Privacy Policy
Effective October 11, 2026
Oya runs browsers that sign in to your accounts. Here is what we collect to do that, and what we never do.
1. Who we are
Oya AI Corp ("Oya", "we") operates Oya Browser, the desktop app, and Oya Cloud, the hosted service at oyabrowser.com. This policy covers both. If you run Oya on your own servers, your data stays in your infrastructure and you are its controller; this policy then covers only the website and the desktop app's update checks.
2. What we collect
- Account details. Your email address, name, and sign-in method, and your multi-factor settings if you turn them on.
- Projects and keys. Your projects, their settings and members. API keys are stored only as hashes.
- Browser sessions you choose to sync. When you connect the desktop app, the cookies and site storage of the profile you use are sent to your project, so agents and cloud browsers arrive signed in. Passwords you import from a password manager go to the same sealed sign-in store.
- What agents and cloud browsers do. The pages they visit, the tasks you give them, and, when you record, screen recordings of their runs.
- Billing. Your plan and billing contact. Card details are handled by Stripe, not stored by us.
- Usage and errors. Product analytics tied to your account, never URLs or page content, and error reports with request bodies, headers and cookies removed.
3. How we use it
- To run the service: sign you in, run your browsers and agents, and keep your sessions working.
- To bill you for paid plans.
- To secure the service, investigate abuse, and keep an audit trail of privileged actions.
- To understand which features are used and fix what breaks.
- To write to you about your account and, if you agree, about product news.
4. What we never do
- We do not sell your personal data or share it for advertising.
- We do not train AI models on your pages, sessions, recordings or tasks.
- We do not read your synced sessions or recordings except to support you, at your request.
5. AI models
When an agent works, the page content it reads and your instructions are sent to the model provider that runs it: OpenAI, Anthropic or Google when Oya's key is used, or the provider and account you connected yourself, under that provider's terms.
6. Who else receives data
We use a small set of service providers for hosting, sign-in, cloud browsers, models, billing, error reports and analytics. Each receives only what its job needs. The current list, with what each one receives, is on our trust center. We disclose data to authorities only when the law requires it, and tell you when we are allowed to.
7. Security
Data is encrypted in transit. Credentials, MFA secrets, cookies, proxy credentials and recordings are sealed with AES-256-GCM and bound to their project. Privileged actions go to a tamper-evident audit log. The trust center describes these controls in detail.
8. How long we keep it
- Recordings are deleted after 7 days.
- A deleted project is erased after a one-day grace period, so a mistaken delete can be undone.
- Deleting your account deletes your projects, keys, profile and sign-in.
- Audit records and billing records are kept as long as the law or security requires.
9. Your choices and rights
You can see and change your data in the dashboard, disconnect the desktop app at any time, and delete your account from its settings. Depending on where you live, you may also have the right to a copy of your data, to correct it, to object to or restrict its use, and to complain to your data protection authority. Write to sales@getoya.ai and we will answer within 30 days.
10. International transfers
Oya is a US company, and your data may be processed in the United States and wherever our service providers operate. When we move personal data from the EU, UK or Switzerland, we rely on the European Commission's standard contractual clauses or an equivalent safeguard.
12. Children
Oya is for businesses and adults. It is not meant for anyone under 16, and we do not knowingly collect their data.
13. Changes and contact
If we change this policy in a way that matters, we will tell you by email or in the product before it takes effect. Questions, requests and complaints go to sales@getoya.ai.