What happens to what you type here

Who is responsible

Kodawari OÜ
Õismäe tee 142-18
Tallinn, Estonia
Registry code 17407183
hello@ovirno.com

The controller for this website is Kodawari OÜ, the company behind Ovirno. There is no data protection officer: the company is one person and the thresholds in Art. 37 GDPR are not met. Write to hello@ovirno.com and the person who built the site answers.

What the form collects

The form at the bottom of the home page has three fields, and that is the whole list:

Email — required

So there is somewhere to reply. Nothing else works without it.

Your name — optional

So the reply is addressed to a person.

What you do — optional

Free text, one line, e.g. “two coffee shops in Kraków”. It decides whether the first answer is useful or generic.

Nothing is collected that you did not type. There is no hidden field carrying a device fingerprint, no cross-site identifier, no “where you came from”. The request also records which language version of the page it was sent from — that is how the reply comes back in the right language.

Why, and on what legal basis

To answer you and, if it goes further, to prepare an offer. That is Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract. If your message turns out not to be about working together, the same message is handled on Art. 6(1)(f): our interest in replying to people who write to us, which is hard to argue against.

No profiling and no automated decision-making. No newsletter: the address you leave is not added to a mailing list, because there is no mailing list.

Where the request goes

The form posts directly to https://app.ovirno.com — the Ovirno application — and the request lands in our own workspace under Customers → Waiting list. That server is operated by Hetzner Online GmbH in Falkenstein, Germany. Backups stay on the same infrastructure, inside the European Economic Area.

Where this website is served from

The pages you are reading are static files served from our own machine at Hetzner Online GmbH in Falkenstein, Germany — the same server the application runs on. Nothing about this site is handled outside the European Economic Area.

Until 7 September 2026 that was not true. The pages were served by a shared host in Kyiv, which meant that although your data went to Germany, the record of your visit was written outside the EEA — for which no adequacy decision exists — and the site's own footer claimed otherwise. We moved the site rather than reword the footer.

No access log is kept. The web server writes no line per request: not your IP address, not the page, not the time. Errors are recorded so that a broken page can be found, and that is all. The only record that a visit happened is the counter described below, and it stores no address.

Cookies, analytics, fonts

No cookies are set by this site. Nothing is written to local storage. There is no tag manager, no advertising pixel, no chat widget, no embedded video, and no third-party script of any kind.

Since 7 September 2026 the fonts are served from this domain. Before that date the pages loaded them from Google's servers, which meant every visitor's IP address reached a third party without being asked. That is fixed: opening any page on ovirno.com now makes requests to ovirno.com and to nothing else.

There is a visitor counter, and here is exactly what it does

We count visits, because otherwise we cannot tell whether anybody reaches the form. The counter is Umami, and it runs on our own server in Germany — the same machine as the application. It is not Google Analytics and not a hosted service: nothing about your visit leaves our infrastructure, and the script itself is served from ovirno.com, which is why the paragraph above still says every request goes to this domain and nowhere else.

What it records: the page address, the referring address if there was one, screen size, browser and operating system, and the country derived from the IP address. What it counts as an action: clicks on the two “try it on your data” buttons, sending the form, and switching language.

What it does not do:

• No cookies, and nothing stored in your browser. That is also why there is no consent banner: there is nothing on your device to ask permission for.
• Your IP address is not stored. It goes into a one-way hash together with your browser string and a secret that is regenerated every day, and the result is what distinguishes one visitor from another for that day. The next day the same person is a new number, and there is no way back from the number to the address.
• No cross-site tracking and no profiles. The counter knows nothing about where you were before this site or where you go after it.

Legal basis: Art. 6(1)(f) GDPR — our interest in knowing whether the site works at all, weighed against an interception that stores no identifier on your device and keeps no address. If you would rather not be counted, any tracker blocker stops it, and so does Do Not Track; nothing on the site breaks if the counter never loads.

How long it is kept

While the conversation is alive, and for twenty-four months after the last message in case you come back — a small business that asked in March often writes again in October, and making you re-explain the business is worse service than keeping three lines of text. After that it is deleted.

If we work together, the record moves into the customer file and follows the retention rules in the service agreement and Estonian accounting law (seven years for what belongs to an invoice).

Who else sees it

One processor, and it is infrastructure rather than a partner:

• Hetzner Online GmbH (Germany) — the server that runs the application, serves these pages and holds the backups.

The visitor counter is not a second one: it runs on that same machine, under our own control, and its data never leaves it. Since 7 September 2026 there is no other company between you and us — the shared host in Kyiv that used to serve these pages is gone, and so are the Google servers the fonts used to come from.

Nothing is sold, rented or handed to advertisers, and there is no affiliate arrangement under which your address would be worth passing on. If a court or an authority with the power to require it asks, we comply — and say so here rather than pretend it could not happen.

The AI models the product uses are not part of this: they answer questions about a customer's own business data inside the workspace, and the form on this page is not sent to them.

Your rights

Access, rectification, erasure, restriction, objection, and portability — Art. 15–21 GDPR. In practice: write to hello@ovirno.com with what you want, and it is done. Deletion needs no reason and no form; “delete what you have on me” is enough, and you get a confirmation that it happened.

If we handle it badly you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the supervisory authority in the country you live in.

Changes

The date at the top is the date of the last change. There is no archive of previous versions yet; if a change affects someone who has already written to us, they get an email rather than a silently updated page.