1. Where this policy applies
This policy covers Asiri's public website, signed-in dashboard, hosted control plane, API, CLI and local runtime interactions with the hosted service, customer support, billing, email, and security processes.
O'CLAN LIMITED is the data controller for account, billing, website, security, and service-administration information. Where a workspace customer determines why and how personal data is included in secret inventory metadata, access requests, or audit data, that customer is the controller and O'CLAN LIMITED processes the hosted data on its behalf, subject to applicable law.
2. Information we collect
- Account information: your email address, display name, avatar, account ID, and provider ID from Google or GitHub sign-in.
- Authentication information: hashed session, access, refresh, invitation, and verification tokens; session status and timestamps; and temporary OAuth state information.
- Workspace information: workspace and project names, member email addresses, roles, invitations, aliases, verified domains, permissions, policies, grants, access requests, and service-account records.
- Device information: device name and type, status, public encryption and signing keys, public-key fingerprints, challenges, approvals, and revocation records.
- Secret inventory: plaintext workspace names, project names, scope paths, secret names, environment, version, status, and related operational metadata.
- Encrypted secret material: ciphertext, nonces, authenticated metadata, wrapped data keys, and recovery public-key records. The hosted data can still be personal data when it relates to an identifiable person, even when encrypted.
- Activity and audit information: actor, device, action, scope, hashed or omitted secret-name tags, result, reason, timestamps, access decisions, and limited event metadata. Do not put secret values in audit reasons or metadata.
- Billing information: plan, subscription state, currency, amount, Paystack customer and payment references, checkout status, and payment-event metadata. Paystack handles payment-card details.
- Network and security information: IP address and request-derived rate-limit keys, browser or client details available in ordinary requests, request timing, status, and abuse-prevention signals.
- Support and communications: messages you send us, service emails, delivery status, and information needed to respond.
3. How we use information
- Contract: create and secure accounts, workspaces, sessions, devices, and recovery records; store and sync encrypted secret material; apply roles, grants, policies, access decisions, and revocation; process billing; and send service messages.
- Legitimate interests: prevent abuse, investigate incidents, enforce rate and plan limits, debug problems, improve reliability, protect Asiri and its users, and enforce our agreements.
- Legal obligations: keep tax and accounting records, respond to valid legal requests, and meet other duties that apply to us.
- Consent: use optional features or communications where applicable law requires consent. You may withdraw consent at any time, without affecting processing already carried out.
Asiri makes automated technical decisions to enforce rate limits, plan limits, device and session validity, grants, and policies. These decisions may allow, deny, or delay access. They are not used for employment, credit, insurance, or similar decisions. Email hi@oclan.co if you believe an automated decision was wrong.
4. Hosted and local processing
The hosted control plane stores account data, plaintext inventory labels and operational metadata, encrypted secret values, wrapped keys, public device keys, policies, grants, revocation state, access requests, and audit records.
During normal operation, plaintext secret values, device private keys, unwrapped data keys, and raw workspace recovery keys remain on trusted devices. The local runtime decrypts secrets and may inject them into child processes, create temporary files, answer local broker requests, or pass them to another local action you configure.
Asiri does not proxy ordinary customer API traffic. A process using an injected credential connects directly from the customer's device or infrastructure to the destination provider. Calls to the Asiri control plane, strict audit acknowledgements, sync operations, support, and billing still reach hosted services.
Local-only records are not sent to us unless you push or sync them, report related audit events, request support that includes them, or otherwise choose to transmit them.
5. Cookies and similar storage
Asiri uses cookies needed for sign-in and secure setup. The main signed-in cookie is named asiri_session. Temporary cookies hold OAuth state, redirect information, and optional Cloudflare domain-setup state. They use same-site restrictions, cannot be read by browser scripts, and use secure transport on HTTPS.
We do not currently use advertising or cross-site analytics cookies. Browser sign-in cookies normally expire after seven days. Server session records may be extended while the session is used. Temporary setup cookies usually expire within ten minutes.
6. Providers and information sharing
We may share information with:
- Cloudflare for website and API hosting, database storage, release-file storage, network security, and optional domain setup.
- Google and GitHub when you use their sign-in services.
- Resend to deliver invitations, security notices, and other service email.
- Paystack to process subscriptions, checkout, payment events, cancellation, and billing status.
- Workspace owners, admins, and members according to membership, grants, policies, and product permissions.
- Professional advisers, auditors, insurers, or a buyer of all or part of our business where reasonably needed.
- Authorities or other parties when law, a court order, a valid legal request, security, fraud prevention, or protection of rights requires it.
We do not sell personal information. We do not share it for advertising based on your activity across different services.
7. Who is responsible for your data
O'CLAN LIMITED is the data controller for account, billing, website, security, and service-administration information. We act as a processor where a workspace customer controls personal data included in its hosted workspace metadata, access requests, or audit records.
- Service: asiri.dev
- Company: oclan.co
- Privacy and data-rights requests: hi@oclan.co
8. How long we keep information
- Browser and CLI refresh sessions normally expire after seven days of inactivity or at the end of their session window. CLI access tokens normally expire after one hour.
- Temporary sign-in and domain-setup state normally expires after ten minutes. Member invitations and domain verification requests normally expire after seven days.
- Remote encrypted secret versions marked for deletion have a seven-day restore window and are then scheduled for permanent purge.
- We generally keep account, workspace, device, policy, grant, encrypted secret, and operational records while the account or workspace is active or as needed to provide the service.
- Audit, expired session, revocation, and security records may remain after they stop being active. We keep them as reasonably needed for security, dispute resolution, legal compliance, and service integrity.
- Billing, tax, checkout, and payment-event records may be kept for as long as accounting laws, tax laws, fraud prevention, or payment-network rules require.
Asiri does not currently provide self-service account deletion. Email hi@oclan.co to request account or workspace deletion. We may verify your identity and authority, and may keep limited records when required for security, legal, tax, payment, or compliance reasons.
Deleting hosted records cannot erase plaintext, cached, exported, or decrypted copies already held on trusted devices, in local processes, or by third-party credential providers.
9. How we protect information
- Secret values are encrypted on a trusted device before upload. The hosted service stores ciphertext and wrapped data keys for authorised devices or the workspace recovery recipient.
- Device private keys, unwrapped data keys, and raw recovery keys are designed to remain local.
- Session, access, refresh, invitation, and verification tokens are stored server-side in a one-way hashed form where the product design allows.
- Browser sign-in cookies use HTTP-only and same-site protections and use secure transport on HTTPS.
- Workspace roles, device trust, grants, policies, request signatures, and rate limits restrict access and sensitive actions.
- Important security and secret-access activity is recorded using restricted fields and hashed or omitted secret-name tags. Asiri does not inspect every allowed text value for embedded secrets, so users must keep secret values out of audit reasons and metadata.
No security system is perfect. Trusted-device security remains your responsibility. A person with control of an authorised host may be able to use or extract secrets available to that host.
10. Your privacy rights
Your rights depend on where you live and how you use Asiri.
Nigeria
Under the Nigeria Data Protection Act 2023, you may ask whether we process your data, request access, correction, deletion, restriction, objection, or portability where applicable, withdraw consent, and receive information about how we use it. You may also complain to the Nigeria Data Protection Commission.
EU, EEA, and UK
Under the GDPR or UK GDPR, you may ask for access, correction, deletion, restriction, objection, or portability where applicable and withdraw consent. You may also complain to your local data protection authority.
California
Where the CCPA applies, California residents may ask what personal information we collect, use, and disclose; request access, correction, deletion, or portability; and receive equal service when exercising these rights. Asiri does not sell personal information or share it for cross-context behavioural advertising.
We may need to confirm your identity and authority before completing a request. Email hi@oclan.co to exercise a privacy right.
11. Data processed in other countries
Asiri may process information in countries where O'CLAN LIMITED or our service providers operate. International transfers are subject to the provider arrangements and legal safeguards that apply to the transfer.
12. Children and sensitive information
Asiri is not intended for anyone under 18. Only add credentials and other sensitive information when you have a lawful reason and authority to manage them. Keep secret values and unnecessary personal information out of plaintext names, scope paths, access-request reasons, and audit metadata.
If you believe personal information or credentials were submitted without authority, email hi@oclan.co.
13. Changes to this policy
We may update this policy as Asiri changes. We will publish the latest version here and show its effective date. If a change materially affects your privacy rights, we will take reasonable steps to provide additional notice.
Our Terms of Service explain the rules for using Asiri.
14. Contact us
For privacy requests or questions about this policy, email O'CLAN LIMITED at hi@oclan.co.