Privacy Policy

1. Who We Are

Oselo ("Nova," "we," "us") is a software platform that helps venues, wineries, and sports organizations manage their operations and communicate with their customers. We are headquartered in the United States.

This Privacy Policy explains how we collect, use, disclose, and protect information when you use our platform — whether as a venue operator, a parent using a sports organization portal, or a customer purchasing tickets or browsing an event site.

2. Information We Collect

Information You Provide Directly

• Name, email address, and phone number when you create an account or register
• Payment information (processed by Square or Stripe — we do not store card numbers)
• Profile details such as your event preferences, dietary notes, or membership information
• Content you submit such as messages, reviews, or waiver signatures

Information About Children (Sports Organizations)

• Player name, position, jersey number, and graduation year
• Game statistics and season performance records
• Parent or guardian name and contact information
• Waiver and consent signatures

Information Collected Automatically

• IP address and browser type when you visit our sites
• Pages visited and features used (via analytics)
• Device type and operating system

2a. Financial Account Data (Oselo Books)

If you connect a bank account to Oselo Books, our bookkeeping feature, we receive transaction history, account balances, and account metadata (institution name, account type, last four digits) from your financial institution through our service provider, Plaid Inc. We never receive your online banking username or password — those are entered directly with Plaid or your bank, never with Nova.

This access is read-only. We do not use it to move money, initiate any transaction, or authorize any payment on your behalf. It is used solely to display your transaction history and balances for bookkeeping, expense categorization, and bank reconciliation within your own business account.

You may disconnect a bank account and permanently delete all associated transaction and balance data at any time from the Banking page. Doing so also revokes our access to that account at Plaid. This deletion is immediate, not a delayed or scheduled process.

3. How We Use Your Information

• To provide and operate the services you signed up for
• To send transactional communications (ticket confirmations, schedule updates, registration receipts)
• To enable organizations to communicate with their members and customers
• To process payments and prevent fraud
• To improve our platform based on usage patterns
• To comply with legal obligations

4. Children's Privacy (COPPA)

5. How We Share Your Information

We share your information only in these limited circumstances:

With the Organization You're Interacting With

When you register for an event, purchase a ticket, or join a sports portal, the relevant organization (the venue, winery, or sports org) can see the information you provided. They are responsible for their own use of that data.

With Service Providers

We use trusted third-party services to operate our platform:

• Supabase — database and authentication
• Square / Stripe — payment processing
• Plaid — bank account connectivity for bookkeeping (Oselo Books, read-only)
• Resend — transactional email delivery
• Render — cloud hosting
• PostHog — anonymous usage analytics

These providers are contractually prohibited from using your data for any purpose other than providing services to us.

Legal Requirements

We may disclose information if required by law, court order, or to protect the safety of our users or the public.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Specifically:

• Active accounts: Data retained while the account remains active
• Bank account data (Oselo Books): Retained only while a bank account remains connected. Disconnecting an account immediately and permanently deletes its associated transaction and balance data — this is not a delayed or scheduled process.
• Inactive accounts: Customer data for organizations that leave Nova is retained for 90 days, then deleted unless legally required to keep it
• Children's data: Deleted within 30 days of a valid deletion request
• Payment records: Retained for 7 years as required by financial regulations
• Deletion logs: Retained permanently as proof of compliance

7. Your Rights

Depending on where you live, you may have the following rights:

• Access: Request a copy of all data we hold about you
• Correction: Request we correct inaccurate information
• Deletion: Request we delete your data (subject to legal retention requirements)
• Portability: Download your data in a machine-readable format
• Objection: Object to certain uses of your data

Parents using our sports portal can exercise all of these rights directly from the Privacy & Data section of the parent portal. All others can email [email protected].

We will respond to all valid requests within 30 days.

8. Data Security

We implement industry-standard security measures including:

• Encrypted connections (HTTPS/TLS) for all data transmission
• Encrypted database storage via Supabase
• Multi-tenant data isolation — organizations cannot access each other's data
• Access controls limiting which employees can access user data
• Regular security reviews

No system is 100% secure. If we become aware of a data breach that affects you, we will notify you within 72 hours.

9. Cookies

We use essential cookies to keep you logged in and maintain your session. We do not use advertising cookies or third-party tracking cookies. You can disable cookies in your browser settings but some features may not work correctly.

10. Third-Party Links

Our platform may link to third-party websites (GameChanger, Google Calendar, etc.). We are not responsible for the privacy practices of those sites and encourage you to review their policies.

11. Changes to This Policy

We may update this policy as our platform evolves. We will notify you of material changes by email or by posting a notice on our platform at least 14 days before the change takes effect. Continued use of the platform after that date constitutes acceptance of the updated policy.