Privacy policy

Last updated October 31, 2026

Version 2026-10-31

This policy covers octosup.ai, the Octosup beta at app.octosup.ai, and our communications with you. It explains who handles your personal data, for what purposes, and how to exercise your rights.

Who is responsible

The data controller is Di Cosmo Vincenzo, sole proprietorship, VAT IT11115670967:

Our role and your workspace

We are the controller for account administration, service security and our communications with you. When an organisation uses Octosup to store personal data in its workspace, that organisation determines why that data is used and acts as its controller; we process workspace content on its instructions. Contact your workspace administrator about that content, or write to us for help identifying the right contact. A data processing agreement is required where we act as a processor.

What we collect

• Account and workspace. Email address, profile information you provide, membership, roles, invitations, sign-in records, and the version and date of your acceptance of our terms and DPA and acknowledgement of this policy.
• Your work. Cards, comments, requests, responses, documents, attachments and their revision and activity history, including the author and time of actions. Other members and agents with access to the project can read the content available to them.
• Connected services. Agent connection details, permissions and activity; if you link Telegram, the identifiers and messages needed for that connection. You can choose whether to connect these services.
• Support. Your address and the information you send when you contact us.
• Technical logs. Our hosting and authentication providers record technical information, including IP addresses, browser details and request or sign-in times, to operate the service and prevent abuse.

The public website runs no advertising or analytics scripts and sets no tracking cookies. The app uses authentication cookies needed to keep you signed in. Blocking them may prevent sign-in.

Why, and on what basis

• Account access, invitations and service communications: to perform our agreement with you or take steps you request before it (Art. 6(1)(b)). Account details needed for sign-in are required to use the app; without them we cannot provide an account.
• Workspace content: to provide the service on the workspace controller's instructions. That controller is responsible for its legal basis and for informing the people whose data it uploads.
• Support and service security: our legitimate interest in answering requests, preventing abuse and protecting accounts (Art. 6(1)(f)); legal obligations where applicable (Art. 6(1)(c)).
• Technical logs: our legitimate interest in a secure, working site (Art. 6(1)(f)).

We don't sell your data, don't use it for advertising and don't send newsletters.

Agents and optional connections

When you connect an external AI client, it can receive project information through the access you approve. Its provider handles that information under its own terms and privacy policy. Check those policies, including model training and retention settings, before connecting it. Revoking access prevents future authorised access; it does not recall copies already received. Telegram also processes data under its own privacy policy when you use that integration.

We do not make decisions with legal or similarly significant effects about you solely by automated processing.

Service providers and other recipients

• Vercel: hosting of the website and app.
• Supabase: authentication, database, file storage and realtime updates for the app, and the waitlist when available.
• Resend: delivery of account and invitation emails.
• Apple iCloud Mail: correspondence sent to our contact address.

Only people who need access to operate or support the service should access your data. We may also disclose data where required by law or necessary to establish or defend legal claims.

The app's database, authentication and file storage are hosted in Frankfurt, Germany, and the app's server functions run in Frankfurt. Transactional email is sent from Ireland. This does not mean all processing remains in the EU: website delivery, support and provider operations may involve other locations, including access from the United States. Transfers outside the European Economic Area rely on applicable adequacy decisions, including the EU–US Data Privacy Framework for certified recipients and covered transfers, or the European Commission's Standard Contractual Clauses. Contact us to request details of the safeguards applicable to your data or a copy of them.

How long we keep it

Account data is kept while your account is active. Workspace content is kept to provide the workspace and its history, subject to the controller's instructions and erasure rights. Security logs and deletion receipts are retained only as needed for security, handling requests and legal obligations. Database backups are retained for 7 days. They do not include files stored as attachments. Point-in-time recovery (PITR) is disabled. Resend retains transactional email content and delivery logs for 30 days. Deleting live data does not immediately erase every backup. Contact us for the retention details applicable to your request.

Deleting your account

You can request deletion in Account settings or by writing to hello@octosup.ai. You do not need to accept the terms to request deletion. We verify your identity before processing the request. If you are the only owner of a workspace with other active members, transfer ownership first.

Account deletion removes your sign-in identity and disconnects Telegram. Your contributions in shared workspaces remain attributed to “Deleted user”. Personal information inside comments, documents or attachments is not automatically removed: this is not complete anonymisation. Contact us and the workspace controller to request erasure of that information.

Workspaces where you are the only active member become inaccessible and become eligible for permanent deletion after 14 days. This is an eligibility period, not a promise that every copy is erased on day 14. Requests concerning backups, shared content or external providers require separate handling.

Your rights

You can ask to see, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. Write to hello@octosup.ai. We normally respond within one month. If a complex request requires an extension permitted by law, we explain why within that month.

Where processing relies on consent, you can withdraw it at any time without affecting earlier lawful processing. You can object to processing based on legitimate interests. Access, correction, erasure, restriction and portability apply subject to the conditions in the GDPR. Exercising your rights is normally free; we may need proportionate information to verify your identity.

If you think we handled your data wrongly, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority where you live.

Changes

If this page changes in a way that matters, we'll update the date above.