Privacy Policy

This Privacy Policy explains how Ocli handles personal information when you use our website and application.

The data controller is Ocli, 7 Chemin des Crêtes, 06300, Nice, France. For privacy questions or to exercise your rights, contact hello@ocli.io.

1. Information We Collect

Account and team information

• email address and, where provided, name and company;
• your workspace, role and the team members you invite (their email addresses);
• the websites you add to your workspace.

Website analysis information

• the website and sitemap URLs you provide;
• publicly accessible page content and metadata we fetch to analyse your pages;
• scores, decisions, recommendations and approvals created in the Service.

Connected accounts

If you connect a CMS (such as Webflow) or analytics account (such as Google Analytics or Search Console), we store the access authorisation and the data needed to provide the feature. You can disconnect at any time.

Google user data: sharing and disclosure

Ocli accesses Google Analytics 4 and Google Search Console data in read-only mode, only after you connect your account. We use it solely to show you AI-referred traffic, search clicks and impressions, and the before/after impact of content changes.

We do not sell Google user data. We do not use it for advertising, and we do not transfer it to data brokers or other third parties.

We share Google user data only with service providers that process it on our behalf to run the service: Supabase (database and secure storage) and Cloudflare (hosting). Google Analytics and Search Console data is not sent to AI model providers. These providers may not use it for their own purposes.

We also disclose it where required by law, to protect the security of our service, or with your explicit consent.

Google user data: protection

OAuth tokens are encrypted at rest in Supabase Vault. All data is encrypted in transit over HTTPS. Access is restricted by workspace and role, and only authorised team members can view a site's data.

You can disconnect Google at any time in Settings. Disconnecting revokes our access token with Google. You can also request deletion of your Google data by emailing hello@ocli.io. We delete synced Google metrics within 30 days of disconnection or account deletion, and otherwise retain them while your account is active.

Limited Use statement

Ocli' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is not used to develop, improve or train generalised AI or machine-learning models.

Billing information

Payments are processed by Paddle.com, our Merchant of Record. Paddle collects and processes your payment details under its own privacy policy. We do not receive or store your full card details; we receive subscription status, billing country, invoices and a customer reference.

Usage information

Technical information needed to operate and secure the Service, such as browser and device details, pages and features used, timestamps and error logs.

2. How We Use Information

• to provide the Service, including analyses, recommendations and CMS drafts;
• to manage accounts, teams, subscriptions and support;
• to send service emails such as invitations, receipts and important changes;
• to maintain, secure and improve the Service and investigate misuse.

3. Legal Bases

Under the EU GDPR we rely on: performance of our contract with you; our legitimate interests in operating, securing and improving the Service; consent where required; and compliance with legal obligations.

4. AI Processing

We use third-party AI providers to analyse publicly available website content and generate recommendations. We send only what is needed for the feature and do not intentionally submit sensitive personal information.

5. Service Providers

We share information with providers who process it on our behalf, for:

• hosting and infrastructure (e.g. Cloudflare) and database and authentication (Supabase);
• payments and invoicing (Paddle, as Merchant of Record);
• artificial-intelligence processing (e.g. Google Gemini, OpenAI, Anthropic);
• email delivery.

6. International Transfers

Some providers process data outside the European Economic Area. Where required, we use appropriate safeguards such as standard contractual clauses.

7. Retention

We keep personal data only as long as needed to provide the Service and meet legal obligations (for example, billing records). You can ask us to delete your account at hello@ocli.io.

8. Your Rights

Depending on applicable law, you can request access, correction, deletion, restriction, objection, data portability and withdrawal of consent. Contact hello@ocli.io. You may also complain to a data-protection authority, such as the French CNIL (Commission Nationale de l'Informatique et des Libertés).

9. Cookies

We use essential cookies and local storage to keep you signed in and remember preferences. We do not use advertising cookies.

10. Children

Ocli is intended for business users and is not designed for children.

11. Changes

We may update this policy; material changes will be communicated and the date above updated.

12. Contact

Ocli, 7 Chemin des Crêtes, 06300, Nice, France · hello@ocli.io