Privacy & Security
Effective date: October 14, 2026
1. Introduction
Ohwow Limited Liability Company, a Connecticut limited liability company (“ohwow”, “we”, “us”, or “our”), runs ohwow.fun, a platform where businesses get a website and AI agents that work for them (the “Service”). This policy explains what information we collect, how we use and share it, how we protect it, and the choices you have.
By using the Service, you agree to this policy.
2. Information We Collect
Account information
Your name, email address, and the business details you give us when you sign up or claim a site (business name, category, location, website, phone).
Content you create
Chats with your agents, tasks and their results, generated websites and media, files you upload, and the knowledge you add to your workspace.
Connected accounts
When you connect a service (for example Gmail, Google Calendar, WhatsApp, Facebook, Instagram, YouTube, TikTok, or Dropbox), we access the data that connection allows, such as reading and sending email or reading and creating calendar events, only to do the work you ask for. You can disconnect at any time.
Your customers’ information
Contacts you import or collect, messages from visitors who chat on your ohwow site, and calls and recordings made through ohwow phone numbers. We process this on your behalf; you are responsible for having the right to share it with us.
Payment information
Payments are handled by Stripe. We never see or store your full card number; we keep only the subscription and invoice records Stripe sends us.
Usage and device data
Pages visited, features used, errors, IP address, browser, and device type, collected through our own logs and the analytics tools listed in Section 5. When you arrive from an ad or a referral link, we store the campaign source (such as a Google Ads click ID) to measure our marketing.
3. How We Use Your Information
- To run the Service: answer your chats, run your agents, build and host your sites, and send the messages you or your agents approve.
- To manage your account and subscription, and to contact you about them.
- To provide support and send service notices.
- To understand how the Service is used, fix problems, and improve it.
- To measure our own marketing, such as which ad or referral brought you to us.
- To prevent fraud and abuse, keep the Service secure, and comply with the law.
We do not sell your personal information, and we do not use your content or your customers’ data to train AI models.
4. Cookies and Analytics
We use cookies to keep you signed in, remember your language and theme, and remember for 30 days how you found us (campaign and referral source). We use PostHog, Vercel Analytics, and Google Analytics to understand how the Service is used, and the Google Ads tag to measure ad performance. You can block or delete cookies in your browser settings; parts of the Service may stop working if you block the sign-in cookies.
5. Who We Share Data With
We share data with the service providers below, only as needed to run the Service on our behalf. Most of them process data in the United States.
| Supabase | Database, authentication, and file storage |
| Vercel | Website and app hosting, page-view analytics |
| Fly.io | Hosting for workspace runtimes and background workers |
| Stripe | Payments and subscriptions |
| OpenRouter | Routes AI requests for chat, agent tasks, text, images, audio, and web search to model providers such as Google, xAI, DeepSeek, Moonshot AI, Alibaba Qwen, Xiaomi, Z.ai, Mistral, OpenAI, and Exa |
| Gemini AI models, speech and voice, Gmail, Calendar and YouTube connections you enable, Google Analytics, Google Ads | |
| fal.ai | Image and video generation |
| ElevenLabs | Text-to-speech voice generation |
| QuickChart | Rendering charts as images |
| Unsplash | Stock photo search for websites |
| Mailgun | Sending email |
| Twilio | Phone numbers, calls, and text messages |
| LiveKit | Real-time voice and meeting rooms |
| PostHog | Product analytics and error reporting |
| Cloudflare | Bot protection on public forms |
| Meta | Facebook, Instagram, and WhatsApp connections you enable |
| X | Posting and mentions for an X account you connect |
We may also share information when the law requires it, to protect the rights and safety of ohwow, our users, or the public, or as part of a merger or acquisition, in which case we will tell you before your information becomes subject to a different policy.
6. How We Protect Your Data
Encryption in transit
All traffic to ohwow.fun and our APIs is served over HTTPS (TLS).
Encryption at rest
Your data is stored with Supabase, which encrypts it at rest. Access tokens and API keys for the services you connect get an extra layer of application-level encryption (AES-256-GCM) before we store them.
Workspace isolation
Database access is scoped by workspace with Postgres row-level security, so one customer’s users cannot read another customer’s data.
Sign-in without passwords
You sign in with an email link or with Google. ohwow does not store a password for your account.
No training on your data
We do not use your content or your customers’ data to train AI models. The AI providers we use process it to return results to you.
If we confirm a breach that affects your personal information, we will notify you without undue delay and tell you what happened, what data was involved, and what we are doing about it.
Found a vulnerability? Please report it to legal@ohwow.fun before disclosing it publicly. We read every report.
No system is perfectly secure, and we cannot guarantee absolute security.
7. Instagram and Facebook Data
If you connect Instagram or Facebook, this is exactly what we do with that data.
What we read
For Instagram: your profile id, username, name and profile picture, the media we publish for you and its permalinks, and Instagram insights for those posts and your account. For Facebook: the list of Pages you choose to connect, their Page access tokens, and the Page posts we publish for you.
Why
Only to publish what you ask us to publish and to show you how it did. We use this data for nothing else.
Where it is stored
In our Supabase Postgres database, with the app hosted on Vercel and Fly.io. Access tokens are encrypted before they are stored, using AES-256-GCM with a key held outside the database.
How long we keep it
While the account stays connected. When you disconnect an account in ohwow, the stored tokens and the connected account record are removed. Saved post results and insights are removed when Meta tells us you removed ohwow, or when you email us to delete your data.
Who can see it
Only your own workspace. We never sell this data and never share it for advertising. We do not use data from Meta to train AI models.
How to disconnect and delete
In ohwow, open Social Media, open the account and choose Disconnect. You can also remove ohwow in your Facebook or Instagram settings under Apps and websites, or email ogsus@ohwow.fun with the subject "Data deletion request".
To disconnect or delete your data, follow the steps on our data deletion page.
8. YouTube Data
If you connect a YouTube channel, this is exactly what we do with that data.
YouTube API Services
ohwow uses YouTube API Services to connect your channel, upload the videos you schedule, and show you how they did. By connecting YouTube you agree to the YouTube Terms of Service, and Google handles your YouTube data under the Google Privacy Policy.
What we access
Your channel id, title, handle and thumbnail. Permission to upload the videos you schedule in ohwow, with the title, description, privacy setting and audience settings you choose. View, like and comment counts for the videos published through ohwow, and YouTube Analytics for those videos and your channel, such as views, watch time and subscribers.
How we use and store it
Only to publish what you ask us to publish and to show you how it did inside your workspace. It is stored in our Supabase Postgres database. Access and refresh tokens are encrypted before they are stored, using AES-256-GCM with a key held outside the database. Video statistics and analytics are kept for no more than 30 days unless they are refreshed from YouTube.
Who we share it with
Nobody outside your workspace. We do not sell YouTube data, do not share it for advertising, and do not send it to AI model providers. It is processed only by the hosting providers that run ohwow (Supabase, Vercel and Fly.io, listed in Section 5).
How to disconnect and delete
In ohwow, open Social Media, open the YouTube account and choose Disconnect. We then revoke our access with Google and delete the stored tokens, the channel record and the YouTube statistics and analytics we saved. The calendar entries and videos you created stay yours. You can also revoke ohwow’s access at any time from your Google account permissions page. If our access stays revoked or expired for 7 days, we delete the YouTube statistics and analytics we stored for that channel.
Google API Services User Data Policy
ohwow’s use and transfer to any other app of information received from Google APIs, including YouTube, Gmail and Google Calendar, will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use data from Google APIs to develop, improve, or train generalized AI or machine learning models.
9. TikTok Data
If you connect a TikTok account, this is exactly what we do with that data.
TikTok Login Kit and Content Posting API
ohwow uses TikTok’s Login Kit and Content Posting API to connect your account, post the videos you schedule, and show you how they did. By connecting TikTok you agree to the TikTok Terms of Service, and TikTok handles your TikTok data under the TikTok Privacy Policy.
What we access
Your TikTok open id, display name, username and profile picture, and your follower, like and video counts. Permission to post the videos you schedule in ohwow, with the caption, privacy setting and interaction settings you choose. View, like, comment and share counts for the videos published through ohwow.
How we use and store it
Only to publish what you ask us to publish and to show you how it did inside your workspace. It is stored in our Supabase Postgres database. Access and refresh tokens are encrypted before they are stored, using AES-256-GCM with a key held outside the database.
Who we share it with
Nobody outside your workspace. We do not sell TikTok data, do not share it for advertising, and do not send it to AI model providers. It is processed only by the hosting providers that run ohwow (Supabase, Vercel and Fly.io, listed in Section 5).
How to disconnect and delete
In ohwow, open Social Media, open the TikTok account and choose Disconnect. We then revoke our access with TikTok and delete the stored tokens and the account record. The calendar entries and videos you created stay yours. You can also remove ohwow at any time in the TikTok app under Settings and privacy, Security and permissions, Apps and services, or at tiktok.com/setting. To ask us to delete anything else, email ogsus@ohwow.fun with the subject “Data deletion request”.
10. Data Retention
We keep your data while your account is open. You can delete your account from your workspace settings; when you do, we delete your account data, except records we must keep for legal, tax, or billing reasons (invoices may be kept for up to 7 years). Deleted data can remain in backups for a limited time before it is overwritten.
11. Your Rights
You can ask us to access, correct, delete, or export your personal information, or to restrict or object to how we process it. You can delete your account and disconnect connected services yourself from your settings. For anything else, email legal@ohwow.fun. We will respond within 30 days, or sooner if the law requires.
If you are a customer of a business that uses ohwow, please contact that business first; they control your information and we help them respond.
12. US State Privacy Rights
Residents of Connecticut, California, and other states with consumer privacy laws may have the right to know what personal information we collect, use, and share; to access, correct, delete, and get a portable copy of it; and not to be discriminated against for exercising these rights. We do not sell personal information. The Google Ads tag on our public website may be used to show you ohwow ads on other sites; you can opt out of this at any time through Google’s Ad Settings (adssettings.google.com), by blocking cookies, or by asking us at legal@ohwow.fun.
To make a request, email legal@ohwow.fun with “Privacy Request” in the subject line. We may need to verify your identity, and we will respond within 45 days (extendable by 45 more days when reasonably necessary). If we deny your request, you can appeal by replying to our decision; if you are not satisfied with the outcome of the appeal, you may contact your state attorney general.
13. Children’s Privacy
The Service is for people 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us their information, contact legal@ohwow.fun and we will delete it.
14. Changes to This Policy
We may update this policy as the Service or the law changes. We will tell you about material changes by email or in the Service before they take effect, and we will update the effective date above.
15. Contact
Effective date: October 14, 2026. Previous versions are available upon request.