How Olyven handles personal information

1. Scope and responsible organization

This policy applies to Olyven LLC websites, applications, communications, and services that link to it. It covers information we process as a business or data controller for our own operations and information we process as a service provider or data processor on behalf of a customer organization.

When a customer connects a social-media, advertising, or lead-generation account, that customer generally determines the business purpose for the connected data. Olyven processes that information only to provide the authorized service, according to the customer's instructions, applicable law, and the relevant platform rules.

2. Information we collect

3. Sources of information

We obtain information from:

• users, customers, and authorized workspace administrators;
• connected platforms when a user grants permission;
• service providers supporting authentication, hosting, billing, communications, security, and analytics;
• public business sources when needed for legitimate business communications; and
• automated technologies used to operate our websites and applications.

4. How we use information

We use information to:

• create and administer accounts, organizations, subscriptions, and customer workspaces;
• provide brand, strategy, content, publishing, campaign, lead-management, reporting, and notification features;
• perform actions that a user has expressly authorized on a connected platform;
• show a user what will be published or changed and record approvals where the workflow requires approval;
• provide customer support, service notices, security alerts, and operational communications;
• prevent fraud, abuse, unauthorized access, impersonation, and violations of our Terms of Use;
• maintain auditability, reliability, performance, and product improvement;
• comply with legal obligations and enforce contractual rights; and
• perform other purposes disclosed at collection or authorized by the user.

5. Legal bases

Where applicable law requires a legal basis, we process information to perform a contract, take steps at a user's request, comply with legal obligations, pursue legitimate interests that are not overridden by the individual's rights, or based on consent. A user may withdraw consent for a connected integration by disconnecting it or revoking the application in the platform settings.

6. LinkedIn, Meta, and X integrations

Use of each connected platform remains subject to that platform's own terms, privacy policy, permissions, and account settings. Olyven is not endorsed by LinkedIn, Meta, or X merely because an integration is available.

7. Artificial intelligence

Olyven may use artificial intelligence to assist with drafting, design, classification, recommendations, analysis, or workflow automation. Customer content may be sent to contracted AI service providers only as needed to perform the requested feature and subject to contractual, security, and data-minimization controls.

We do not use information obtained from LinkedIn, Meta, or X APIs to train general-purpose, foundation, or frontier models. We also do not use connected-platform data to infer sensitive personal characteristics. AI-generated material may be inaccurate and should be reviewed by the user before publication or business use.

8. How we disclose information

We may disclose information:

• to the customer organization and its authorized workspace users;
• to a connected platform when the user instructs us to publish, manage, report, or perform another authorized action;
• to hosting, authentication, communications, billing, security, analytics, and AI service providers acting for Olyven;
• to professional advisers, auditors, insurers, or potential transaction counterparties under appropriate confidentiality controls;
• to authorities or other parties when reasonably necessary to comply with law, protect rights or safety, or address fraud and abuse; and
• as otherwise directed or consented to by the user or customer.

Olyven does not sell personal information. Olyven does not share personal information for cross-context behavioral advertising as those terms are defined by California privacy law.

9. Retention and deletion

We retain information only for the period reasonably necessary to provide the service, satisfy the customer's documented business need, comply with law and platform requirements, resolve disputes, and maintain security and audit records. The shortest applicable legal, contractual, or platform-specific limit controls.

• LinkedIn: certain member profile or activity data may be stored only for short periods, including periods as short as 24 or 48 hours. Other administrative and reporting data may have longer permitted periods. Stored LinkedIn Marketing Data will be permanently deleted within 10 days when required by LinkedIn's terms, including after a qualifying customer request or the end of the related service.
• Meta: Platform Data is deleted or de-identified when it is no longer necessary for the authorized purpose, when access is revoked, when deletion is requested, or when Meta requires deletion, subject to applicable law and permitted retention.
• X: stored X Content is updated or deleted when it is modified, deleted, protected, suspended, withheld, or removed on X. We act as soon as reasonably possible and, when required, within 24 hours after a request from X or the applicable account owner. On termination of API access, X data is deleted within the period required by the X Developer Agreement, currently no later than 10 business days.

Limited information may remain in secure backups until overwritten under standard backup cycles or may be retained when required by law, provided it is isolated from ordinary use. Detailed request instructions are available at olyven.co/data-deletion.

10. Cookies and similar technologies

We may use essential cookies and similar technologies for authentication, session continuity, security, preferences, diagnostics, and service operation. Where required, non-essential analytics or marketing technologies are used only after appropriate notice or consent. Browser settings may allow users to control cookies, but disabling essential technologies may prevent some features from working.

11. Security

We maintain administrative, technical, and organizational safeguards designed to protect information, including tenant isolation, role-based access controls, encrypted transport, protected credential and token storage, logging, monitoring, and access review. No system is completely secure, and we cannot guarantee that unauthorized access or loss will never occur.

12. Individual rights and choices

Depending on location and applicable law, individuals may have rights to request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. California residents may also have rights to know the categories and specific pieces of personal information collected, request correction or deletion, and receive equal service without unlawful discrimination for exercising privacy rights.

A customer organization may be responsible for responding to requests involving information Olyven processes on its behalf. We will assist the customer as required. We may verify identity and authority before completing a request and may deny or limit a request where permitted by law.

13. International processing

Olyven is based in the United States and may use service providers in other countries. Information may be processed in jurisdictions whose data-protection laws differ from those where the individual is located. We use contractual, organizational, and technical safeguards appropriate to the transfer and applicable law.

14. Children

Olyven's business services are not directed to children under 13, and we do not knowingly collect personal information directly from children under 13 through these services. Customer organizations using an Olyven product in an education context are responsible for obtaining required institutional, parental, or guardian permissions and for using an appropriately configured service and agreement.

15. Changes to this policy

We may update this policy to reflect service, legal, security, or platform-requirement changes. The revised version will be posted at this address with an updated effective date. Material changes may also be communicated through the service or by email where appropriate.