Privacy Policy

Last Updated: 4th February 2026

Utility3 Ltd trading as "Oh" and "OhChat" ("Oh", "we", "us", "our") is committed to protecting your privacy and complying with applicable data protection laws, including the UK GDPR and EU GDPR.

This Privacy Policy explains how we collect, use, store, and share personal data when you access or use https://oh.xyz and related services (the "Services").

1. Data Controller

The data controller responsible for your personal data is:

Utility3 Ltd Company No: 14000143 Registered Office: 9th Floor, 107 Cheapside, London, EC2V 6DN Email: hello@oh.xyz

If you have any data protection queries, please contact us at hello@oh.xyz.

2. Information We Collect

We collect limited account, technical, and content-related information necessary to operate and secure the Services.

A. Account Information

When creating and using an account, users may provide:

• Email address
• Username or nickname (which may be an alias and does not need to reflect a real name)
• Age confirmation (users must confirm they are 18 or older)
• Location (optional and self-declared)

We do not independently verify the accuracy of self-declared profile information unless legally required to do so.

In certain jurisdictions where age or identity verification is required to access explicit content, verification is conducted by third-party identity verification providers. We do not store government-issued identification documents. Such information is processed and retained by the relevant third-party provider in accordance with their own privacy policies.

B. Usage and Technical Data

When you access or use the Services, we automatically collect certain technical information, which may include:

• IP address
• Device type
• Browser type and version
• Operating system
• Session duration and interactions
• Pages viewed
• Referring URLs
• Log data and diagnostic information

This information may be associated with an account where necessary for security, fraud prevention, moderation, legal compliance, and service functionality. In some cases, technical data may also be processed in aggregated or pseudonymised form for analytics and performance improvement purposes.

C. Payment Data

Payments are processed by third-party payment providers. We do not store full payment card details or billing information on our servers.

We may receive limited transactional information necessary to operate the service, such as:

• Payment status (successful, failed, refunded)
• Transaction identifiers
• Subscription status
• Limited billing metadata (such as country or card brand, where provided)

Full card details and sensitive payment credentials are handled directly by regulated and PCI-compliant payment processors.

D. Content and Interaction Data

In order to provide the Services, we process content generated or transmitted through the platform, including:

• Messages sent via the platform
• AI-generated interactions
• Uploaded images or media
• Reports submitted by users
• Moderation flags and related metadata

This information is processed to provide the Services, enforce our Terms, comply with legal obligations, and maintain platform safety.

3. Legal Bases for Processing (GDPR)

We process personal data under the following lawful bases:

• Performance of a contract – to provide you with access to OhChat services.
• Legitimate interests – to improve services, prevent fraud, monitor abuse, and ensure platform security.
• Legal obligation – to comply with applicable laws, including financial, tax, and safety obligations.
• Consent – where required (e.g., certain cookies, marketing communications).

4. How We Use Your Information

We use your data to:

• Provide and operate the platform
• Process payments and subscriptions
• Deliver AI-generated content
• Provide customer support
• Prevent fraud, abuse, and illegal content
• Comply with regulatory requirements
• Improve and develop our services
• Conduct analytics and service monitoring

5. Data Sharing

We do not sell personal data.

We may share limited data with trusted third-party service providers who process information on our behalf, including:

• Payment processors
• Identity verification providers (where legally required)
• Cloud hosting providers
• Fraud detection and moderation services
• Analytics providers

We do not share user profile data for marketing or advertising purposes.

6. International Transfers

As we operate globally, personal data may be transferred outside the UK or EEA. Where required, we implement appropriate safeguards such as Standard Contractual Clauses or equivalent protections.

7. Data Retention

We retain personal data only for as long as necessary to:

• Provide services
• Meet legal, tax, and accounting obligations
• Resolve disputes
• Enforce agreements

Inactive accounts may be deleted or anonymised after a reasonable period.

Payment records are retained in accordance with financial regulations.

8. Security Measures

We implement technical and organisational measures to protect personal data, including:

• HTTPS encryption across the platform
• Secure cloud infrastructure
• Role-based internal access controls
• Payment processing via PCI-compliant providers
• Monitoring systems to detect fraud and illegal content
• Automated and manual content moderation processes

While we take appropriate security measures, no system is completely secure.

9. Cookies and Tracking

We use cookies and similar technologies for:

• Essential site functionality
• Authentication
• Analytics
• Performance monitoring

You can manage cookie preferences through your browser settings.

A separate Cookie Policy is available at Cookie Policy.

10. Your Rights Under GDPR

Under UK and EU data protection law, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion ("right to be forgotten")
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent where applicable

You also have the right to lodge a complaint with a supervisory authority.

We will respond to data subject requests within 30 days, as required by GDPR.

To exercise your rights, contact: hello@oh.xyz

11. Third-Party Links

Our platform may contain links to third-party websites. We are not responsible for their privacy practices.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised "Last Updated" date.