Create account

Ovebot Privacy Policy

How Ovebot handles personal data of its B2B customers and processor relationships.

Who we are

Aweb Design SRL is the operator of the Ovebot AI customer-support platform. You can reach us at https://ovebot.ai/en/contact.

Our role under the GDPR

When you (a tenant business) sign up to use Ovebot, we are the controller for your account, billing and support data. When end-customers chat with the AI on your website, you are the controller and Ovebot acts as processor on your behalf (Art. 28 GDPR).

Data we collect

For our direct relationship with you (the tenant) we collect:

  • Account data — name, email, hashed password, language preference.
  • Billing data — company name, VAT ID, address, payment metadata returned by Stripe.
  • Operational logs — login events, IP address, user-agent, audit trails.
  • Aggregate usage metrics — API calls, message counts, token totals.

Why we collect it

  • Provide and operate the Ovebot platform.
  • Process payments and issue invoices.
  • Detect abuse, debug incidents, and maintain platform security.
  • Comply with legal obligations (accounting, tax, regulatory).

Legal basis

We process your data under Art. 6(1)(b) (performance of the contract you signed up for) and Art. 6(1)(f) (legitimate interest in running the platform securely). Marketing communications, when applicable, are sent with your explicit consent (Art. 6(1)(a)).

How long we keep it

  • Account data: kept while your account is active. After deletion, soft-deleted for 30 days then permanently removed.
  • Billing records: kept for 10 years to satisfy accounting law.
  • IP addresses in logs: anonymized after 90 days.

We use cookies

We use cookies to keep the site working, understand how it is used and improve your experience. You choose which categories to allow.

Essential cookies

Required for the website to function (security, session and your cookie choices). These cannot be switched off.

  • ovebotai_cookie_consent — Stores your cookie consent preferences.
    1 year
  • ovebotai-session — Identifies your browsing session.
    2 hours
  • XSRF-TOKEN — Protects you and the site against cross-site request forgery.
    2 hours

Analytics cookies

Google Analytics is on by default so we can understand how the site is used. You can switch it off here or at any time via "Manage cookies". Data is aggregated and IP addresses are anonymised.

  • _ga — Google Analytics — distinguishes individual visitors.
    1 year
  • _ga_K60TLF6G3L — Google Analytics — persists session state.
    1 year
  • _gid — Google Analytics — distinguishes individual visitors.
    1 day

Marketing cookies

Used to measure advertising and show more relevant content. They enable Google, Meta (Facebook/Instagram), TikTok, OpenAI (ChatGPT) advertising and remarketing signals.

  • _gcl_au — Google Ads — stores and measures advertising conversions.
    2 months
  • _gcl_aw — Google Ads — stores and measures advertising conversions.
    2 months
  • _gcl_gb — Google Ads — stores and measures advertising conversions.
    2 months
  • __oppref — OpenAI (ChatGPT) Ads — stores the ad click identifier used to measure conversions.
    4 weeks
  • __obref — OpenAI (ChatGPT) Ads — browser identifier used to match conversions.
    4 weeks
  • _fbp — Meta (Facebook/Instagram) Ads — distinguishes visitors to measure ad conversions.
    2 months
  • _fbc — Meta (Facebook/Instagram) Ads — stores the ad click identifier used to measure conversions.
    2 months
  • _ttp — TikTok Ads — distinguishes visitors to measure ad conversions.
    1 year

Cookies used

The widget sets two cookies required for it to work:

  • ovebot_vid — Identifies your browser as a returning visitor. Contains a random identifier and a cryptographic signature that prevents tampering. First-party cookie (set on this site), Secure (HTTPS only), valid for 6 months. Not used for marketing or advertising.
  • ovebot_sid / ovebot_sid_<id> — Remembers your current chat conversation so you can resume it if you come back to this site. Contains a random session identifier and a cryptographic signature. Also used to precisely attribute orders to the specific conversation that generated the purchase. First-party cookie, Secure, valid for 30 days.

Advertising measurement

When you reach us through an ad — for example a Google ad or an ad shown in ChatGPT — we store the click identifier carried by the link (such as gclid, fbclid, ttclid or oppref) on the server: in your session and, if you create an account, on that account, together with the page you landed on, the referring site and the campaign parameters (utm) of that visit. We set no cookie of our own for it. Conversions (such as a signup, a trial or a subscription) are reported to the advertising network that brought you (Google Ads, Meta Ads — Facebook/Instagram, TikTok Ads, OpenAI Ads) together with that click identifier and, as irreversible SHA-256 hashes — never in clear text — your email address, your name and the country, city and postal code of your billing address, plus technical identifiers of the signup request (IP address, browser user agent and, if you accepted marketing cookies, the network's own browser identifiers). Measurement pixels in the browser only run after you accept marketing cookies. This data is used solely to know which ad led to a signup or subscription.

Third parties involved

We rely on a small number of vetted third parties to deliver the service. See the full list at https://account.ovebot.ai/en/legal/sub-processors.

International transfers

Some sub-processors (notably the LLM providers) are based in the United States. Transfers happen under the EU-US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission.

Your rights

  • Right to access
  • Right to rectification
  • Right to erasure (be forgotten)
  • Right to object
  • Right to lodge a complaint with a supervisory authority

Contact

Questions about this policy? Email us at .

Last updated: 2026-05-10