Privacy policy

• We collect what we need to run the service and to see what brings people to it, and nothing beyond that.
• We do not sell your data, and we never send anyone the guides you write.
• We run one advertising pixel, Meta’s, so we can tell which ads bring people here. It is the only third-party tracker on the site and section 8 says exactly what it sends.
• We also count visits and clicks ourselves, with our own code and our own database. We never sell those records or hand them to Meta, and section 8 says what they hold and what they leave out.
• Your guides are yours. Ask and we delete them, and your account with them.

Account details. Your email address, and a password we never see in plain text because our authentication provider hashes it.

What you make. The niches you search, ideas you save, guides you build, edits you make, and the exports you generate. This is the product; without it there is nothing to show you when you come back.

Billing details. Your plan, billing period, and renewal date. Card numbers never touch our servers. Payment is handled by Stripe, which sends us a customer reference and the last four digits, nothing more.

Technical logs. IP address, browser and device type, timestamps, and errors. Ordinary server logs, used to keep the thing running and to find out why something broke.

Visits and clicks. Which pages you look at, what you click on them, how you got here, roughly where you are, and what kind of device you are using. Section 8 has the detail, including what we never record.

Bug reports. If you send one, we keep what you wrote, the page you were on, your browser and screen size, and an address you give us so we can reply. We also store a one way hash of your IP address, never the address itself, purely so one machine cannot fill the table. It cannot be turned back into you.

We do not ask for your date of birth, your phone number, your address, or anything else the service does not need.

• To perform our contract with you: your account, your guides, your plan.
• Legitimate interest: keeping the service working, secure, and free of abuse, and counting visits and clicks so we know which pages and channels bring people in.
• Legal obligation: tax and accounting records for payments.
• Consent: product email, which you can withdraw at any time without losing anything.

Only the companies we need to run the service, each doing one job:

• Anthropic: your prompts and guide text are sent to the Claude API to write and revise. Anthropic does not train on API data by default.
• Supabase: accounts, database, and file storage, including the visit and click records described in section 8.
• Stripe: payments. They hold the card details, we do not.
• Vercel: hosting and server logs. Vercel also tells our server the approximate location of each visit, worked out from the IP address. We keep that location, not the address.
• Pexels: photo search. We send the search terms, not anything about you.
• Meta: advertising measurement only. Their pixel tells us which Facebook and Instagram ads led to a sign-up or a purchase. Section 8 lists exactly what it sends, and it is never your guides.

Meta is the one name on that list that uses what it receives for its own advertising systems as well as ours, which is what an ad pixel is for and why it gets its own section below. The rest get your data only to do their job for us. We will hand data to law enforcement only where the law actually requires it.

Our providers run infrastructure in the United States and the European Union, so your data may be processed outside your country. Where that involves data leaving the UK or EEA, the transfer relies on Standard Contractual Clauses.

• Account and guides: while your account is open.
• After you delete your account: removed within 30 days, apart from backups, which roll off within 90.
• Payment records: kept as long as tax law requires, usually 6 to 7 years.
• Server logs: 30 days.
• Visit and click records: no fixed period yet. The ones linked to your account are deleted along with it.

Wherever you are, you can ask us to show you what we hold, correct it, export it, or delete it. In the UK, the EEA, and several other places these are legal rights rather than courtesies, and they also include objecting to processing and asking us to restrict it.

Email hello@getoctavo.com and we will act within 30 days. There is no charge. If you are in the UK or EEA and you are not satisfied, you can complain to your data protection authority.

Octavo sets a session cookie so you stay signed in, and stores your local preferences in your browser. Neither is shared with anyone.

We count visits with our own code. A small script served from getoctavo.com notes each page you view, how far down it you scroll, and how long it stays open in front of you. When you click a link or a button, it records the label on it, the part of the page it sits in, where it leads, and roughly where on the page the click landed. It also notes the size of your browser window, the site that sent you here, and any campaign tags in the link you followed, which is how we tell one ad or post from another.

Our server adds your approximate location (country, region, and city, which our host works out from your IP address), your device type, operating system, and browser, and whether you are browsing inside an app such as Instagram. It stores the location and never the IP address. To tell one visit from the next, the script keeps two random identifiers in your browser’s local storage, one for the browser and one for the current visit. They are not cookies, they hold nothing about you, and clearing your site data resets them.

What it never records: anything you type into a form, your password, or the words of your guides. Inside the app and on the sign-in pages it does not even keep the text on the buttons you click, only the names we gave them, because that is where your own work and your email address appear on screen. Once you sign in, we link these records to your account, including visits from the same browser before you signed up, so we can see which channels bring the people who go on to make and buy guides. The records stay in our database at Supabase. We use them ourselves and never sell them or pass them to Meta or anyone else. If you block the script, every part of Octavo still works.

We also run the Meta advertising pixel. We advertise Octavo on Facebook and Instagram, and the pixel is how we find out which ads actually bring people here rather than paying for guesses. It records four moments: a page view, a completed sign-up, a started checkout, and a purchase with its dollar amount. It sets Meta’s own cookies and Meta can match those events to your Facebook or Instagram account if you have one.

What it never sends: your email address, your password, your niches, your ideas, or a single word of any guide you write. Those stay with us. If you block the pixel with an ad blocker or browser setting, every part of Octavo still works, and we would rather you did that than felt watched. You can also turn off ad personalisation in your Meta ad preferences.

Octavo is not for under-18s and we do not knowingly collect their data. If you believe a child has an account, tell us and we will remove it.

If a breach happens and it puts you at real risk, we will tell you and the relevant authority within 72 hours of finding out, and we will say what happened rather than dressing it up.

Material changes to this policy get notice before they take effect, and the date at the top always reflects the current version. Anything you want to ask goes to hello@getoctavo.com. See also the terms of service.