Privacy Policy

This Privacy Policy explains how OhhWells Pte. Ltd. ("OhhWells", "we", "us") collects, uses, discloses and protects personal data when you visit ohhwells.com, use the OhhWells application, attend our events or webinars, or interact with us. We comply with the Singapore Personal Data Protection Act 2012 (PDPA) and, where applicable, the EU/UK GDPR and other privacy laws.

2.1 Two roles we play

• We are the data controller (PDPA: "organisation") for data about our own users, leads, event attendees and website visitors. This policy covers that.
• We are a data processor (PDPA: "data intermediary") for data that our customers' site visitors submit through forms, bookings or checkout on sites built with OhhWells. That data belongs to the business that owns the site. We process it only on their instructions under our Data Processing Addendum. If you submitted data on a site built with OhhWells, please contact that business directly — their privacy notice governs.

2.2 What we collect

You give us:

• Account details — name, email, password, company name, phone (optional), billing address.
• Payment details — handled by Stripe; we receive only the last four digits, card type and expiry, never full card numbers.
• Content — anything you upload or create in the editor, including brand assets and business descriptions used to generate AI Output.
• Communications — support emails, chat messages, survey answers, webinar/event registrations.
• Done-for-you project data — briefs, existing site access, migration files.

We collect automatically:

• Usage data — pages viewed, features used, clicks, session recordings and heatmaps (PostHog), device, browser, IP address, approximate location.
• Attribution data — referrer, UTM parameters, ad click IDs, and cross-subdomain cookies so we know which campaign brought you to us.
• Cookies and similar technologies (see Section 2.9).

From third parties:

• Partners and referrers who introduce you to us (e.g. a co-working space, community or integration partner).
• Public sources, when we prepare a Conversion Score audit of a website you or someone else submits.

2.3 Why we use it (and our legal basis under GDPR)

Under the PDPA we collect, use and disclose personal data with your consent, or where deemed consent or an exception applies, and only for purposes a reasonable person would consider appropriate.

2.4 AI and your data

• Your inputs (business descriptions, brand assets, prompts) are sent to Anthropic to generate output, under commercial terms that do not permit Anthropic to use your data to train its models.
• We do not use Your Content to train AI models, and we will not do so without asking you first.
• We may use aggregated, de-identified data (e.g. Conversion Score benchmarks) for research and published reports. This data cannot identify you or your business.

2.5 Who we share it with

We do not sell, rent or trade personal data. We share it only with:

• Service providers who process data for us under contract: Vercel (hosting), Stripe (billing), Anthropic (AI generation), Resend and Loops (email), PostHog and Google Analytics (analytics), Sanity (content), Slack and Zapier (internal operations). The vendors that handle data submitted on our customers' websites are listed separately in our DPA at ohhwells.com/legal/dpa.
• Advertising platforms (Meta) — pixel and conversion data, subject to your cookie choices.
• Partners — only where you signed up via a partner link and only to confirm the referral and grant credits; we do not share your content or usage.
• Professional advisers, auditors and authorities where legally required, or to protect our rights, safety or property.
• A buyer or successor in a merger, acquisition or asset sale, with notice to you.

2.6 International transfers

We are based in Singapore and our providers operate in Singapore, the United States, the EU and elsewhere. When personal data leaves the country where it was collected, we ensure a comparable standard of protection as required by the PDPA (Transfer Limitation Obligation) and, for EU/UK data, use Standard Contractual Clauses or an adequacy decision.

2.7 How long we keep it

• Account and content data — for the life of your account, then deleted or anonymised within 90 days of termination, except where we must keep it longer.
• Billing records — 7 years (Singapore tax and accounting rules).
• Marketing data — until you unsubscribe or after 24 months of inactivity.
• Analytics and session recordings — up to 12 months.
• Support correspondence — 3 years from the last message.

2.8 Security

We use encryption in transit (TLS), encryption at rest at our hosting providers, access controls, and vendor due diligence. No system is perfectly secure; if we suffer a data breach that is likely to cause significant harm, we will notify the PDPC and affected individuals as required by law (and controllers within 72 hours under our DPA).

2.9 Cookies and tracking

We use:

• Essential cookies — login, session, security, cross-subdomain identity. Always on.
• Analytics cookies — PostHog and Google Analytics 4. PostHog session recordings mask keystrokes and form inputs so they are never recorded.
• Advertising cookies — Meta Pixel, for measuring and retargeting.
• Attribution cookies — store your referrer, UTM and click IDs across ohhwells.com and the app. These are treated as analytics cookies and only set with your consent.

Every visitor sees a cookie banner on their first visit. You can accept all, reject non-essential cookies, or choose which categories to allow, and you can change your choice at any time via the "Cookie settings" link in the footer. You can also block cookies in your browser; some features may stop working.

2.10 Marketing communications

We send marketing email only if you signed up for it, downloaded a resource, attended an event, or are a customer and did not opt out. Every marketing email has an unsubscribe link. Service emails (receipts, security, trial-end, dunning) are not marketing and continue while you have an account. We do not send unsolicited marketing to Singapore phone numbers on the Do Not Call Registry.

2.11 Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and learn how it has been used or disclosed in the past year (PDPA).
• Correct inaccurate or incomplete data.
• Delete your data, or restrict or object to certain processing (GDPR).
• Port your data in a machine-readable format (PDPA Data Portability Obligation, once in force; GDPR).
• Withdraw consent at any time, including for marketing, without affecting prior processing.
• Complain to a regulator — in Singapore, the Personal Data Protection Commission (pdpc.gov.sg); in the EU/UK, your local supervisory authority.

To exercise a right, email support@ohhwells.com. We will respond within 30 days and may need to verify your identity. We will not charge a fee unless the request is excessive, and will tell you first.

2.12 Children

The Services are not directed at anyone under 18 and we do not knowingly collect their data. If you believe a minor has given us data, contact us and we will delete it.

2.13 Third-party sites

Our site and customers' sites may link to third-party sites and services. Their privacy practices are their own.

2.14 Changes

We may update this policy. Material changes will be announced by email or in-app at least 14 days before they take effect. The "Last updated" date shows the current version.

2.15 Data Protection Officer and contact

Under the PDPA we have appointed a Data Protection Officer.

Data Protection Officer, OhhWells Pte. Ltd.
160 Robinson Road, Singapore Business Federation Center, Singapore 068914
Email: support@ohhwells.com (put "Privacy" in the subject line)