Legal
Privacy policy
Last updated September 24, 2026
This policy explains what personal data Oystar collects when you use our website (oystar.io) and our app (app.oystar.io), why we collect it, who we share it with, and the choices you have. If anything here is unclear, write to hello@oystar.io.
Who we are
Oystar ("we", "us") provides a service that turns a company's documents into cited answers. We are the controller of the account data described below. For the documents and questions a customer puts into its workspace, we act on that customer's behalf, as a processor.
What we collect
- Account details: your name, email address, password (stored only as a one-way hash), and optionally a job title and profile photo.
- Google account details: if you sign in with Google, your name, email address and Google account ID. See "Google user data" below.
- Workspace content: the files your team uploads, the questions you ask, the answers and the conversations they form.
- Security and device data: IP address, browser and device type, and sign-in times, used to keep your account safe and to show you where you are signed in.
- Billing details: the plan, seats and invoices of your workspace. Card numbers are handled by Stripe.
- Messages to us: what you send through the "Book a demo" form (name, email, company, message) or by email.
How we use it
- To run the service: sign you in, store your documents, and answer questions with sources.
- To keep accounts secure: verification codes, new sign-in alerts, and detecting misuse.
- To send emails you need: email confirmation, password resets, invitations and billing notices.
- To bill workspaces and to answer support and demo requests.
We do not sell personal data, we do not use it for advertising, and your company content is not used to train AI models — ours or our providers'. Answer generation receives only the passages the person asking is allowed to see.
Google user data
When you choose "Continue with Google", we receive your name, email address and Google account ID from Google. We use them only to create or sign in to your Oystar account and to show your name in the app. We do not request access to your Gmail, Drive, Calendar or any other Google data, we do not share Google user data with third parties, and we do not use it for advertising. Oystar's use of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements. You can disconnect Oystar from your Google account at any time in yourGoogle account settings.
Who we share it with
We use a small number of service providers, each only for the job described:
- Google Cloud: Hosting of the application, database and search index (region europe-west1, Belgium), and of this website.
- Contabo: Storage of the files you upload (EU data centre).
- Anthropic: Generating answers from the passages of your documents that the person asking is allowed to see.
- Google Cloud Vertex AI: Answer generation, when a workspace is set up to use Gemini models instead of Anthropic.
- Mistral AI, LlamaIndex (LlamaParse), OpenAI: Reading uploaded documents (text and layout extraction), only for workspaces configured to use one of them.
- Mailtrap: Delivering account emails: verification, password reset, invitations, security alerts and billing notices.
- Stripe: Payments. Card details go straight to Stripe; we never see or store full card numbers.
- Slack: Only if your workspace connects Slack: receiving the questions you ask Oystar there and posting answers.
- Google Sign-In: Only if you choose "Continue with Google": confirming who you are.
The sign-in pages and our emails may load typefaces from Google Fonts, which receives your IP address when they do. We may also disclose data when the law requires it.
Cookies
The app uses only the cookies it needs to keep you signed in and to protect sign-in with Google from forgery. This website and the app use no analytics, advertising or tracking cookies.
How long we keep it
- Account and workspace data: for as long as the account or workspace exists.
- Backups of the database: rolling daily snapshots, each kept for 7 days.
- Password-reset and verification links: they expire after 1 hour and 24 hours; invitations after 7 days.
- Demo requests: as long as we need them to follow up with you. Ask us and we delete them.
When an owner deletes a workspace, its members, knowledge bases and conversations are removed from the app straight away. The stored files and the search index behind them are then purged when you ask us to athello@oystar.io.
How we protect it
Traffic is encrypted in transit (HTTPS). Passwords and one-time links are stored only as hashes. Every document and conversation belongs to one workspace, and access inside a workspace follows the permissions its admins set.
Your rights
Depending on where you live, including under the GDPR, you can ask us to access, correct, export or delete your personal data, or object to or restrict how we use it. Email hello@oystar.io and we will answer within 30 days. If your data is in a workspace managed by your employer, we may refer you to them. You can also complain to your local data protection authority.
Children
Oystar is a business tool and is not intended for anyone under 16.
Changes
If we change this policy, we will update the date at the top, and tell account holders by email when the change is significant.
Contact
Questions or requests about privacy: hello@oystar.io.