Privacy Policy
Last updated: April 28, 2026
What Data We Collect
- Email addresses via waitlist signup
- Contact form submissions (name, email, category, message)
- AI chat messages, processed in real time to generate responses (see retention table for details)
- Anonymous product analytics events, only collected after you accept cookies via our consent banner
How We Use Your Data
- To send email updates about Ouoba (waitlist subscribers)
- To respond to contact form inquiries
- To provide AI assistant responses to your questions
- To improve platform features and content
- We do NOT sell personal data to any third parties
Third-Party Services
- Cloud database and authentication provider
- Transactional email service
- AI language model provider — your messages are processed solely to generate responses and are not used by the provider to train AI models
- Cloud hosting and content delivery provider
- Privacy-respecting product analytics service
- Managed infrastructure for caching, rate limiting, and background processing
- Web search provider used by the AI assistant
- Travel service affiliate partners
- Email service for receiving contact form submissions
Named Service Providers
When you subscribe, payment is processed by our payment provider, Stripe (PCI-DSS Level 1 certified). Stripe is the data controller for your billing details (card information, billing address, transaction records) and applies its own privacy policy and retention periods to that data. US federal tax record-keeping rules require Stripe to retain payment and tax records for typically 7 years. See Stripe's privacy notice at stripe.com/privacy for full details.
Sources of Travel and Health Information
Ouoba aggregates official travel and health advisories from authoritative public sources, including:
- UK Foreign, Commonwealth & Development Office (FCDO) — country-level travel advisories
- US Centers for Disease Control and Prevention (CDC) — international health notices
- World Health Organization (WHO) — global health alerts
These are one-way data flows: we read public advisories, we do not share user data with these organizations.
How Long We Keep Your Data
Different categories of data are retained for different periods, calibrated to operational necessity, regulatory requirement, and your right to be forgotten:
| Data category | Retention period |
|---|---|
| AI conversation messages | Not retained — messages are processed in real time and not stored in our database. |
| Cached AI responses | Up to 7 days. The original question text is not stored. |
| AI usage quota counter (rate limit) | 365 days |
| Operational logs | 30 days. May include IP addresses (used to enforce per-user rate limits), error context, and brief diagnostic information. |
| AI service usage data | 180 days. Technical information about AI interactions (request counts, error events). Used for rate limiting and abuse prevention. |
| Affiliate referral clicks | Indefinite — automatic deletion not currently applied. We plan to introduce a retention limit and will update this section. |
| Waitlist email subscriptions | Until you unsubscribe — then immediately deleted. |
| Onboarding email sequence state | Until completion or unsubscription — then immediately deleted. |
| Contact form submissions | Indefinite — automatic deletion not currently applied. We plan to introduce a retention limit and will update this section. |
| Feedback submissions | Indefinite — automatic deletion not currently applied. We plan to introduce a retention limit and will update this section. |
| Community contributions (safety reports) | Retained indefinitely as part of the public community resource. Removal requests via contact form. |
| Payment processing (handled by Stripe) | Stripe is the data controller; Stripe applies its own retention policy. US tax record-keeping rules typically require 7 years. |
| Subscription records (kept by Ouoba) | Indefinite — automatic deletion not currently applied. Removal after cancellation via contact form. |
| Cookie consent preference | 12 months |
| Free-trial gate cookie | 12 months on your device. Records that the trial was used; does not extend the trial beyond 30 days. |
Cookies
- Minimal cookies in current version
- Third-party travel service partners may set functional cookies
- No personal tracking or advertising cookies
- Anonymous product analytics, only when enabled by your cookie consent
Your Rights
You have the right to access, correct, export, or delete the data we hold about you, and to opt out of marketing communications.
For other rights — correction, marketing opt-out, or general questions — email the address below. We respond to all requests within 30 days.
We may ask you to verify your identity before fulfilling certain requests, to protect your data from unauthorized access.
Your California Privacy Rights
If you live in California, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you specific rights about your personal information. This section explains those rights and how to use them.
We do not sell your personal information. We do not share it. We have never done so.
Some pages on our site link to external sites — including public health and travel-advisory sources such as CDC, FCDO, and WHO, and to outside travel service providers. These external sites are operated independently of Ouoba and have their own privacy practices. For any questions about what those sites collect or how they use your information, please contact them directly through their own websites.
Your rights as a California resident
Right to know — you can ask what personal information we have about you, where we got it, why we have it, and who we have shared it with.
Right to delete — you can ask us to delete personal information we have collected from you, with limited legal exceptions.
Right to correct — you can ask us to correct inaccurate personal information we have about you.
Right to limit use of sensitive personal information — you can tell us to use your sensitive personal information only for the services you asked for.
Right to opt out of sale or sharing — we don't sell or share, so there's nothing to opt out of. You keep this right if our practices ever change.
Right to non-discrimination — we will not discriminate against you for exercising any of your privacy rights. We will not deny you services, charge you different prices, or provide a different level of quality because you exercised these rights.
Children
We do not knowingly collect, sell, or share the personal information of anyone under sixteen.
How to use these rights
To use any of these rights, use the data export and deletion tool linked above, or email us. We will verify your identity before acting on certain requests, as the law requires. We respond to verifiable requests within 45 days.
You can have someone else (an authorized agent) make a request for you. They need to give us written permission signed by you, and we may ask you to confirm your identity directly with us.
For California-specific privacy questions, email contact@ouobanyc.com with the subject "California Privacy Request".
Age Requirements
Ouoba is intended for users aged 16 and over.
In jurisdictions where the Children's Online Privacy Protection Act (COPPA) applies, the minimum age is 13.
We do not knowingly collect personal information from children below these thresholds. If we learn we have inadvertently collected such information, we will delete it.
About This Translation
This privacy policy is currently available in full in English. Translations into other languages are in preparation. Until translation is complete, the English version is the legally authoritative text.
Changes to This Policy
We may update this policy from time to time. The latest version is always available on this page.