Privacy Policy

Website: https://ozeaon.com

Operated by: Ozeaon OÜ, Estonia (Registry Code 17484775)

Group holding company: Ozeaon Pte. Ltd., Singapore

Data controller: Ozeaon OÜ

Registered address: Tornimäe tn 5, 10145 Tallinn, Kesklinna linnaosa, Harju maakond, Estonia

Contact: privacy@ozeaon.com

1. Introduction

This Privacy Policy explains how Ozeaon collects, uses, stores, shares, and protects personal data through the Ozeaon website and platform.

Ozeaon is a regenerative innovation platform connecting knowledge, learning, publishing, projects, organisations, Open Calls, funding, governance, and verification across ocean, climate, land, and sustainability-related work. Ozeaon currently operates two systems: the public marketing website at ozeaon.com, and the authenticated platform at app.ozeaon.com, where organisation, project, publishing, education, and social features are hosted. This policy covers personal data collected through both.

This policy applies to the current public website and platform, including: early access and waitlist forms, language selection, contact or enquiry forms, cookie preferences and consent-based analytics, account creation and authentication, organisation and pod profiles, published articles and project content, educational resources, social network participation, copyright and intellectual property complaints, illegal content reports, community conduct reports and appeals, prohibited project reports, institutional partner interactions, and current restricted internal/editor functionality where applicable. It does not yet fully cover future platform features such as project funding, payments, tips, paid content, subscriptions, bounties, DAO participation, Progress tokens, $OZN utility, NFTs, IP-NFTs, OCIS, dMRV services, AI Footprint, or project verification workflows. Before those features launch publicly, Ozeaon will update this Privacy Policy and provide additional privacy notices where needed.

2. Who We Are

For the purposes of data protection law, the controller of personal data collected through this website is:

Ozeaon OÜ (17484775)
Tornimäe tn 5, 10145 Tallinn, Kesklinna linnaosa, Harju maakond, Estonia
Email: privacy@ozeaon.com

Ozeaon OÜ decides why and how personal data is processed through the current website.

Ozeaon's holding company is:

Ozeaon Pte. Ltd. (202535133H)
133 New Bridge Road, #08-01, Chinatown Point, Singapore 059413

Ozeaon Pte. Ltd. does not receive personal data collected through the website. It holds Ozeaon's intellectual property and brand assets, and does not act as a data recipient, processor, or joint controller for any of the personal data described in this Policy, which remains with Ozeaon OÜ as the operating entity.

Ozeaon has assessed its processing activities against Article 37(1)(b) GDPR. At its current scale, Ozeaon's user base is limited, and its social-network, profiling, and analytics features do not yet amount to processing that is core to Ozeaon's activities, conducted on a large scale, and involving regular and systematic monitoring of data subjects, taken together. Ozeaon has therefore determined that appointment of a Data Protection Officer is not currently required. This determination will be reassessed, and this Section updated, on the earliest of: (a) Ozeaon's annual turnover exceeding EUR 10 million, or Ozeaon otherwise ceasing to qualify as a small enterprise under Commission Recommendation 2003/361/EC — the same threshold this document set uses for the DSA Article 19 exemption (Terms & Conditions Section 88) and the DSM Directive Article 17(6) young-platform regime (Copyright and Intellectual Property Policy Section 8), so that all three reassessments are triggered together; (b) the launch of any feature that scores, profiles, or monitors user behaviour on a continuous or automated basis, including any recommendation or engagement-ranking algorithm, OCIS, Project Integrity Scoring, or AI Footprint features; or (c) 12 months from the date of this determination.

3. Scope of This Policy

This Privacy Policy covers personal data collected when users:

• visit the Ozeaon website
• submit an early access or waitlist form
• contact Ozeaon through the website
• select language preferences
• interact with pages where Analytics consent has been given
• manage cookie and privacy preferences
• request information about Ozeaon, partnerships, or platform access
• receive transactional or confirmation emails
• receive early access, waitlist, publishing, or social network communications
• create an account and use authentication features, including Google OAuth sign-in on app.ozeaon.com
• create or manage an organisation profile, team, or pod
• publish or interact with articles and project content, including project location, volunteer, and impact data
• use Ozeaon's Education Hub, including quizzes, progress tracking, and certifications
• participate in Ozeaon's social network features, including notifications and, where available, the referral program
• submit or respond to a copyright or intellectual property complaint
• submit or respond to an illegal content notice
• report or appeal a decision under Ozeaon's Community Conduct or Prohibited Project Types terms
• engage with Ozeaon as an institutional partner or on behalf of an institution
• use restricted Ozeaon Studio or editor functionality, where applicable

This policy should be read together with Ozeaon's Cookie Policy, which explains cookies, local storage, Google Consent Mode v2, analytics preferences, and cookie categories in full detail, and Ozeaon's Terms & Conditions, which govern use of the website and platform more broadly, including the publishing, social network, and reporting features described in this policy.

4. Personal Data We Collect

Ozeaon aims to collect only the personal data needed for the purposes described in this policy. Ozeaon currently operates two systems: the public marketing website at ozeaon.com, and the authenticated platform at app.ozeaon.com. Both are covered by this policy; where a data category is specific to one system, that is noted below.

4.1 Data Provided Directly by Users

When users submit an early access, waitlist, contact, partnership, or enquiry form, Ozeaon may collect:

• name
• email address
• organisation name, if provided
• role, background, or professional area, if provided
• country or general location, if provided
• selected interests or interest tags
• message content, if provided
• communication preferences
• date and time of submission

The exact data collected depends on the form used.

4.2 Early Access and Waitlist Data

When a user joins the early access list or waitlist, Ozeaon may process:

• email address
• name, if collected
• selected interest tags
• signup source, date, and time
• subscription status
• email engagement data, where enabled by the email provider
• unsubscribe or communication preference status

Waitlist and email-list data are stored in Ozeaon's own systems, where needed for platform operations, signup validation, and record keeping. A double opt-in confirmation email is sent before any address is added to the mailing list.

4.3 Account and Profile Data (Platform)

Where a user creates an account on app.ozeaon.com to publish content or participate in Ozeaon's social network, Ozeaon may process:

• account email address, username or handle, and authentication data, including Google account information where the user signs in via Google OAuth
• display name, profile bio, professional affiliation, and profile image, where provided
• ORCID identifier, where provided
• organisation link, where the user connects their profile to an organisation on the platform
• affirmative age confirmation, collected for social network participation (see Section 16)
• connections, follows, and other profile-level social graph information
• account status, verification status, and account security events

Authentication for app.ozeaon.com is provided by Supabase Auth, including Google OAuth sign-in, and is processed by Supabase as a third-party processor (see Section 8). This is distinct from the restricted Studio, editor, and administrative access used to manage the ozeaon.com marketing website, described in Section 4.14.

4.4 Organisation and Pod Data (Platform)

Where a user creates or manages an organisation profile, or a team or sub-group ("pod") within one, Ozeaon may process:

• organisation name, description, and profile information
• team and pod membership, and member roles and permissions
• organisation-level activity, such as projects and articles published under that organisation

4.5 Publishing and Project Content Data (Platform)

Where a user publishes an article or a project, Ozeaon may process:

• article or project content, title, subtitle, abstract, and language
• author name(s), affiliations, ORCID identifiers, and co-author information
• licence selection, access level selection, and commercial-use/derivative-use settings
• funding source disclosure and linked project or organisation information
• geographic scope information and, for projects, more precise project location data, where provided
• the Indigenous/Local Knowledge flag and consent acknowledgement, where applicable
• submission attestation confirmations
• version history, changelog entries, and revision metadata
• DOI or other persistent identifiers, where provided
• volunteer or participant recruitment information, and impact or outcome metrics reported for a project
• reader-interaction data (votes, favourites, bookmarks) associated with the user's own account, where the platform links this to the account

Full detail on how this data is used within the publishing feature is in Ozeaon's Terms & Conditions.

4.6 Education Hub Data (Platform)

Where a user accesses Ozeaon's educational resources, Ozeaon may process:

• course, category, subcategory, and subject enrolment and progress
• quiz and assessment responses and results
• certifications or completions issued to the user
• any rewards recorded against course completion, consistent with Section 4.8

4.7 Social Network Interaction Data (Platform)

Where a user participates in Ozeaon's social network, Ozeaon may process:

• posts, comments, reactions, and messages
• follows, connections, and blocks
• bookmarks and saved content
• real-time notifications delivered to the user
• reports of content or behaviour submitted by, or about, the user
• enforcement and appeal records associated with the user's account, where applicable

4.8 Referral Program Data (Platform)

Where Ozeaon's referral rewards program is available and used, Ozeaon may process a user's referral code, information about accounts referred, and any reward or token record associated with a successful referral. This feature, along with Ozeaon's broader token economy, is under active development; this policy will be updated with further detail before it is fully launched (see Section 18).

4.9 Reports, Complaints, and Disputes Data

Where a user submits or is the subject of a report, complaint, notice, dispute, or appeal under Ozeaon's Terms & Conditions, Ozeaon may process:

• the reporter's or notifier's name and contact details, where provided (some notices may be submitted anonymously, as described in the Terms & Conditions)
• a description of the concern and any supporting evidence submitted
• the content, account, or project involved
• Ozeaon's review notes, statement of reasons, and outcome

This includes copyright or intellectual property complaints and disputes, illegal content notices and counter-notices, Community Guidelines-style reports and appeals, and prohibited project reports and appeals, each described in Ozeaon's Terms & Conditions.

4.10 Cookie and Consent Preference Data

Ozeaon stores information about cookie and consent choices, including whether the user has accepted or rejected Strictly Necessary, Functional, and Analytics cookies. The current consent model is stored under version 2 and includes necessary, functional, and analytics fields. Strictly Necessary is always active; Functional and Analytics are optional and disabled by default. Full detail is in the Cookie Policy.

4.11 Technical and Usage Data

When users visit the website or platform, Ozeaon and its service providers may process limited technical information, including:

• IP address, browser type, device type, operating system
• approximate region or country
• pages visited, referral source, date and time of visit
• request metadata and user-agent information
• website interaction information and language selection
• cookie consent status
• website performance information
• security and abuse-prevention signals

Some of this information may be processed by hosting, infrastructure, analytics, security, rate-limiting, and performance providers.

4.12 Analytics and Performance Data

Ozeaon currently uses:

• Google Analytics 4 — consent-gated; only runs where Analytics consent is given
• Vercel Analytics and Speed Insights — aggregate website usage and performance measurement, on ozeaon.com

Neither tool is used for advertising, retargeting, or behavioural marketing.

4.13 Google Analytics Event Data

Where Analytics consent has been given, the website tracks two custom events:

• join_waitlist — fires on successful early access/waitlist submission; may include selected interest tags
• select_language — fires when a user selects a language; may include language code and name

Neither event intentionally sends personally identifiable information — names, email addresses, phone numbers, or message content — to Google Analytics.

4.14 Restricted Studio, Editor, or Administrative Account Data (Landing Website)

Where restricted Ozeaon Studio, editor, or administrative functionality is used by authorised team members or collaborators to manage the ozeaon.com marketing website — as distinct from the app.ozeaon.com platform accounts described in Section 4.3 — Ozeaon may process:

• account email address, login or verification information
• role and permission metadata, authentication events
• content records, uploaded files or images, file metadata
• editor activity, security logs, technical request data

Authentication for this restricted tooling is handled through BetterAuth, self-hosted on Ozeaon's own infrastructure and database. Because it is self-hosted, BetterAuth is not a separate third-party processor — the underlying infrastructure and database providers are disclosed in Section 8.

4.15 File and Image Upload Data

Where users upload files or images — whether through a published article, a profile, or project on app.ozeaon.com, or through Ozeaon Studio and related internal tools on ozeaon.com — Ozeaon may process uploaded files and images, file names and metadata, storage paths, upload timestamps, and associated account or editor metadata. Files and images are stored using Supabase Storage (app.ozeaon.com) or Vercel Blob (ozeaon.com Studio tooling), as applicable.

4.16 Institutional Partner Data

Where Ozeaon engages with a user as an institutional partner, or where a user's institution has a formal partnership arrangement, Ozeaon may additionally process institution name and affiliation, department or research group information, and evidence of institutional consent or authority for specific submissions, consistent with Ozeaon's Terms & Conditions and, where a formal Institutional Content Partnership Agreement is in place, that Agreement.

4.17 Rate Limiting and Abuse Prevention Data

To protect the website from abuse, spam, repeated form submissions, and automated misuse, Ozeaon may process request metadata, timestamps, IP-derived or request-derived rate-limit keys, one-time send guards, and temporary operational data. Ozeaon uses Upstash for Redis-based rate limiting, abuse prevention, and ephemeral operational storage on ozeaon.com; equivalent protections on app.ozeaon.com are provided through Cloudflare and Supabase, as described in Section 8.

4.18 Data We Do Not Intentionally Collect

The current public website and platform do not intentionally collect special category data — information about health, religion, political opinions, trade union membership, genetic or biometric data, sex life, sexual orientation, or racial or ethnic origin. Users should not submit sensitive personal data through general website forms unless Ozeaon specifically requests it through an appropriate, protected process. Indigenous and local knowledge consent acknowledgements and cultural context described in a submission (Section 4.5) are handled as content and provenance data about the submission itself, not as special category data about the submitting user, and are additionally governed by the Indigenous Knowledge provisions in Ozeaon's Terms & Conditions.

5. Why We Use Personal Data

5.1 Website Operation and Security

Technical data and Strictly Necessary technologies are used to operate, secure, maintain, and deliver the website — page delivery, reliability, security, consent storage, TLS, CDN delivery, edge protection, abuse prevention, and debugging.

Legal basis: legitimate interests (operating a secure and reliable website is necessary to provide the service a user has requested).

5.2 Cookie Consent Management

Consent preference data is processed to remember user cookie choices and allow users to update or withdraw consent.

Legal basis: legitimate interests in maintaining a compliant, functioning consent system.

5.3 Early Access and Waitlist Management

Used to process signups, understand user interest, organise onboarding, assign interest tags, manage email lists, and communicate with people who have asked to hear from Ozeaon.

Legal basis: consent, given by the user at signup.

5.4 Responding to Enquiries

Used to respond to user messages, partnership requests, collaboration enquiries, and other user-initiated communications. Legal basis: legitimate interests in responding to enquiries directed to Ozeaon.

5.5 Communications and Updates

Contact details may be used to send early access updates, launch information, partnership discussions, and other optional update or marketing communications. Users can unsubscribe at any time.

Legal basis (optional marketing/update communications): consent.

Contact details may also be used to send verification emails, confirmation emails, welcome emails, and enquiry responses, which are necessary to provide a requested service or protect account security and are sent regardless of marketing preferences.

Legal basis (transactional/service communications): contractual necessity, since these communications are required to deliver the account or feature the user has requested.

5.6 Website Analytics and Improvement

Where Analytics consent is given, Google Analytics data is used to understand website usage and improve page content, structure, language support, design, and user experience.

Legal basis: consent.

5.7 Aggregate Performance Analytics

Vercel Analytics and Speed Insights are used to understand performance, page speed, route-level experience, and technical reliability — never for advertising or retargeting.

Legal basis: legitimate interests. Vercel Analytics and Speed Insights are cookieless by design — visitors are identified only by a short-lived hash derived from the incoming request, not a persistent cookie — so this technology sits outside the Cookie Policy's optional Analytics category and does not require cookie consent.

5.8 Functional Preferences

Where Functional consent is given, optional preferences such as language or personalisation settings may be stored.

Legal basis: consent.

5.9 Studio, Editor, and Administrative Functionality

Account, authentication, content, upload, and permission data is processed to manage authorised access, protect content workflows, support publishing, and maintain website operations.

Legal basis: legitimate interests in operating restricted tooling securely for authorised team members, collaborators, and contractors.

5.10 Rate Limiting and Abuse Prevention

Limited technical data is processed to prevent spam, abuse, excessive submissions, automated misuse, and security threats.

Legal basis: legitimate interests in protecting the website, users, and infrastructure.

5.11 Account Creation, Authentication, and Social Network Operation

Account, authentication, profile, and social interaction data is processed to create and secure user accounts, operate the social network, display profiles and connections, and enforce Ozeaon's Terms & Conditions.

Legal basis: contractual necessity in providing the account and platform features the user has requested.

5.12 Publishing Operations

Article and project content data, including authorship, licensing, access-level, and Indigenous/Local Knowledge consent information, is processed to operate the publishing feature, display attribution and provenance correctly, and apply the licence and access level the author selects.

Legal basis: contractual necessity in providing the publishing feature the user has requested.

5.13 Reports, Complaints, and Dispute Handling

Report, complaint, notice, and appeal data submitted under Part V of the Terms & Conditions (illegal content notices) is processed to review and respond to such notices and to maintain the records required under the EU Digital Services Act.

Legal basis: legal obligation.

Report, complaint, and appeal data submitted under Part II (copyright/IP) or Part IV (community conduct) of the Terms & Conditions, where not separately mandated by law, is processed to review and respond to the report at the reporting user's request and to maintain the platform's integrity.

Legal basis: legitimate interests; steps taken at the user's request.

5.14 Institutional Partnership Management

Institutional data is processed to manage institutional relationships and verify institutional affiliation and consent for published content. Legal basis: legitimate interests. Where a formal Institutional Content Partnership Agreement is in place, data processed to administer that Agreement is instead processed on the basis of contractual necessity.

5.15 Organisation and Pod Management

Organisation and pod data is processed to operate organisation profiles, manage team and pod membership and permissions, and attribute projects and articles to the correct organisation.

Legal basis: contractual necessity in operating the organisation-level features the user has requested.

5.16 Education Hub Operation

Course, quiz, and progress data is processed to deliver educational content, track completion, and issue certifications.

Legal basis: contractual necessity in providing the educational feature the user has requested.

5.17 Notifications and Referral Program

Notification data is processed to deliver real-time updates about platform activity relevant to the user.

Legal basis: contractual necessity in operating the platform feature the user has requested.

Where the referral program is available and used, referral code and reward data is processed to track and credit successful referrals.

Legal basis: consent, given by the user when opting into the referral program.

6. Legal Bases Summary

Where Ozeaon relies on legitimate interests, it considers whether the processing is necessary, proportionate, and balanced against the rights and freedoms of users.

7. Cookies, Consent & Analytics

Ozeaon uses cookies, local storage, and similar technologies across three categories — Strictly Necessary (always active), Functional, and Analytics (both optional and off by default). Optional categories are governed by Google Consent Mode v2: functionality_storage and personalization_storage follow Functional consent, and analytics_storage follows Analytics consent — all denied until the user opts in. Ozeaon does not currently use advertising cookies, retargeting pixels, behavioural advertising tools, or third-party marketing tracking technologies. If that changes, this Privacy Policy, the Cookie Policy, and the cookie banner will be updated before those tools are activated.

Users can accept, reject, or change cookie preferences at any time via the Cookie Settings link in the site footer, or through their browser settings. Full detail — including the current cookie table, consent versioning, and Google Analytics event structure — is in the Cookie Policy.

8. Third-Party Services and Processors

Ozeaon uses selected third-party providers to operate the ozeaon.com marketing website and the app.ozeaon.com platform, manage signups, send email, store data, prevent abuse, and measure performance. Each processes personal data only as necessary for the purposes in this policy, and only in its capacity as a service provider or processor.

Ozeaon works to put in place a data processing agreement, consistent with Article 28 GDPR, with each provider listed in this Section before sharing personal data with it.

Ozeaon maintains a Record of Processing Activities under Article 30 GDPR, covering each processing operation described in this Policy, and makes a summary available to the competent supervisory authority on request.

8.1 ozeaon.com (Marketing Website)

Providers currently used for ozeaon.com (Marketing Website):

• Vercel Inc. (United States) — Hosting, serverless infrastructure, CDN, edge security, TLS, delivery, Vercel Blob file storage (Studio tooling), Vercel Analytics, Speed Insights
• Google Analytics 4 (United States) — Consent-gated website analytics
• Resend (United States) — Transactional email delivery (verification codes, confirmations, welcome emails, publishing and report/appeal status notifications)
• Neon (region documented internally; available on request) — Serverless Postgres hosting for subscriber/waitlist records and restricted Studio/editor content records
• Upstash (United States) — Redis-based rate limiting, abuse prevention, ephemeral operational storage

Ozeaon's own /api/subscribe route on Vercel receives and validates waitlist submissions before passing relevant data to the systems above; Ozeaon does not currently use a third-party form tool such as Typeform for waitlist submissions.

8.2 app.ozeaon.com (Platform)

Providers currently used for app.ozeaon.com (Platform):

• Cloudflare, Inc. (United States-based; global edge network across 300+ locations) — Edge deployment (Cloudflare Workers/Pages), global CDN, hosting, edge security
• Supabase, Inc. (United States-based company; specific database hosting region depends on project configuration, available on request) — PostgreSQL database (accounts, profiles, organisations, projects, articles, education, social, and report/complaint records), authentication, storage (file and image uploads), real-time subscriptions (notifications)
• Google LLC (United States) — OAuth sign-in identity provider, where a user chooses to sign in with Google (via Supabase Auth)

Reports, complaints, and notices submitted under Ozeaon's Terms & Conditions in connection with app.ozeaon.com are processed using the Cloudflare and Supabase infrastructure above, and reports submitted in connection with the ozeaon.com marketing website are processed using the Vercel and Neon infrastructure above; in neither case are they shared with additional third parties beyond what is necessary to respond to the report — for example, referring a matter to law enforcement or another competent authority where required by law.

Ozeaon maintains an internal record of processing for each provider — its role, the data categories involved, location of processing, applicable data processing agreement, transfer safeguard, and retention setting — available on request.

9. International Data Transfers

Several providers listed in Section 8 are based in, or may process data in, the United States or other countries outside the European Economic Area, the United Kingdom, or Switzerland — including Vercel, Resend, and Upstash for ozeaon.com, and Cloudflare, Supabase, and Google for app.ozeaon.com.

Where personal data is transferred internationally, Ozeaon relies on appropriate safeguards, which may include:

• an adequacy decision, where applicable
• the EU-U.S. Data Privacy Framework, where the provider is certified and the transfer is covered
• Standard Contractual Clauses
• the UK International Data Transfer Addendum or equivalent UK safeguards
• data processing agreements and supplementary safeguards, where required

Ozeaon Pte. Ltd. (Singapore) does not receive personal data collected through the website (see Section 2); no international transfer safeguard is therefore required for that entity, and Singapore is not otherwise a destination for any transfer described in this Section.

Users may contact privacy@ozeaon.com for more information about the transfer safeguards in place for a specific provider.

10. Data Retention

Ozeaon keeps personal data only as long as necessary for the purposes described in this policy, unless a longer period is required by law.

• Consent preferences — until the user changes preferences, clears browser storage, or the consent model version is updated.
• Early access and waitlist data — 12 months from the last engagement with the relevant communication, or until the user unsubscribes or requests deletion, whichever is earlier, unless Ozeaon has a lawful reason (such as an unresolved legal claim) to retain it longer.
• Email marketing and subscriber records — for as long as the user remains subscribed; unsubscribe and suppression records are kept for 3 years after unsubscribing to demonstrate compliance with the user's opt-out.
• Contact and partnership enquiries — 24 months from the last contact, unless a longer period is necessary to manage an ongoing relationship or a legal claim.
• Account and profile data — for the lifetime of the account, plus 90 days afterward to allow account recovery, and up to 6 years thereafter where necessary for security, dispute-resolution, or legal record-keeping purposes.
• Published articles and project content — consistent with Ozeaon's Terms & Conditions; deleting an account does not automatically remove content already published under a licence granted to other readers, since that licence and the associated provenance record survive account deletion (see Section 11 for how this interacts with erasure requests). Attribution and provenance metadata are retained as part of the public record of publication unless Ozeaon is legally required to remove them.
• Social network content — for the lifetime of the account, and for up to 6 years afterward where necessary for enforcement and appeal record-keeping under Ozeaon's Terms & Conditions.
• Reports, complaints, and disputes — for 6 years from resolution of the matter, consistent with Ozeaon's record-keeping obligations under applicable law, including the EU Digital Services Act.
• Institutional partner data — consistent with any formal Institutional Content Partnership Agreement, or otherwise while the institutional relationship is active, plus up to 6 years afterward for record-keeping.
• Organisation and pod data — for the lifetime of the organisation profile, plus 12 months afterward where necessary for record-keeping.
• Education Hub data — course progress and quiz data: for the lifetime of the account; certification records: 10 years from issuance, to allow verification of a completed certification.
• Notification and referral data — notifications: 90 days from delivery; referral records: 12 months from the referral event, or longer where necessary to resolve a dispute about a reward, consistent with Section 18.
• Google Analytics data — governed by the applicable GA4 property retention settings, and only where Analytics consent has been given.
• Vercel Analytics / Speed Insights data — retained per Vercel's applicable product settings and service terms; used for aggregate performance insight only, never advertising or retargeting.
• Technical logs — 12 months from creation, save for logs needed for longer as part of an active security investigation.
• Studio, editor, and account data — for the lifetime of the account, plus up to 6 years afterward for content history, security records, auditability, and access management.
• Uploaded files and images — for as long as the associated content, profile, or project remains published or active, plus 90 days afterward to allow recovery, after which they are deleted or archived per internal content-management practice.

11. User Rights

Depending on location and applicable law, users may have the right to:

• access their personal data
• request correction of inaccurate personal data
• request deletion of personal data
• restrict or object to certain processing
• withdraw consent at any time (without affecting processing carried out before withdrawal)
• data portability
• not be subject to decisions based solely on automated processing that produce legal or similarly significant effects
• complain to a data protection authority

Users can exercise these rights by contacting privacy@ozeaon.com. Ozeaon may need to verify a user's identity before responding to certain requests.

Ozeaon will respond to a request within one month of receipt. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months; Ozeaon will inform the user of any such extension, and the reasons for it, within the initial one-month period.

Where personal data forms part of a published article's attribution or provenance record — for example, an author's name on a published article — a deletion request is considered alongside Ozeaon's need to maintain accurate attribution and provenance for content already made available to readers under the licence the author selected (see Ozeaon's Terms & Conditions). Ozeaon will work with users to address such requests appropriately, which may include anonymising or updating a record rather than removing it entirely, consistent with applicable law.

12. Right to Complain

Users who believe their personal data has been processed unlawfully have the right to complain to a data protection authority. As Ozeaon OÜ is established in Estonia, the relevant supervisory authority is:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Tatari 39, 10134 Tallinn, Estonia
Website: https://www.aki.ee

Users may also contact the supervisory authority in their own EU or EEA country.

13. No Sale of Personal Data

Ozeaon does not sell personal data, and does not currently share personal data with third parties for behavioural advertising or retargeting.

14. Email Communications

Ozeaon may send email to users who sign up for early access, join the waitlist, request updates, create an account, publish content, participate in the social network, or make contact — including early access updates, launch information, onboarding communications, partnership responses, verification codes, confirmations, welcome emails, and updates about published content, social network activity, or the outcome of a report, complaint, dispute, or appeal submitted under the Terms & Conditions.

Ozeaon manages its mailing list in its own systems with double opt-in confirmation; Resend is used for transactional email delivery. Users can unsubscribe from optional marketing or update emails at any time via the unsubscribe link or by contacting privacy@ozeaon.com. Transactional or service-related emails may still be sent where necessary to provide a requested service, confirm an action, or protect account security.

15. Security

Ozeaon uses reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure, including:

• secure website delivery, TLS encryption, CDN and edge security
• access controls, including role-based access for restricted Studio or editor functionality
• limited access to form submissions
• use of reputable service providers and data minimisation
• consent-based analytics and rate limiting / abuse prevention
• avoidance of unnecessary tracking — no advertising or retargeting trackers in the current implementation

No website or online service can guarantee absolute security, but Ozeaon aims to apply privacy-conscious practices as the platform develops.

16. Children and Young People

The current website is not intentionally directed at children under the age required by applicable data protection law for independent consent. Ozeaon's social network features require users to be at least 18 years old, or the age of majority in their jurisdiction if higher, and Ozeaon collects an affirmative age confirmation at signup for these features, consistent with its Terms & Conditions. If Ozeaon becomes aware that an account belongs to a person under 18, it will take steps to delete the relevant personal data and may take enforcement action under its Terms & Conditions. Future educational or community features involving young people will be reviewed separately for child privacy, safeguarding, age-appropriate design, and consent requirements.

17. Automated Decision-Making

The current website does not use personal data for automated decision-making that produces legal or similarly significant effects on users. Where Ozeaon reviews or moderates content, reports, or complaints under its Terms & Conditions, this involves human review rather than solely automated decision-making. Future features involving OCIS, Project Integrity Scoring, dMRV, verification workflows, governance, funding, token activity, or AI-supported reporting may require additional notices explaining automated or AI-assisted processing.

18. Future Platform Features

This policy describes the current public website and platform, including account creation, organisation and pod profiles, publishing, the Education Hub, social network participation, and the reporting and complaint mechanisms described above. Future Ozeaon platform features may involve additional processing, including: payments, project funding, subscriptions, bounties, DAO participation, a fully-launched token economy and referral rewards program, Progress tokens, $OZN utility, NFTs and IP-NFTs, OCIS climate intelligence, dMRV monitoring, AI Footprint, and project verification workflows. Before launching these features publicly, Ozeaon will update this Privacy Policy, the Cookie Policy, the Terms & Conditions, and any relevant platform-specific notices.

19. Related Policies

This Privacy Policy should be read alongside Ozeaon's Cookie Policy, which covers cookies, consent, and analytics in full detail, and its Terms & Conditions, which govern use of the website and platform more broadly, including publishing, social network conduct, illegal content reporting, and copyright and intellectual property matters.

20. Changes to This Privacy Policy

Ozeaon may update this Privacy Policy if it adds website or platform features, changes analytics tools or cookie categories, adds third-party providers, changes hosting, database, storage, or email providers, launches payment, project funding, subscription, DAO, token, NFT, OCIS, dMRV, or AI Footprint features, changes retention periods, changes the responsible legal entity, or changes international transfer safeguards. Where changes are material, Ozeaon will update the policy date, notify users, and request renewed consent where required.

21. Contact

Questions about this Privacy Policy or Ozeaon's use of personal data: privacy@ozeaon.com