Privacy Policy

1. Scope and Who This Applies To

This policy covers three distinct groups, and different sections apply depending on which one describes you:

(a) Site Visitors — anyone browsing opheliaos.com without a Customer account. (b) Customers — developers and businesses who register for the Ophelia dashboard or API. (c) End Users — individuals whose data is processed through the API because a Customer used Ophelia’s infrastructure to book something on their behalf. If you are an End User, see the “Our Role” section below — your primary privacy relationship is with the Customer whose application you used, not with Ophelia directly.

2. Information We Collect

From Site Visitors: standard web analytics such as pages viewed, referring URLs, browser and device information, and approximate location derived from IP address, typically collected via cookies and similar technologies.

From Customers: account information (name, business entity, contact details), authentication data (login credentials, API keys, IP addresses at login), billing information (processed by our payment processor — we do not store full card numbers), and API usage logs (request volume, endpoints called, response status).

From End Users, on a Customer’s behalf: identification data (first and last name), contact data (email or phone number, used to relay one-time passwords and booking confirmations), and booking details (date, time, venue, party size, and similar details needed to complete a reservation). We do not collect government-issued identification, biometric data, health information, or full payment card numbers from End Users.

3. How We Use Information

We use Site Visitor data to operate and improve opheliaos.com and understand how the site is used. We use Customer data to provide, secure, and bill for the Services, and to communicate with Customers about their account. We use End User data solely to execute the specific booking a Customer’s application requested on that End User’s behalf, as instructed by the Customer.

4. Our Role: Controller vs. Processor

With respect to Site Visitor and Customer account data, Ophelia acts as the data controller and is responsible for that data under this policy.

With respect to End User data submitted to us by a Customer through the API, Ophelia acts only as a data processor, handling that data solely as instructed by the Customer in order to complete a booking. If you are an End User and have questions about how your data was used, please contact the Customer application you interacted with directly — they are responsible for their own end-user privacy disclosures and for honoring your rights. We will assist Customers in responding to such requests as required by applicable law.

5. Cookies and Analytics

opheliaos.com uses cookies and similar technologies for essential site functionality and for analytics that help us understand aggregate site usage. You can control cookies through your browser settings; disabling them may affect some site functionality.

6. How We Share Information

We share information with service providers who help us operate the Services, including cloud hosting providers and our payment processor, under confidentiality and data-protection obligations.

To execute a booking, we transmit the minimum necessary End User data to the relevant third-party reservation or booking platform (for example, a restaurant or event ticketing system); those platforms act as independent controllers of their own data practices.

We do not sell End User or Customer personal data. We may disclose information where required by law, to protect the rights and safety of Ophelia or others, or in connection with a merger, acquisition, or sale of assets.

7. Data Retention

We retain Customer account data for as long as the account is active and as needed to comply with legal and billing obligations. We retain End User booking data only as long as necessary to complete and confirm the booking and to meet recordkeeping obligations; one-time passwords used during booking confirmation are not retained after the session closes.

8. Data Security

We use technical and organizational measures designed to protect the information we process, including encryption in transit and access controls on production systems. No method of transmission or storage is fully secure, and we cannot guarantee absolute security.

9. Your Rights and Choices

Depending on your location, you may have rights to access, correct, delete, or port the personal data we hold about you as a controller (Site Visitors and Customers), and to object to or restrict certain processing. California residents have rights under the CCPA/CPRA, including the right to know what personal information is collected and to opt out of its sale or sharing — we do not sell personal information. To exercise these rights, contact us at team@opheliaos.com.

If you are an End User whose data was processed by Ophelia on a Customer’s behalf, please direct data-rights requests to that Customer in the first instance, as described in the “Our Role” section above.

10. International Data Transfers

Ophelia is based in the United States, and information we process may be transferred to and stored in the United States or other countries where our service providers operate. Where required, we use appropriate safeguards for such transfers.

11. Children's Privacy

The Services are not directed to individuals under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can address it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice to Customers.

13. Contact Us

Questions about this Privacy Policy can be sent to team@opheliaos.com.