Privacy Policy

The data controller is OVER Holding S.r.l. ("OVER", "we", "us"), Viale Tricesimo 200, 33100 Udine, Italy, VAT and tax code IT02945890305.

Some services related to OVR tokens are provided by our affiliate OVRGLOBAL OÜ, Päevalille tn 6-15, 13517 Tallinn, Estonia (registry code 14721068). When it processes your personal data, it does so under this Privacy Policy.

For any privacy question or request, write to privacy@ovr.ai.

This policy applies to our websites (overthereality.ai, ovr.ai and their subdomains), the OVER app for iOS and Android, the OVER Marketplace, OVRLand and the Map2Earn program (together, the "Services").

It does not apply to third-party websites or services that our Services link to. If your company buys data or services from OVER, the processing is governed by the agreement with your company.

The rules on who owns the maps you upload are in our Terms and Conditions. This policy explains how we handle any personal data those maps contain.

Account data

Email address, username, password (stored only in encrypted, hashed form), profile picture, country, language and date of birth. If you sign in with a social account, we receive the account ID and an authentication token from that provider.

Identity verification (KYC)

Before you withdraw Map2Earn rewards or buy on the Marketplace, you verify your identity with our provider Sumsub (Sum and Substance Ltd). Sumsub collects your identity document, a selfie with a liveness check, your name, date of birth, address and nationality, and processes them under its own privacy notice. We receive the result of the check and the identity details we need to meet our legal and tax obligations and to prevent fraud. We do not receive or store biometric data from the check.

Map2Earn capture data

When you record a map, the app collects:

• photos, video frames and 360° imagery of the place, from your phone or from a connected 360° camera;
• GPS (GNSS) position and its accuracy;
• motion sensor data (IMU): accelerometer and gyroscope, plus compass (magnetometer) and, where available, barometer;
• camera position and orientation computed by the device's AR framework (Apple ARKit or Google ARCore), and camera settings;
• depth data, where your device has a depth or LiDAR sensor;
• audio from the microphone, only if you allow it. You can map without audio;
• timestamps, device model, operating system and app version.

The app collects this data only while you are recording a map. It is linked to your account so that we can review the map and pay your reward.

Location while you use the app

The app uses your device's location while you use it, to show the OVRLands and Map2Earn places near you and to check that you are at the place you are mapping.

Rewards, tokens and wallets

OVR balance, rewards earned and withdrawn, wallet addresses you connect, and your transactions on the Marketplace.

Content you create

The maps you upload, AR content you place on OVRLands, your profile, and messages you send through the Services.

Usage analytics in the app

To understand how the app is used and where it fails, we collect pseudonymous usage data: screens viewed, actions taken in the app (for example starting a map or an AR experience), technical errors, app or web version, platform, language, whether you are logged in or a guest, and timestamps.

This data is linked to a random identifier stored on your device. It is not linked to your account, email, wallet or name, and we do not collect your IP address, precise location or device identifiers for this purpose. It is stored on our own servers, is not shared with third parties and is not used for advertising.

You can turn usage analytics off at any time in Profile → Settings → Usage statistics. When it is off, we stop collecting this data and delete the identifier from your device.

Technical and security data

When your device connects to our servers, they record technical data such as IP address, device type, operating system and app version. We use this data, together with device identifiers, to deliver the Services, keep them secure and prevent fraud, not for usage analytics.

Face tracking for avatars (Apple TrueDepth)

Some AR experiences let your digital avatar mimic your facial expressions. For this, the app uses face-tracking technology developed by third parties: on iPhone and iPad with a TrueDepth camera, Apple's ARKit face tracking (TrueDepth API); on other devices, similar technology such as Google ARCore.

• What we use: the movement of your eyes and your facial expressions, as provided by ARKit or ARCore.
• Why: only to animate your avatar, so that it mimics your expressions in real time and makes the AR experience more immersive.
• Where it stays: face data is processed and stored only on your device. OVER does not collect, copy or store face geometry, depth data or images of your face on its servers.
• Who sees it: only if you choose to make your avatar visible to others, other users in the same experience see your avatar's expressions in real time. They see your avatar, not your face data.
• What we never do: we don't use face data to recognise or identify you, we don't share it with third parties, and we don't use it for advertising, marketing or data mining, or for any purpose other than animating your avatar.

Support requests

What you write to us by email, chat or social media, and our replies.

Cookies on our websites

We use cookies and browser storage that are strictly necessary for the website to work, including remembering your cookie choice. Only if you accept cookies in the banner, we also load Google Tag Manager and Google Analytics to measure how the website is used, and the TikTok Pixel to measure our advertising campaigns. If you decline, these tools are not loaded. To change your choice, clear this website's data in your browser: the banner will appear again.

Maps are the core of what OVER builds. Every map adds to a 3D model of the real world that machines can use to understand where they are. This is what we do with map data:

• 3D maps and digital twins. We turn maps into 3D reconstructions of places and show them in our 3D viewer and on OVRLand.
• Visual positioning and re-localization. We use maps so that phones, glasses, robots and other devices can work out their exact position and orientation from what their camera sees (our Visual Positioning System, VPS).
• AI research and training. We use maps to train, test and improve AI models, including Large Geospatial Models, computer vision and robotics models.
• Datasets for third parties. We sell or license datasets made from maps you sold to OVER and from public maps you kept, to companies and research institutions working on AI, robotics, autonomous systems, mapping and augmented reality, and we may publish some of them as open datasets.

Whatever the use, we apply these rules:

• Map data is never used to identify people. We do not run face recognition on map imagery and we do not build biometric profiles from it.
• Faces and licence plates are blurred automatically before a map is published, licensed to a third party or used to train AI models. We keep the original, unblurred images only inside OVER, to process maps again when our technology improves. We never use them to train AI models and never sell, license or publish them (see section 5).
• Your account details are removed before map data leaves OVER. Licensees receive the imagery and sensor data, not your name, email or username, and they are contractually forbidden from trying to identify anyone.
• Private maps are only for you. If you keep a map as your own NFT and mark it as private, we only store it, build it and show it to you. We don't use it to train AI or for visual positioning, and we never publish, sell or license it. Maps you sell to OVER can't be private. The Terms and Conditions explain the rules.
• Audio never reveals private conversations. If you allow audio, it is part of the map data and is used in the same ways. Before audio is used to train AI models or shared, private conversations are removed from it, and we never use audio to identify people by their voice.

We do not sell your personal data: your name, email, identity documents and account history are never part of the datasets we license.

Maps are made in public and private places, so photos can sometimes include people who happen to be there, or vehicles with their licence plates. When audio is on, recordings can also capture people talking nearby. Mappers are told to map places, not people or cars, and maps that focus on people or vehicles are rejected.

For any personal data that still ends up in map imagery:

• We automatically detect and blur faces and licence plates. Detecting a face in order to blur it is not face recognition.
• We keep the original, unblurred imagery of each map in separate, access-restricted storage, so that we can process the map again when our 3D reconstruction or blurring technology improves. We use it only for this and to build and check maps.
• Unblurred imagery is never used to train AI models, and never sold, licensed or published. Only blurred imagery leaves OVER.
• We never try to identify or track the people who appear in maps.

For people heard in map audio:

• Private conversations are removed from audio before it is used to train AI models or shared.
• We never use audio to identify people by their voice, and we don't create voiceprints.
• We keep the original audio like the unblurred imagery: in access-restricted storage, only to process maps again when our technology improves. It is never used to train AI models, and never sold, licensed or published.

We process this data on the basis of our legitimate interest in building 3D maps and spatial AI, with the safeguards above. As we cannot identify the people who appear by chance in maps, we inform them through this policy.

If you think you appear or can be heard in a map and want your image or voice removed, write to privacy@ovr.ai with the place and the approximate date. We will reply within one month.

We process personal data only when we have a legal basis under the GDPR:

Where we rely on legitimate interest, we have weighed our interest against your rights and you can object at any time (see section 10). You can ask us for more information about this assessment at privacy@ovr.ai.

Automated checks help us review maps (for example coverage, image quality, position and duplicates), but the approval decision is made by a person on the OVER team. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

• Service providers who process data on our behalf and under our instructions, such as cloud hosting and storage, identity verification (Sumsub), email delivery, analytics and customer support tools. They are bound by data processing agreements.
• Licensees of map datasets: companies and research institutions that receive map data from sold and public maps, after blurring and without your account details, under contracts that forbid any attempt to identify people.
• Everyone, when content is public: your username and profile picture, the maps you publish in our 3D viewer (shown as "Mapped by" your username), your rank on the mapper leaderboard, and content you place on OVRLand. Open datasets we publish are available to anyone, without account details.
• Public blockchains: rewards, withdrawals and transfers of OVR, OVRLand and other NFTs are recorded on public blockchains together with the wallet addresses involved. These records are public and cannot be changed or deleted by OVER or anyone else.
• Our affiliates, such as OVRGLOBAL OÜ, to provide the Services.
• Authorities, when the law requires it or to protect the rights and safety of OVER, our users or others.
• A buyer or investor, if OVER is involved in a merger, acquisition, financing or sale of assets. Data, including map datasets, may be transferred as part of the deal, and the recipient must respect this policy.

We do not share your personal data with third parties for their own marketing.

We store data mainly on servers in the European Union. Some service providers and licensees are located outside the European Economic Area. In those cases we transfer data only to countries with an EU adequacy decision (including US companies certified under the EU-US Data Privacy Framework) or under the European Commission's Standard Contractual Clauses. You can ask for a copy of these safeguards at privacy@ovr.ai.

When we no longer need personal data, we delete it or anonymize it so that it can no longer be linked to you.

Under the GDPR you have the right to:

• access your personal data and get a copy of it;
• correct data that is inaccurate or incomplete;
• have your data deleted;
• restrict how we use your data;
• receive the data you gave us in a machine-readable format and have it sent to another company (portability);
• object to processing based on our legitimate interest, and to direct marketing at any time. For usage analytics you can do this yourself in the app, in Profile → Settings → Usage statistics;
• withdraw your consent at any time, without affecting processing that took place before;
• lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali) or the authority in your country.

To exercise your rights, write to privacy@ovr.ai. We will reply within one month. This can be extended by two more months for complex requests, in which case we will tell you why. We may ask you to confirm your identity first.

What closing your account does

You can close your account in the app or from your profile on the OVER Marketplace, or by writing to privacy@ovr.ai. When you do:

• we delete your account data, except what we must keep by law (see section 9);
• maps you sold to OVER remain OVER's property and stay in our datasets, without your account details, as described in the Terms and Conditions;
• OVER can keep using the public maps you kept as your own NFT, without your account details. To stop this, mark them as private before you close your account;
• private maps are not used by OVER, and you can ask us to delete them;
• AI models already trained are not retrained, and datasets already delivered to licensees, which do not contain your account details, are not recalled;
• records on public blockchains cannot be deleted.

We protect personal data with technical and organizational measures, including encryption in transit, hashed passwords, access controls based on need, and separate, access-restricted storage for original map imagery. If a personal data breach puts your rights at risk, we will notify the supervisory authority and, where required, you.

You must be at least 14 years old to create an account, or older if the law of your country sets a higher age. Map2Earn, identity verification and the Marketplace are only open to people aged 18 or over. If we learn that we have collected data from a child without a valid consent, we will delete it. Parents and guardians can contact us at privacy@ovr.ai.

We may update this policy when our Services or the law change. The date at the top shows the latest version. If we make important changes, we will tell you by email or in the app before they take effect.

OVER Holding S.r.l., Viale Tricesimo 200, 33100 Udine, Italy. Email: privacy@ovr.ai.