:

• Encryption in Transit: All web traffic, API communications, and widget WebSocket connections are enforced over TLS 1.3 / HTTPS.
• Encryption at Rest: All database clusters, disk volumes, and vector indexes utilize AES-256 hardware encryption.
• Domain Origin Whitelisting: Widget connections verify HTTP Origin and Referer headers against customer-registered domains, rejecting unauthorized embedding attempts.
• Access Control: Administrative access to production databases is restricted using multi-factor authentication (MFA) and least-privilege Role-Based Access Control (RBAC).
• Automated Vulnerability Scanning: Continuous dependency audits and automated static analysis to remediate vulnerabilities prior to deployment.

11. International Data Transfers & Cloud Infrastructure#

Our Operating Headquarters: Olama Labs is a technology organization based in and operated from the Federal Republic of Nigeria.

Global Cloud Architecture: While our management, core engineering, and operational teams are in Nigeria, Oogla delivers autonomous AI responses with sub-second latency to websites and visitors globally. To provide high availability, redundancy, and rapid vector search, our backend servers, cloud databases, and artificial intelligence inference models (including Supabase, Amazon Web Services, Anthropic, and OpenAI) are hosted in enterprise data centers located in the United States and the European Union.

Consequently, when you register an account, configure an AI employee, or when end-users interact with the Oogla widget on your website, personal information is securely transmitted across international borders to these cloud hosting facilities.

12. Your Legal Rights (NDPA 2023, GDPR, CCPA/CPRA)#

Under the Nigeria Data Protection Act (NDPA 2023), GDPR, and leading international privacy legislation, you possess the following enforceable rights regarding your personal information:

• Right to be Informed: The right to clear, transparent disclosure about how your personal data is collected and processed.
• Right to Access: The right to request copies of the personal data we hold about you.
• Right to Rectification: The right to correct inaccurate, outdated, or incomplete personal records.
• Right to Erasure (“Right to be Forgotten”): The right to request the permanent deletion of your personal records.
• Right to Data Portability: The right to receive your data in a structured, commonly used, and machine-readable format (e.g., CSV or JSON).
• Right to Restrict or Object to Processing: The right to limit or object to our processing of your information under specific circumstances.
• Right to Lodge a Complaint: Nigerian data subjects have the right to lodge a formal complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng, or your local data protection regulatory authority.
• California “Do Not Sell or Share My Info”: We do not sell or share your personal information for cross-context behavioral advertising.

13. Children’s Privacy Protection#

The Service is designed exclusively for commercial business use and is not intended for individuals under sixteen (16) years of age. We do not knowingly collect, solicit, or maintain personal information from children under 16. If we discover that a child under 16 has provided us with personal information, we will take prompt steps to delete such data from our systems.

14. Modifications to This Privacy Policy#

We may update this Privacy Policy from time to time to reflect enhancements to our AI technology, regulatory updates, or changes in our data processing practices. When updates are published, we will revise the “Last Revised” date at the top of this document.

For significant or material changes that impact your privacy rights, we will notify registered account holders via email or prominent in-app notification at least thirty (30) days prior to the effective date of such modifications.

15. Data Protection Officer & Contact#

If you have any questions, privacy inquiries, or wish to submit a data subject request, please reach out to our dedicated privacy and legal team: