Privacy Policy

Your OYA collects no data

OYA is an alarm, not a tracker. It has no app to install, no account to create, no GPS and no SIM card. The device gathers, stores and sends no personal data whatsoever.

Paired over Bluetooth, it simply triggers the SOS feature already built into your phone. It is your phone that calls the emergency services and alerts the emergency contacts you saved in it.

So we never receive your location, your list of contacts or any record of your alerts. None of it goes through our servers.

Your location, during an alert

Only the trusted contacts you picked can see where you are, and only while an alert is running. Outside an alert, nobody follows you: your position stays private until you decide to pass it on.

When your phone calls 112, your position reaches the emergency services on its own so operators can find you quickly. They can confirm it with you and ring back if the line drops.

That location travels between your phone, your contacts and the emergency services. It does not pass through this website, we never store it, and it is never sold or used for advertising.

Who is responsible

ALTHIR GROUP, the French company selling OYA, decides what is done with the personal data gathered through this site and is answerable for it. Its full identity and address sit on the Legal Notice page.

For any question about your data, write to contact@oya-alert.com: the person who handles these requests will answer you.

What the site gathers, and why

The site gathers what it takes to get your order to your door and answer you afterwards. Each use rests on its own legal ground:

• Your order: contact and delivery details and order history, to fill your order and deal with returns. Legal ground: the contract between us.
• Your payment: your card details are handled by our payment provider and never stored on our side. Legal ground: the contract between us.
• Bookkeeping: invoices and accounting records, to meet the bookkeeping rules we are held to. Legal ground: a legal obligation.
• Your messages: what you send through the contact form, to reply to you. Legal ground: the contract, or our interest in answering a question.
• The newsletter: your email address, to send you our news. Legal ground: your consent, which you may take back at any time.
• Customer reviews: your name, email address and order summary, to email you, after a purchase, an invitation to review us on Trustpilot. Legal ground: our legitimate interest in gathering reviews of our service. You may object at any time, through the unsubscribe link in the invitation or by writing to us.
• The OYA quiz: if you sign up, your address and answers (who it is for, everyday moments, number of people to equip, phone type and colour), together with the recommended pack, are saved in Shopify to tailor your result, tips and offers. Legal ground: your consent. Without signing up, your answers stay on the page and disappear when you leave. They contain no phone number or location, and you can ask for their deletion at contact@oya-alert.com.
• Technical logs: basic connection information, to keep the site up and fend off abuse. Legal ground: our legitimate interest in a service that works.
• Audience measurement: the pages you open and the way you reached them, so the site gets better. Legal ground: your consent, given through the cookie banner and withdrawable at any time.

Who can see your data

We never sell personal data. It reaches only the partners who make an order possible, each bound to use it for nothing else:

• Our payment provider, to take and secure payment.
• The carrier, to bring the parcel to your door.
• Our hosting provider, which keeps this site online.
• Google, PostHog, Pinterest, Meta, OpenAI, TikTok and Shopify, for audience and ad measurement, and only if you agreed to it.
• Trustpilot, which receives a copy of your order summary to send you, on our behalf, an invitation to leave a review.
• Google (Gemini API), which receives the questions typed into the FAQ question field, to draw an answer from them.
• Public authorities, where the law obliges us to answer them.

How long we keep it

Nothing is held longer than needed. In practice:

• Order and delivery details: three years after your last purchase.
• Invoices and accounting records: ten years, as bookkeeping rules require.
• Contact form messages: one year after the exchange closes.
• Newsletter address: until you unsubscribe, then three years at most.
• Technical logs: twelve months.
• Audience measurement: fourteen months in Google Analytics, thirteen for the cookies that carry it.

What works without your consent

Your basket, your language and your answer to the cookie banner are remembered by your own browser, on your device, and never leave it. None of that asks your permission: without it, the site would not work.

If you reached us through a creator’s link, that link carries a referral name. Your browser keeps it for ninety days and passes it to Shopify with your order, so we know which creator to pay. It is a name we chose for the creator, not one for you: it says nothing about who you are and is used for nothing else. If the link also carries a discount code, your browser keeps it the same way and passes it to checkout, where it is applied.

On product pages, your browser also remembers, for as long as the tab is open, which colours you have looked at. At the third, or after about twenty seconds on any one page of the site, it offers you a welcome code in exchange for your email address. If you close that offer, it remembers for thirty days so as not to ask again; if you accept, it keeps a note of your sign-up so it can place the code in your cart. Neither the colours you viewed nor that choice leave your device: only the address you type reaches us, just as in the footer.

After you sign up (quiz, newsletter), an oya_email cookie keeps your address, encrypted, for thirty days. It is used to pre-fill it at checkout and to link it to your basket at Shopify, our payment provider. If you have agreed to receive our emails, this lets us remind you of a basket left waiting. This cookie can only be read by our server and is used for no audience measurement and no advertising. You can delete it at any time by clearing your browser’s cookies. After that same sign-up, your Shopify customer identifier is kept in your browser’s local storage for thirty days: if you have accepted audience measurement, it travels with the visit statistics sent to Shopify, so that this provider can remind you of a basket left waiting. It is passed to no other tool, and is cleared with your browser’s site data.

A count of visits, without cookies

We also count, without asking, how visits begin and how they unfold. When you open a page from outside the site, your browser tells our own server what kind of link brought you (a search result, an ad, another site, along with the campaign name and ad number the link itself declares, if any) and which page you landed on.

It then reports the pages you open and three moments on the way to a purchase: looking at a colour, adding it to the basket, going to payment. Our server adds the country your connection comes from and passes that tally to PostHog, in the European Union.

To know that those signals come from one visit, our server works out a marker from your address, your browser and your language, mixed with a secret known only to us that changes every night. The marker cannot be traced back to you, it lasts a day, and it is used here only: come back tomorrow and you are someone else.

If you order without accepting audience measurement, we also pass PostHog the order amount, the items and the link that brought you here (campaign, ad number), with no order number and nothing that identifies you: so we know which ads lead to sales.

We count answers to the cookie window the same way: shown, all accepted, all rejected, custom choice or closed. Each answer is sent on its own, with the language and the type of page, without any marker linking it to another answer or to you.

Nothing is stored or read on your device, your IP address is not kept, and no click on an ad is ever tied to you. It is a count of visits, not a record of anyone.

Questions asked on the FAQ

The « Ask your question » field of the FAQ is only there to answer you. The question you type goes to our server, which passes it to Google (Gemini API) together with the excerpts of our pages that come closest to it, to draw a short answer from them. Legal basis: our legitimate interest in answering the question you ask us.

The field asks for no personal data, and we invite you to type none. We do not keep the questions, apart from the server’s technical logs, kept for a few days, where e-mail addresses and phone numbers are masked and where your IP address does not appear. Your IP address is only used, for one minute, to limit how many questions can be sent in a row.

Cookies that wait for your consent

The scripts of the six tools below are fetched only once you have said yes, and one answer covers all six. Refusing costs you nothing: every page behaves the same either way.

Your answer is kept for thirteen months when you agree and six when you refuse. The Cookies link at the foot of every page reopens the question whenever you want to change your mind.

• Google Analytics, which tells us which pages help and which fall flat. If your visit came from a Google ad and you order after accepting advertising, we also pass Google Ads your email address and, if the order has one, your phone number, each reduced to an encrypted fingerprint, with the order amount, so it knows its ad led to a purchase.
• PostHog, which records the pages you open, the clicks you make and the errors you run into, and can replay a visit as a reconstructed animation so we can see where a journey stalls. Everything you type is masked before it leaves your browser: we see that a field was filled in, never with what. Its servers sit in the European Union.
• The Pinterest tag, which tells us which of our Pinterest ads brought someone here, and lets that ad platform learn from it. After you sign up (quiz, newsletter, waiting list), your browser also passes it your email address reduced to an encrypted fingerprint, and keeps that fingerprint to attach it to your next additions to the basket.
• The Meta pixel, which does the same for our ads on Facebook and Instagram. Shopify also passes Meta the amount and items of any order placed afterwards, with your contact details reduced to an encrypted fingerprint, so it knows its ad led to a purchase. After you sign up (quiz, newsletter, waiting list), your browser also passes it your email address reduced to an encrypted fingerprint, so it knows its ad led to a sign-up. With your consent, the Meta pixel may also pick up the contact details you type into a form on the site (email address; name and phone number on the contact page), reduce them to an encrypted fingerprint in your browser and pass them to Meta, so it can match your visit to its ads.
• The OpenAI tag, which does the same for our ads in ChatGPT. Our site also passes OpenAI the amount and items of any order placed afterwards, with your contact details reduced to an encrypted fingerprint, so it knows its ad led to a purchase.
• The TikTok pixel, which does the same for our ads on TikTok. If you arrive through one of these ads, the click identifier TikTok placed in the link is attached to your order, and our site passes it back to TikTok with the amount and items, so it knows its ad led to a purchase: without your consent, nothing else goes with it; with your consent, your contact details reduced to an encrypted fingerprint are added.
• Shopify, which handles your orders, and to which your browser reports the pages you open, the colours you look at and what you add to your cart, so the shop knows how many visits lead to an order and can tie yours to the visit before it.

The cookies we set

Having agreed, what reaches Google stays within this site: the pages you open, how you got here, your device, your language, and an approximate location worked out from your IP address, which Google Analytics does not store.

Where you are signed in to a Google account and have allowed ad personalisation there, Google adds an aggregated age bracket, gender and interest category: a group, never an identity. It is never crossed with data from anywhere else and never sold.

The measurement is erased after fourteen months, and the following cookies carry it, thirteen months at most:

• _ga: tells one browser from another, so the same visitor coming back twice is not counted as two people.
• _ga_GTKM8X8KSX: holds a single visit together across the pages you open.
• ph_phc_yrUWvGdg3GHVcrp87oygTrLu6DSPygHt7BSrU9CkUFYz_posthog: set by PostHog, for one year at most, to tie together the pages, the clicks and the replay of a single visit.
• _epik: set by Pinterest, or by this site from the link of the ad you clicked if you accept advertising, for one year at most, so an ad you clicked on Pinterest can be tied to what you did here. If you order after accepting advertising, its value is attached to your order and passed to Pinterest with the purchase.
• _fbp: set by Meta on this site, for ninety days at most, to recognise the same browser from one visit to the next when a Facebook or Instagram ad leads here.
• _fbc: set by Meta on this site if you arrive through a Facebook or Instagram ad, for ninety days at most, to tie that click to what you do here.
• oya_xid: set by this site if you accept advertising, for ninety days at most: a random identifier for your browser, unrelated to your identity, passed to Meta and Pinterest with the events they receive (additions to the basket, purchase), so they recognise the same browser from one event to the next.
• __oppref: set by OpenAI on this site if you arrive through an ad in ChatGPT, for thirty days at most, to tie that click to what you do here.
• __obref: set by OpenAI on this site, for one year at most, to recognise the same browser from one visit to the next when an ad in ChatGPT leads here.
• _ttp: set by TikTok on this site, for thirteen months at most, to recognise the same browser from one visit to the next when a TikTok ad leads here.
• ttcsid: set by TikTok on this site, for thirteen months at most, to hold together a single visit that came from a TikTok ad.
• _shopify_y: set by Shopify, for one year at most, to recognise the same browser from one visit to the next.
• _shopify_s: set by Shopify, for thirty minutes at most, to hold a single visit together up to checkout.
• _tracking_consent: set by Shopify, for one year at most, so checkout honours the answer you gave here.

Data stored outside the EU

Our hosting provider operates from the United States, and so do Google, Pinterest, Meta, OpenAI, TikTok and Shopify, should you have agreed to the measurement.

Where data does travel that far, it is covered by the standard contractual clauses adopted by the European Commission and by the EU-US Data Privacy Framework, which hold the recipient to the protection you enjoy here.

Your rights

Write to us at contact@oya-alert.com: we act on each of these rights, free of charge, within one month.

• Read the personal data we hold on you, and receive a copy of it.
• Correct anything inaccurate, or fill in what is missing.
• Erase your data, where nothing obliges us to keep it.
• Restrict or object to a given use, marketing included.
• Receive your data in a portable form, or have it passed to someone else.
• Take back a consent you gave, without unsettling what came before.
• Say what should become of your data after your death.

If something goes wrong

Come to us first: an answer is quicker that way. Should our reply leave you unsatisfied, you can complain to the French data protection authority, the CNIL (3 place de Fontenoy, 75007 Paris), or to the equivalent authority in the EU country where you live.

To stop our marketing emails without writing to us, the unsubscribe link at the foot of any message does the job.