Privacy

Who is who

AInovaty DOO ("Othvia", "we") runs the Othvia service. Two roles matter.

• For the people who sign in to the products you build with Othvia, you are the controller of their personal data and Othvia is your processor. We act only on your instructions, which are your settings in the Console and your use of the API.

• For your own account in the Console, your billing details and the visitors of othvia.com, Othvia is the controller.

What Othvia holds about the people who sign in to your product

• Account data: email address, name, profile fields you choose to store, and the sign-in methods a person has set up, such as passkeys, a password hash or a linked Google or GitHub account. Passwords are stored only as salted hashes.

• Organization data: which company a person belongs to, their role, and what the company's identity provider sends about them, such as group membership. Directory sync keeps this current.

• Session and device data: active sessions, refresh tokens (stored as hashes), device names and the time and address of the last use.

• Security events: sign-ins, failed attempts, setup-link changes and administrator actions, with who did it and the network address it came from.

What Othvia holds about you as a customer

• Console account: name, work email, the workspaces you belong to and your role in them.

• Billing: plan, usage counts and invoices. Card and tax details are collected and kept by Paddle, our payment provider; we never see the full card number.

• Correspondence you send to hello@othvia.com.

• othvia.com: the site sets no advertising or cross-site tracking cookies. The sign-in and Console hosts set only the cookies needed to keep you signed in and to protect the sign-in from forgery.

Why we use it

To sign people in and keep accounts safe; to show administrators what happened; to send the events and emails you configure; to measure retained users for billing; to bill and answer support requests; and to meet legal obligations. The legal bases are performance of the contract, our legitimate interest in running and securing the service, and legal obligation. Othvia does not sell personal data and does not use it for advertising or to train models.

How long we keep it

• User and organization data stays until you or an administrator deletes it, or until directory sync removes the person.

• Audit events are kept for 90 days by default. You can set a period from 7 days to 10 years per realm in the Console. The oldest events are then removed.

• When you delete a realm, it is held for 30 days so a mistake can be undone, then it is purged and its signing keys are destroyed.

• Invoices and billing records are kept for as long as accounting and tax law require.

• Correspondence is kept while it is needed for support or the contract, then deleted.

Who else handles it

We use a small number of providers who process data on our behalf, each bound by a data processing agreement:

• Paddle: merchant of record for paid plans. It handles payment, invoicing and EU VAT.

• Postmark: delivery of the sign-in and notification emails Othvia sends by default. If your realm uses its own SMTP, Postmark, Resend, Amazon SES or SendGrid account, that provider is yours, not ours.

• Cloudflare: DNS for our domains and, only when you enable it for a realm, Turnstile bot checks on sign-in.

• Our infrastructure provider, which hosts the servers and backups.

Transfers outside Serbia and the EEA

Some providers above may process data in other countries. Where a destination does not have an adequate level of protection, we rely on standard contractual clauses or an equivalent safeguard approved under Serbian and EU law.

When Othvia is your processor

• We process personal data only on your documented instructions and tell you if an instruction appears to break data protection law.

• Everyone with access to it is bound by confidentiality. Data is encrypted in transit, and each realm's data is isolated from every other realm's.

• We help you answer requests from the people concerned: administrators can export or delete a person in the Console or through the API, and deletion is recorded in the audit log.

• We tell you without undue delay after we learn of a personal data breach affecting your realm.

• We use the providers listed above and tell you in advance before adding another one that processes your users' data. You may object, and if we cannot accommodate the objection you can close your realm.

• When your contract ends, we delete or return the data as described under retention, and you may audit our compliance by written request, once a year and with reasonable notice.

Your rights

Under the Serbian Law on Personal Data Protection and, where it applies, the GDPR, you may ask for access to your data, correction, deletion, restriction, a portable copy, and you may object to processing based on our legitimate interest. If you are a person who signs in to someone else's product, ask that product first: they decide how your data is used and we will help them answer. You may also complain to the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia or to your local supervisory authority.

Children

The Console and othvia.com are for businesses and are not directed at children under 16. Products you build are responsible for their own audience.

Changes

If we change this page in a way that matters to you, we email Console administrators at least 30 days before it applies. The date at the top always shows the current version.

Controller and contact

AInovaty DOO, Heroja Maričića 93, 36000 Kraljevo, Serbia. Company number MB 21873802, PIB 113475410.

Write to hello@othvia.com for any request about personal data.