Privacy policy
Last updated October 20, 2026
- 1
Who we are
Overheard is operated by Cyos Technologies, a software company based in Brazil (“we”, “us”). We decide why and how your personal data is processed, which makes us the controller under the EU General Data Protection Regulation (GDPR), the UK GDPR and Brazil's General Data Protection Law (LGPD).
For anything about your data, write to hello@overheard.sh.
- 2
What we collect and why
We only collect what the service needs. For each kind of data, this is what we use it for and the legal basis we rely on.
- Account: your name, email address and a hashed version of your password. We use them to give you an account and run the audits you ask for. Basis: performance of a contract.
- Sign-in sessions: a session record with your IP address and browser type, kept while the session is active. We use it to keep you signed in and to protect your account. Basis: performance of a contract and our legitimate interest in security.
- Audits and reports: the websites you audit, the public pages we read from them, the questions we generate and the answers AI models give. We use them to produce and show your reports. Basis: performance of a contract.
- Sign-up protection: a one-way, salted hash of your IP address when an account is created, kept for 30 days. We use it only to limit how many accounts can be created from one network. Basis: our legitimate interest in preventing abuse.
- Analytics, only if you accept it: a random ID stored in a cookie, the pages you open, the site that sent you and the campaign tags in the link. No IP address and no browser details. If you then create an account, we link those visits to it. We use this to learn which pages and channels bring customers. Basis: your consent, which you can withdraw at any time.
- Your cookie choice: the same random ID, whether you accepted or rejected analytics, and when. We keep it to respect your choice and to prove it. Basis: legal obligation.
- Billing: if you subscribe, our payment partner collects your payment details and billing address as seller of record. We receive the status of your subscription and a reference to your account, never your card details. Basis: performance of a contract and legal obligations.
- Messages: if you write to us, we keep the conversation so we can answer. Basis: our legitimate interest in supporting you.
- Technical logs: our hosting provider records technical data such as IP address and request time to keep the service secure and working, for a short period. Basis: our legitimate interest in security.
- 3
What we don't do
We don't sell or rent personal data. We don't run advertising, use third-party analytics or tracking pixels, or share visit data with anyone. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
- 4
How AI is used
To build a report we send the audited website's public content, its domain and the generated questions to AI model providers. We never send them your account details.
Reports are about companies, so please don't use the service to look into private individuals. The questions, answers and fixes in a report are generated by AI models, and the report says so.
- 5
Who we share data with
We work with a small number of carefully chosen service providers that process data on our behalf and only on our instructions: hosting and database, sign-in, AI model providers, a service that reads public web pages, and our payment partner. Each is bound by a data processing agreement or equivalent terms.
We disclose data to authorities only when the law requires it. Anyone you share a report link with can read that report.
- 6
International transfers
We are based in Brazil, and some of our providers are in the United States and other countries outside the European Economic Area and the UK. When personal data leaves the EEA or the UK, we rely on the safeguards the law provides, such as adequacy decisions (including the EU-US Data Privacy Framework where it applies) and the European Commission's Standard Contractual Clauses.
- 7
How long we keep data
- Account and reports: while your account exists. When you delete your account they are erased at once and leave our backups within 7 days.
- Hashed IP from sign-up: 30 days.
- Analytics: 13 months, or until you delete your account.
- Record of your cookie choice: 3 years.
- Session records: until you sign out or the session expires.
- Billing records: kept by our payment partner for as long as tax law requires.
- Conversations with us: up to 2 years after the last message.
- 8
Your rights
You can ask to access your data, correct it, delete it, receive it in a portable format, restrict or object to its processing, and withdraw any consent you gave. Some of these rights depend on where you live.
You can download your data and delete your account yourself from your account page. For anything else, write to hello@overheard.sh and we'll answer within one month.
You can also complain to a data protection authority, for example the AEPD in Spain, the authority of your own country in the EU, the ICO in the UK or the ANPD in Brazil.
- 9
Cookies
We use the cookies needed to keep you signed in and to remember your privacy choice, and analytics only if you accept. The cookie policy lists each one, and you can change your choice there at any time.
- 10
Security
Data travels encrypted over HTTPS, passwords are stored only as hashes, IP addresses are hashed with a secret salt, access to production systems is limited to the people who run the service, and every page is served with a strict content security policy.
- 11
Children
Overheard is meant for businesses and is not directed at anyone under 16. We don't knowingly collect their data, and we delete it if we learn we have.
- 12
Changes to this policy
If we change this policy in a way that matters, we'll tell signed-in users before the change takes effect. The date at the top shows the current version.
Contact: hello@overheard.sh