OAEYA OS

Privacy Policy

Last updated: date set at publication · GDPR (General Data Protection Regulation) and German BDSG

Draft, not published. The marked gaps are filled before this page goes live.

This page explains in plain language what data we process when you use OAEYA OS, why, and for how long. Short version: the public website sets no cookies, uses no analytics or advertising tools, and loads nothing from third-party servers. In the course area, videos are streamed by Bunny Stream (section 7). If that ever changes, we will ask for your consent first.

1Who is responsible

Oaeya LLC
447 Broadway, 2nd Floor, #3493
New York, NY 10013, USA
Represented by Mike Lee Dang (Managing Member)
Email: legal@oaeya.com

Oaeya LLC is based in the United States. The website, the email list and the course area run on servers in the European Union (see sections 2, 5 and 7). We collect your data directly from you; the GDPR applies in full.

Our representative in the EU (Art. 27 GDPR): name, address and email of the EU representative

2Hosting and server logs

The website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (data center in Nuremberg). When you open a page, the server processes technically necessary connection data: IP address, date and time, requested address and status code, amount of data transferred, browser and operating system (user agent), and the previous page (referrer) if your browser sends it.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a stable and secure website). Logs are deleted after 14 days at the latest, unless we need them to investigate an attack.

3Cookies and local storage

This website sets no cookies. So that the opening animation does not replay on every page, it stores a single flag in your browser's session storage (“os-intro”). It contains no personal data, never leaves your device and is deleted when you close the tab. Legal basis: § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act).

4Free checklist and email course (sign-up)

When you sign up for “The 12 questions before every campaign”, we store your email address, the time of sign-up, the page and spot you signed up from, the wording version of the consent text you saw, and your IP address and browser identifier. We then send you an email asking you to confirm (double opt-in). Only after you confirm do we send the checklist and further emails. We store the time and IP address of your confirmation as proof of your consent.

What you receive: the checklist, a 5-day email course (one email a day), and after that emails about paid social and the OAEYA OS course, including offers, at most twice a week.

Legal basis: your consent (Art. 6(1)(a) GDPR). The sign-up record is kept as proof of consent on the basis of Art. 6(1)(c) and (f) GDPR.

Unsubscribing: every email contains a one-click unsubscribe link. You can also write to support@oaeya.com. After you unsubscribe we send no more emails. We keep your address on a block list so it is not added again by mistake, and we keep the proof of consent for 3 years after the end of the year in which the last email was sent or you withdrew your consent, then delete it. Unconfirmed sign-ups are deleted after 30 days.

5Email service: Brevo

We send these emails with Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France). Brevo processes your email address, the sign-up and confirmation data and the sending history on our behalf, under a data processing agreement (Art. 28 GDPR), on servers in the EU.

We have switched off open and click tracking in Brevo. We do not build profiles of what you read.

6Buying the course: Digistore24

OAEYA OS is sold through Digistore24 GmbH, St.-Godehard-Straße 32, 31139 Hildesheim, Germany. Digistore24 acts as reseller: your purchase contract, payment, invoice, VAT and right of withdrawal are handled by Digistore24, which is responsible for that data itself. Its privacy policy applies: link to the Digistore24 privacy policy.

To give you access, Digistore24 passes us your name, email address, the product you bought, the order number and the order status (including refunds and withdrawals). Legal basis: Art. 6(1)(b) GDPR (performing the contract). We keep this data as long as you have access to the course, plus statutory retention periods where they apply.

7Course area and videos

The course runs in our own members area at address of the course area on the server named in section 2. To log in, we send you a one-time sign-in link by email. We store your email address, name, access status, your progress (which lessons you completed) and sign-in times. To protect the course, we limit the number of devices signed in at the same time and may show your email address faintly over the videos. Legal basis: Art. 6(1)(b) GDPR (performing the contract) and Art. 6(1)(f) GDPR (protecting the course from unauthorized sharing).

Videos are delivered by Bunny Stream (BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia) under a data processing agreement. When a video plays, Bunny processes your IP address and technical playback data.

8Webinars

We hold free live sessions on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). If you sign up, we send you the link and a reminder by email (see sections 4 and 5). We do not embed the YouTube player on this website; you open YouTube yourself via the link. On YouTube, Google's privacy policy applies, and if you use the chat you do so with your YouTube account. Recording: if we keep one, it stays on YouTube as an unlisted video and is deleted after a period still to be set.

9No analytics, no tracking, no advertising pixels

This website uses no web analytics, no pixels (e.g. Meta, TikTok, Pinterest, LinkedIn), no conversion tracking and no advertising cookies. No profiling takes place. If we ever add any of these, we will ask for your consent first in a consent window that lets you decline just as easily, and we will update this policy.

10Contacting us by email

If you write to us, we process your details (name, email address, message) to answer you. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) or Art. 6(1)(f) GDPR (answering your request). We keep the message until your request is done; business correspondence is kept for statutory periods (usually 6 or 10 years). Our mailboxes are hosted by Hostinger (data center in the EU).

11Fonts

All fonts are served from our own server. No connection to Google Fonts or other providers is made.

12Links to other services

We link to our profiles on Instagram, TikTok, YouTube and LinkedIn. These are plain links: your browser only connects to these services when you click one. Their privacy policies apply there.

13Automated decisions and obligation to provide data

We make no automated decisions or profiling within the meaning of Art. 22 GDPR. You are not obliged to give us any data. Without your email address we cannot send you the checklist or emails, and without the order data we cannot give you access to the course.

14Your rights

Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7(3)). Just write to legal@oaeya.com.

15Right to complain

If you believe we are not processing your data correctly, you can complain to a data protection supervisory authority under Art. 77 GDPR, in particular in the EU member state where you live or work or where the alleged infringement took place.

16Encryption

This website uses an encrypted connection (TLS). You can tell by “https://” in the address bar.

Changes

We update this policy when our processing or the law changes. The current version is always on this page.