# Privacy Policy

Legal

# Privacy Policy

OllyGarden, Inc. | Last Updated: September 30, 2026

## Who we are

OllyGarden, Inc. (“OllyGarden”, “we”) is the controller of the personal data described in this policy. It covers our website at ollygarden.com, the OllyGarden platform at ollygarden.app (including Insights, Rose, and Tulip), and our sales and support communications.

OllyGarden, Inc. is located at 251 Little Falls Drive, Wilmington, DE 19808, United States. Our establishment in the European Union is OllyGarden GmbH, Hauptstr. 14, 13158 Berlin, Germany, which is also our contact point in the EU. See our [imprint](/imprint) for company details.

Questions and requests about your personal data can be sent to [[email protected]](/cdn-cgi/l/email-protection#ea999f9a9a85989eaa858686938d8b988e8f84c4898587).

When customers send us telemetry, source code, or other content to analyze, we process it on their behalf as a processor, under our agreement with that customer and our [Data Processing Addendum](/cdn-cgi/l/email-protection#295a5c5959465b5d69464545504e485b4d4c47074a4644165a5c4b434c4a5d146d485d480c1b19795b464a4c5a5a40474e0c1b19684d4d4c474d5c44), which is available on request. The customer's own privacy notice governs that data.

## Our website

### Visiting the website

DataIP address, browser and device details, requested URL, referrer, and time of the request.PurposeDelivering the website, keeping it secure, and diagnosing errors.Legal basisOur legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).RetentionHosting logs are kept for the short period our hosting provider retains them.

### Website analytics (only with your consent)

DataPages viewed, clicks on links and buttons, time on page, scroll depth, performance measurements, browser and device type, approximate location derived from your IP address, and the referring site and campaign parameters. We remove URL query strings and fragments, mask page text, and do not record sessions.PurposeUnderstanding how the website is used so we can improve it.Legal basisYour consent (Art. 6(1)(a) GDPR).RetentionUntil you withdraw consent, and no longer than needed for trend analysis.

### Identifying visiting companies (only with your consent)

DataYour IP address, the pages you visit, the referring site, campaign parameters, and an anonymous identifier stored in your browser. Our provider matches the IP address to the organization that owns the network. We do not use this to identify you as an individual.PurposeUnderstanding which organizations are interested in OllyGarden, so our sales team can prioritize follow-up.Legal basisYour consent (Art. 6(1)(a) GDPR).RetentionUntil you withdraw consent, or until the organization-level record is no longer relevant to sales.

### Contact, product inquiry, and open source application forms

DataName, email address, and, depending on the form, company, message, support tier, or GitHub repository URL.PurposeResponding to your request and evaluating your inquiry or application.Legal basisSteps you ask us to take before entering a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR).RetentionAs long as needed to handle your request and any resulting business relationship.

### Job applications

DataFull name, email address, and optional LinkedIn and GitHub profile URLs, plus anything you share with us during the hiring process.PurposeAssessing your application and running our hiring process.Legal basisSteps prior to entering an employment contract (Art. 6(1)(b) GDPR, § 26 BDSG).RetentionUntil the position is filled and the period for legal claims has passed, unless you agree to a longer period.

## The OllyGarden platform and our business relationships

### Your account

DataName, email address, authentication identifiers, organization memberships, and sign-in timestamps.PurposeCreating and securing your account and giving you access to the OllyGarden platform.Legal basisPerformance of our contract with you or your organization (Art. 6(1)(b) GDPR).RetentionFor as long as the account exists. Upon deletion, within 30 days, except where the law requires us to keep records.

### Product analytics, session recordings, and error monitoring

DataA pseudonymous user identifier, account creation and last sign-in times, pages viewed in the app, errors, browser console messages, and performance measurements. We also record sessions: replays of your interactions with the app, such as clicks, scrolling, and page layout. All text on screen and in form fields is masked in your browser before recordings are sent, so recordings do not contain what you read or type. We remove URL query strings before analytics events are sent.PurposeKeeping the platform reliable, reproducing and fixing errors, and improving features.Legal basisOur legitimate interest in operating and improving the service (Art. 6(1)(f) GDPR).RetentionSession recordings are deleted after 90 days. Other analytics data is kept no longer than needed for trend analysis and troubleshooting.

### Rose managed repository analysis

DataRepository source code and metadata; file contents, searches, and command output selected during analysis; findings, suggested fixes, execution records, and Rose pull request comments. Operational telemetry can include secret-redacted model and tool inputs and outputs, truncated to 4 KB per item, and therefore code excerpts.PurposeAnalyzing OpenTelemetry instrumentation, presenting findings, preparing proposed fixes for human review, securing and operating Rose, and monitoring quality and reliability.Legal basisPerformance of our contract with you or your organization (Art. 6(1)(b) GDPR) and our legitimate interest in operating a secure and reliable service (Art. 6(1)(f) GDPR).RetentionFull repository checkouts and build artifacts are destroyed with each sandbox. Findings, metadata, execution and follow-up records are kept for the lifetime of the account or until deletion is requested. Rose operational telemetry in Grafana Cloud and Datadog is retained indefinitely and is not removed by deletion requests; telemetry collection can be disabled on request. AI providers may retain prompts and responses for up to 30 days by default. Zero-data-retention routing is available as a separate Enterprise add-on.

### Billing

DataBilling contact, company details, and payment information. Our payment provider processes card details; we do not store them.PurposeCharging for paid plans and meeting accounting obligations.Legal basisPerformance of a contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR).RetentionAs required by tax and commercial law.

### Business contacts and sales outreach

DataName, business email address, job title, employer, and professional profile information from business databases or from your interactions with us.PurposeReaching out to organizations that may benefit from OllyGarden and managing our customer relationships.Legal basisOur legitimate interest in business-to-business marketing (Art. 6(1)(f) GDPR). You can object at any time and we will stop.RetentionUntil you object, or until the contact is no longer relevant to our business.

## Cookies and similar technologies

Our website stores your cookie choice in your browser for 12 months. This is strictly necessary and needs no consent.

Analytics and company identification use cookies and browser local storage, and start only after you select **Accept analytics**. If you choose essential cookies only, neither runs. You can change your choice at any time through **Cookie settings** in the website footer. Withdrawing consent stops collection from your next page view and clears the related local storage; it does not affect processing that took place before.

The OllyGarden platform uses cookies and local storage that are necessary to sign you in and keep your session secure, and for the product analytics described above.

## Who receives your data

We share personal data only with service providers that process it on our behalf and under our instructions and applicable contractual terms:

- • Netlify: Website hosting and delivery
- • Supabase (EU): Storage of website form submissions
- • Resend: Delivery of form submissions to our team by email
- • PostHog (EU): Website analytics
- • Apollo.io: Identification of visiting organizations, business contact data, sales outreach
- • HubSpot: Customer relationship management
- • Google Workspace: Email and documentsThe providers that host and operate the OllyGarden platform, including the AI providers that Rose uses, are listed with their purpose and location on our [subprocessors page](/subprocessors).

We may also disclose personal data where the law requires it, or to protect our rights. We do not sell personal data.

## International transfers

Some of our service providers process data in the United States and other countries outside the European Economic Area. By default, the managed Rose service analyzes repositories in E2B's managed United States region and sends selected repository content through OpenRouter to provider-managed OpenAI and Anthropic endpoints. An agreed EU-only Enterprise configuration covers the entire Rose service, including AI processing, managed sandboxes, storage, and telemetry; this is separate from optional zero-data-retention model routing. Our Grafana Cloud monitoring runs in the United Kingdom. For transfers to the United Kingdom we rely on the European Commission's adequacy decision. For other transfers we rely on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.

## Your rights

Under the GDPR and similar laws, you have the right to:

- • Access the personal data we hold about you and receive a copy
- • Have inaccurate data corrected
- • Have your data deleted
- • Restrict how we process your data
- • Receive your data in a portable format
- • Object to processing based on our legitimate interests, including sales outreach
- • Withdraw your consent at any time
- • Lodge a complaint with a data protection supervisory authorityYou can complain to the supervisory authority where you live or work. The authority responsible for our EU establishment is the Berlin Commissioner for Data Protection and Freedom of Information ([Berliner Beauftragte für Datenschutz und Informationsfreiheit](https://www.datenschutz-berlin.de)).

To exercise a right, email [[email protected]](/cdn-cgi/l/email-protection#ed9e989d9d829f99ad828181948a8c9f898883c38e8280). For deletion, use the subject [“Data Deletion Request”](/cdn-cgi/l/email-protection#a8dbddd8d8c7dadce8c7c4c4d1cfc9dacccdc686cbc7c597dbddcac2cdcbdc95ecc9dcc98d9a98eccdc4cddcc1c7c68d9a98facdd9ddcddbdc). We acknowledge requests within 5 business days, verify your identity before acting, and complete verified requests within 30 days.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

## Security

We protect personal data with encryption in transit and at rest, access controls, and monitoring. Our [Data Protection Policy](/data-protection-policy) describes these controls, and our [security page](/security) explains how to report a vulnerability to [[email protected]](/cdn-cgi/l/email-protection#2754424452554e535e67484b4b5e4046554342490944484a).

## Children and changes to this policy

OllyGarden is a business service and is not directed at children under 16. We do not knowingly collect their personal data.

We update this policy when our practices change and show the date of the latest change at the top of this page.

Canonical URL: https://ollygarden.com/privacy-policy