Privacy Policy

Who this policy covers

Ollio ("Ollio", "we", "us", or "our") provides business management software for stock, orders, delivery, contacts, team management, and related business operations, currently offered as a beta service. This Privacy Policy explains what personal information we collect through our public website, our beta invitation and registration process, and the Ollio application, and how we use, share, retain, and protect it.

This Policy applies to visitors to our public pages, people who request beta access or register for an account, and members of a company workspace who use Ollio through their employer or organisation (a "Workspace"). If you use Ollio as part of a Workspace, your organisation decides what business information is stored in that Workspace and is generally responsible for those records; this Policy should be read alongside any agreement between you and that organisation.

Ollio is built for businesses in Malaysia, and this Policy is written with the Malaysian Personal Data Protection Act 2010 (PDPA) and other applicable data protection laws in mind.

Information we collect

Depending on how you use Ollio, we collect the following categories of information.

Account information

• Your name, email address, and — for a password-based account — a password, which we store only as a secure hash (bcrypt) and never in plain text.
• Optional profile details you add, such as a phone number or profile photo.
• Account preferences, such as your interface language and display settings.

Company and Workspace information

• Your organisation or company name, business type, country, and contact details.
• Workspace configuration, such as branches, roles and permissions, tool settings, and branding (for example a company logo).
• Optionally, a business registration number or tax number, if you add one in Settings.

Business Data you and your team enter

When you use Ollio, you and your colleagues enter business records into your Workspace. These can include:

• stock items, categories, units, and stock movements;
• orders, customers, and invoices;
• deliveries, drivers, and delivery proof photos;
• contacts and suppliers;
• team member records;
• files and images uploaded to Ollio, such as product photos, supplier logos, reorder documents, and delivery proof.

Business Data may include personal information about your own customers, suppliers, employees, or other individuals. Your organisation is responsible for that information (see "Workspace data and organisational access").

Technical and security information

When you use the service we automatically record:

• browser and device details, operating system, and screen size;
• an approximate location (country) derived from your network connection;
• dates, times, and the pages or features used;
• authentication and security events, such as sign-in and password-reset activity;
• application error and activity logs.

We use network information such as an IP address to operate and secure the service and to apply rate limits. We do not keep full IP addresses in our ordinary logs; where an IP address is recorded for security or audit purposes, it is stored only in a hashed form.

Support, feedback, and beta requests

• support and feedback messages you send us, including any screenshots or attachments and the technical context captured with a report (such as the page you were on, the app version, and your browser and device type);
• beta-access requests, including your name, email address, company name, business type, and the reason for your request;
• communications related to invitations you send or receive.

How we collect information

We collect information in four main ways:

• Information you provide directly — when you request beta access, verify your email, register, sign in, update your profile or company details, upload a file, or contact us.
• Information your Workspace administrators and colleagues enter — when someone in your organisation adds you as a team member, assigns your role and permissions, or records business information that relates to you.
• Information we record automatically — when you visit our website or use the application, as described under "Technical and security information".
• Information from service providers — for example, our email provider tells us whether a verification or notification email was delivered, opened, or bounced.

Required and optional information

Some information is necessary to provide Ollio. You need to provide it to create an account, verify your email address, create or join a Workspace, or use particular features. If you do not provide required information, we may not be able to give you the relevant account, access, or feature.

Other information is optional — for example a profile photo, a phone number, a company logo, or the reason field on a beta-access request. You can choose not to provide optional information, or remove it later, without losing access to the core service.

How we use information

We use the information described above to:

• create and administer your account and your organisation's Workspace;
• verify your email address and administer invitation-based beta access;
• provide the Ollio tools and features you and your team use;
• operate, maintain, secure, and improve the service, including troubleshooting and testing during the beta;
• provide customer support and respond to feedback, questions, and beta-access requests;
• protect Ollio, our users, and the public — including detecting, investigating, and preventing fraud, abuse, security incidents, and violations of our Terms;
• send you service communications about your account, security, the beta, and material changes to Ollio or this Policy;
• comply with legal obligations and enforce our agreements.

We do not use your information for advertising, and we do not sell your personal information or your Business Data. We do not build advertising or marketing profiles about you.

Workspace data and organisational access

Ollio is organised around company Workspaces. Each Workspace's Business Data is kept logically separated from other Workspaces, and access within a Workspace is controlled by the roles and permissions your organisation's administrators assign.

• A Workspace contains business information provided by your organisation and its team members.
• Workspace administrators control who can join the Workspace and what each member can see and do, through roles, permissions, branch scope, and tool access.
• Your organisation is responsible for having an appropriate legal basis — such as authority or consent — to enter personal information about its customers, suppliers, employees, or other individuals into Ollio, and for responding to those individuals' requests about that information.
• Ollio processes Workspace information on your organisation's behalf as needed to provide, support, secure, and improve the service.

Ollio's platform staff can access account and organisation information and — where reasonably necessary to provide support, investigate misuse, keep the service secure, or comply with law — other information in a Workspace. Sensitive platform-administration actions are recorded in an internal audit log.

How we share information

We do not sell your personal information. We share information only in these circumstances:

• With your organisation — if you use Ollio through a Workspace, your activity and the records you create are visible to others in that Workspace according to its roles and permissions.
• With service providers — companies that help us operate Ollio, as described in "Service providers".
• For legal reasons — where we believe in good faith that disclosure is required by law, or is reasonably necessary to enforce our Terms, protect the rights, safety, or property of Ollio, our users, or the public, or respond to a lawful request from an authority.
• In a business transfer — if Ollio is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy or a successor policy.
• With your consent — for any other sharing, we will ask you first.

Service providers

We use service providers to help operate Ollio. They may process information as necessary to provide their services to us, and are subject to applicable contractual, confidentiality, security, and legal requirements.

Current categories of service provider include:

• cloud hosting and database infrastructure;
• object storage for files and images uploaded to Ollio;
• transactional email delivery, for verification codes, password resets, invitations, and account notifications;
• application error logging and monitoring.

We may add, remove, or change service providers as the product and infrastructure evolve. When a change is significant, we will update this Policy.

Data hosting and international transfers

Ollio and its service providers may store and process information in Malaysia and in other countries where the relevant infrastructure or service providers operate. This means your information, including Business Data, may be transferred to, stored in, or accessed from outside Malaysia.

Where personal data is transferred outside Malaysia, we take steps to handle the transfer in accordance with applicable Malaysian data protection requirements and to apply appropriate safeguards, such as contractual protections and security controls with the parties involved.

Retention

We keep personal information for as long as it is reasonably needed for the purposes described in this Policy. In practice, how long we keep information depends on factors such as:

• how long your account and your organisation's Workspace remain active;
• whether we need the information to provide support, keep the service secure, or investigate fraud or abuse;
• our legal, accounting, and reporting obligations;
• the presence of information in system backups, which are retained for a limited period and then overwritten on a rolling basis.

When information is no longer reasonably required, we take steps to delete or anonymise it. Ollio does not yet operate a single fixed retention schedule for every category of data; our retention practices will continue to be formalised as the service moves toward general availability.

Account and Workspace closure

You can ask us to close your individual account at any time. When an account is closed, we deactivate it so it can no longer be used to sign in, and we delete or anonymise associated personal information that is no longer needed, unless we are required or permitted to keep it for legal, security, or legitimate business reasons.

Closing an individual team member's account does not close the organisation's Workspace or delete the organisation's Business Data — a Workspace and its records remain under the control of the organisation and its administrators. If an organisation ends its use of Ollio, its Workspace administrator can ask us to close the Workspace; we then deactivate it and delete or anonymise the associated data in line with the retention practices above.

Ollio does not currently provide a self-service data export. If you need a copy of specific information before an account or Workspace is closed, contact us and we will consider the request in line with applicable law.

Security

We maintain technical and organisational measures designed to protect information against unauthorised access, alteration, disclosure, or loss. These include:

• storing passwords only as salted hashes (bcrypt), never in plain text;
• encrypting traffic between your browser and Ollio using HTTPS;
• role- and permission-based access controls within each Workspace, and logical separation between Workspaces;
• restricted, audit-logged access for platform staff;
• application logging and monitoring, and ongoing security review during the beta.

No online service can be guaranteed completely secure. You also play an important role: use a strong, unique password, keep your credentials confidential, and tell us promptly if you believe your account has been compromised.

Your privacy rights

Subject to applicable law and relevant exceptions, you may have the right to:

• ask whether we hold personal information about you, and how it is processed;
• request access to that information and a copy of it;
• ask us to correct information that is inaccurate or incomplete;
• withdraw consent where we rely on consent to process your information;
• ask us to limit or stop certain processing, or to delete information, where applicable;
• object to processing of your personal information for direct marketing (Ollio does not currently carry out direct marketing).

You can review and update much of your account information directly in Settings. Workspace administrators can review and update company and team information for their organisation.

If your personal information is held in a Workspace by an organisation that uses Ollio — for example because you are that organisation's customer, supplier, or employee — you should usually direct your request to that organisation, which controls the information. We will help the organisation respond where appropriate.

We will respond to genuine requests within a reasonable time. We may need to verify your identity first, and some information may be retained where the law allows or requires it. Ollio does not use automated decision-making that produces legal or similarly significant effects about you.

Cookies and similar technologies

Ollio uses a small number of cookies and similar browser storage technologies. We do not use third-party advertising or cross-site tracking cookies.

• Authentication — a secure, http-only session cookie keeps you signed in after you log in, and related cookies protect the sign-in process against cross-site request forgery.
• Preferences — a cookie remembers your chosen interface language so pages load in the right language; some preferences are also stored in your browser's local storage.
• Registration and beta requests — a short-lived, secure cookie confirms that you verified an email address before you submit a registration or beta-access request.
• Website analytics — a first-party cookie stores a random identifier so we can estimate unique visits to our public pages; it expires after 24 hours. See "Analytics".

Most cookies we use are necessary for the service to work. You can control cookies through your browser settings, but blocking essential cookies may prevent you from signing in or using parts of Ollio.

Analytics

We use our own first-party analytics to understand how our public website is used. When you visit a public page, or click a call-to-action such as “Join Beta”, we record an event that includes the page path, the referring website's domain, any UTM campaign parameters in the link you followed, a general device category (desktop, tablet, or mobile) derived from your browser, and a coarse country derived from your connection. These events are stored in our own database.

We use a first-party cookie with a random identifier, which expires after 24 hours, to estimate unique visits. We do not use Google Analytics or other third-party analytics services on the website, and we do not sell or share this analytics data. We have not verified this measurement as fully anonymous, cookie-free, or “no tracking”; it is limited, first-party usage measurement.

Children and age eligibility

Ollio is a tool for businesses and is not directed to children. You must be at least 18 years old, or the age of legal majority where you live, to use Ollio. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will take appropriate steps.

Contact us

If you have questions about this Privacy Policy, or you want to exercise a privacy right, you can reach us through the Contact page on our website, or the WhatsApp number listed in the website footer. Please tell us that your message is a privacy request so we can handle it appropriately.

Changes to this Privacy Policy

Because Ollio is in active beta, we may update this Privacy Policy as the product and our practices evolve. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify registered users. If you continue to use Ollio after an update takes effect, you accept the revised Policy.