Privacy Policy

Edition 2026-10-09. Effective from 2026-10-09.

1. Controller and contact

ContentTech LLC, identification number 445866411, is the controller for the personal data it processes to provide Oktava. Registered address: Georgia, Batumi, Zubalashvili street N 39-39a, floor 1, apartment N1. Contact for data requests and support: support@oktava.app.

Oktava provides background-music software to businesses. Personal data includes information about the owners, staff and other people who use or represent a business account. A company account does not remove the rights of those individuals.

2. Data, sources and purposes

We process the following data to operate the Service:

- Account and sign-in information: email address, authentication identifier, profile and account country; used for access and account security. Password-based sign-in is handled by Auth0. - Business information: organisation details and tax identifiers, Location names and addresses, playback points and devices; used to manage subscriptions and produce Location documents. - Service records: track playback, device activation and revocation, subscription changes, generated documents, referral links and product events; used to deliver and support the Service. - Payment-related records: customer and subscription references, transaction status and billing information received from Paddle. Payment notifications may contain buyer or billing details as well as identifiers. Oktava does not collect full payment-card details through its application. - Technical and support records: network and device information, timestamps, logs, error information, messages, attachments and replies; used to diagnose issues, protect access and handle requests. - Analytics and, when you agree, session recordings; used to understand use of the application and diagnose problems.

We receive information directly from you and through your use of the Service; from the business account holder where they enter contact or Location details; from Auth0 for authentication; and from Paddle for transactions and subscription status. Technical records are generated by the application and its service providers. Support records include the information you or an authorised contact sends us.

3. Grounds for processing

Where GDPR applies, processing necessary to provide a contract with an individual business customer relies on Article 6(1)(b). For contact persons acting for a company, necessary account administration, security and support rely on legitimate interests under Article 6(1)(f), subject to the person's rights. A legal obligation is used only for the records that the applicable obligation requires. Product measurement is used to understand how the Service is used, diagnose problems and assess changes. Where this processing is permitted on the basis of legitimate interests, these are our interests in maintaining and improving the Service, subject to the rights and reasonable expectations of users. Where consent is required, that processing must wait for consent. Optional session recordings and promotional communications require the relevant consent, which can be withdrawn without affecting the lawfulness of processing before withdrawal.

Providing account and operational data is necessary to use the corresponding features. A person may object to processing based on legitimate interests; a request is assessed according to the applicable law. Acceptance of service terms is separate from optional consent. Refusing optional session recording or promotional communications does not prevent use of the paid Service. Necessary service messages, including payment and security notices, are separate from promotional communications.

4. Recipients

ContentTech LLC contracts with the service providers used to operate Oktava. Auth0 provides authentication; Aiven hosts the database; Bunny hosts and delivers service content; Resend delivers service email; PostHog provides product analytics and optional session recordings. Support correspondence is handled through the company's support mailbox. Authorised staff and, where needed, professional advisers access data for their assigned tasks.

Paddle generally processes payment data as a separate controller under its privacy terms. Different roles may apply to particular data flows under applicable law and Paddle's Data Sharing Addendum. Deleting an Oktava account does not instruct Paddle to erase records it must retain. We may also disclose information where required by a lawful request, or as necessary in a business transfer subject to applicable safeguards.

5. Processing locations

Our service providers process data in the locations described below; access by their staff and subprocessors is governed by the applicable arrangements. The Service does not promise EU-only processing. The Auth0 tenant is in EU-2, PostHog uses its EU service and the Bunny origin storage and application settings use Germany. These settings do not establish the location of every support activity, delivery edge, log or backup. Resend states that its data is stored in the United States; an email sending region does not change that storage location.

Information about our providers' international processing and transfer safeguards is available in the data-protection terms of Auth0, Aiven, Bunny, Resend and PostHog. The arrangements applicable to a transfer depend on the recipient, processing location and governing law.

You can request information about the transfers relevant to your data and a copy of the applicable safeguards at support@oktava.app.

6. Retention and deletion

We keep operational account data while it is needed to provide the Service. Requests to close an account, obtain a copy or delete data are handled through support; in-product export or deletion does not by itself establish that all provider-held data has been processed.

The PostHog project retains session recordings for 30 days. The Auth0 Free plan lists one day of authentication logs; this does not describe profile or backup retention. For support records, the criteria are whether the request is resolved, whether follow-up remains necessary and whether a specific legal obligation or claim requires retention. For security records, the criteria are investigation and remediation of incidents and applicable legal duties. Payment, contractual and playback evidence is retained only to the extent needed for a specific obligation or claim and the period applicable to it. Accounting records subject to Georgian accounting law are retained for six years after the relevant reporting period, unless another applicable rule requires otherwise.

Removing an email address or replacing an account identifier does not necessarily anonymise Location history, playback logs, certificates or payment records. Retained evidence is limited to what is needed for a specified obligation or claim; it is not automatically excluded from a deletion request. Deletion from the active application is separate from retention in provider backups. Contact support for the scope and status of your deletion request, including any provider-held copies and records that remain retained.

7. Requests and rights

Write to support@oktava.app to request access, correction, deletion, restriction, portability, to object, or to withdraw consent where those rights apply. We may request proportionate information to confirm identity. Do not send passwords or complete card details.

Where GDPR applies, the response period is normally one month. Where permitted, complex or numerous requests may require up to two further months; we explain the extension within the initial month. A restriction or refusal must have an applicable reason; it is not automatic merely because data relates to a business. You may complain to the relevant supervisory authority.

Where Georgian data-protection law applies, requests for information, access, correction or erasure generally have a 10-working-day response period; extensions are available only where the applicable provision permits them. Other requests may have shorter periods. You may complain to the State Audit Office of Georgia or seek a court remedy. We apply the deadline and safeguards required for the particular request, including a shorter applicable deadline.

Rights and procedures under other countries' laws depend on the applicable law. The choice of Georgian law for the Service contract does not remove those protections.

8. Analytics and security

The application uses storage needed for sign-in and interface settings. Optional session recording is subject to a separate consent choice; withdraw it through the available setting or by contacting support. When product analytics is enabled, the application is configured to use a mode without analytics cookies before consent to recording. Cookieless processing can still involve personal data, including technical identifiers and events associated with an account. Agreeing to recording enables the associated browser storage and recording features. The replay configuration masks inputs and marked elements, but masking is not a guarantee that a recording can contain no personal information.

Access controls, protected connections and operational procedures are used to protect data. No absolute security guarantee is given. If an incident requires notification, we follow the applicable notification duties.

9. Updates

A policy update does not itself provide consent or a new legal basis for processing. Where a new purpose requires additional information or consent, we provide that information and obtain any required consent before starting the processing. Published policies identify their version and effective date. Material changes are communicated through the Service or the account contact. The version and effective date displayed with this policy identify the applicable edition.