Privacy Policy

1. Data Controller

2. What personal data do we collect?

• Contact data: Name, email address, shipping address, billing address.
• Account information: Username, password (stored encrypted). For OAuth login (Google, GitHub, Amazon), profile data shared by the provider.
• Financial data: Payment information is processed exclusively by Stripe and not stored on our servers.
• Transaction information: Ordered items, order status, order history.
• Technical data: IP address, browser type, device information, access times.

3. Purpose of Processing

• Providing and operating the website
• Processing orders and payment
• User account management and authentication
• Sending order confirmations and shipping notifications
• Security and fraud prevention
• Communication with you (customer support)

4. Legal Basis

Processing is based on Art. 6(1) GDPR:

• Contract performance (lit. b): Order processing, account management, shipping.
• Legitimate interest (lit. f): Security, technical log data, fraud prevention.
• Consent (lit. a): Cookies (via cookie banner).

5. Cookies

This website uses technically necessary cookies for authentication (session cookie) and storing your cookie preferences. No advertising cookies are used. With your consent via the cookie banner, anonymous usage analysis is additionally performed (see section 5b).

On your first visit, you will be informed via the cookie banner and can accept or decline. Without consent, no usage analysis takes place.

5a. Data Retention Periods

• Server log data: 14 days
• Account data: duration of membership + 30 days after account deletion
• Unverified accounts: deleted if the email address is not confirmed within 30 days of registration
• Contact data (name, address): duration of customer relationship + deleted with account data
• Support messages incl. uploaded photos/videos: to handle your request; deleted with the support case or your account data
• TimeSync diagnostics videos: 90 days, then automatically deleted
• Order data and invoices: 10 years (statutory retention obligation under German tax law, § 147 AO, § 257 HGB)
• Payment data: not stored on our servers (processed by Stripe)
• Passkeys and 2FA data: duration of membership, deleted upon account deletion
• Cookie preferences: stored in browser (localStorage), no server-side storage
• Usage analysis data: 90 days, then automatically deleted

5b. Website Analysis

Data collected: page views, product views, purchases and button clicks; time on page and scroll depth per page; visibility of calls to action; approximate country (derived from the IP, which is NOT stored); device type and browser; traffic source (referrer/campaign) and anonymous performance metrics (e.g. load time). A random session ID is generated per session (not linked to you). No cookies are set and no personal data is stored — the session ID lives in your browsers sessionStorage and is deleted automatically when you close the tab.

Purpose: improving our services and the user experience, detecting technical issues and understanding purchase behaviour.

Legal basis: Consent pursuant to Art. 6(1)(a) GDPR via the cookie banner.

Retention period: 90 days. Older entries are automatically deleted.

Opt-out: You can withdraw your consent at any time by selecting “Decline” in the cookie banner. No usage data will be collected thereafter.

5c. TimeSync microphone (volume check)

Data processed: When you use TimeSync synchronization and the “Check volume” option is enabled, your browser requests microphone permission and measures the sound level locally in your browser while the tone plays. Nothing is recorded, stored or transmitted — no audio data leaves your device. Only a locally computed result (tone loud enough: yes/no) drives an on-screen hint.

Purpose: To verify that the synchronization tone is loud enough for the clock to receive it, and to warn you if the tone is muted or too quiet.

Legal basis: Consent pursuant to Art. 6(1)(a) GDPR — you enable the option yourself and grant microphone permission in your browser.

Retention period: None. Processing happens solely in real time in your browser; no microphone data is stored.

Opt-out: Turn off the “Check volume” option (enabled by default) or deny microphone permission in your browser. Synchronization then works without the microphone.

5d. Umami statistics (self-hosted)

Data collected: When enabled, we use Umami — a self-hosted, cookie-free analytics tool — to collect anonymous, aggregated usage statistics (pages viewed, approximate country-level location, device type, referring website). No cookies are set and no data is shared with third parties; processing takes place on our own infrastructure. You cannot be personally identified.

Purpose: Understanding how the site is used and improving our offering in a privacy-friendly way.

Legal basis: Legitimate interest under Art. 6(1)(f) GDPR in cookie-free, aggregated audience measurement. As no cookies are set and no personal data is processed, no consent is required.

Objection: As no cookies are set and no personal data is stored, no separate opt-out is required. You can block collection using a tracking blocker in your browser.

5e. TimeSync diagnostics video

Data processed: When you choose the “Record a video & have it reviewed” option during the self-test, your browser requests camera permission. The recording stays local in your browser; it is only uploaded once you tap “Send video to OVOSONO”. We then store the video file, the selected language code and the upload timestamp — no further details such as your name or email address.

Purpose: To let support review your self-test result (firmware version, sensor status), in particular when a manual reading off the dial isn't possible.

Legal basis: Consent pursuant to Art. 6(1)(a) GDPR — you enable the option yourself, grant camera permission in your browser and trigger the upload yourself.

Retention period: 90 days, then automatically deleted.

Opt-out: Use the “Note it down manually” option instead — this never activates the camera. You can discard an already recorded but not yet sent video at any time instead of sending it.

6. Third-Party Services

Stripe (Payment Processing)

Payments are processed through Stripe, Inc. Stripe receives the data required for payment processing. Credit card data is not stored on our servers. Privacy Policy (opens in new tab)

Vercel (Hosting)

This website is hosted on Vercel. Vercel may process technical access data (IP address, browser). Privacy Policy (opens in new tab)

Resend (Email Service)

Transactional emails (order confirmations, password reset) are sent via Resend. Resend receives the recipient's email address. Privacy Policy (opens in new tab)

Neon (Database)

The database is hosted at Neon (PostgreSQL). All personal data is stored encrypted.

All listed services are based in the USA and are certified under the EU-US Data Privacy Framework (DPF), which ensures an adequate level of data protection pursuant to Art. 45 GDPR.

7. Your Rights

You have the right at any time to:

• Access your stored data (Art. 15 GDPR))
• Rectification of inaccurate data (Art. 16 GDPR))
• Deletion of your data (Art. 17 GDPR))
• Restriction of processing (Art. 18 GDPR))
• Data portability (Art. 20 GDPR))
• Object to processing (Art. 21 GDPR))

To exercise your rights, contact us at info@ovosono.com.

You can delete your account including all stored data at any time in your account settings. Go to account settings

You can download a copy of your stored data as a file at any time (Art. 20 GDPR). Export data in your account

8. Right to Complain

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.

Competent supervisory authority: The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart, Germany. Web: https://www.baden-wuerttemberg.datenschutz.de

9. Changes

We may update this privacy policy from time to time. The revised version will be published on this website.

10. Contact