1. Introduction
Ovalt ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service at ovalt.org ("Service").
By using the Service, you consent to the data practices described in this policy.
2. Information We Collect
2.1 Information You Provide
We collect information that you directly provide to us:
- Account Information: Name, email address, and organization details when you register
- OAuth Data: Profile information from Google or GitHub when you authenticate
- GTM Containers: Google Tag Manager container configurations you import
- Communication: Messages, feedback, or support requests you send to us
2.2 Automatically Collected Information
When you use the Service, we automatically collect:
- Log Data: IP address, browser type, operating system, access times, and pages viewed
- Usage Data: Features used, actions taken, and migration runs performed
- Device Information: Device identifiers and characteristics
- Session Data: Authentication tokens and session metadata
2.3 Google Tag Manager Data
When you import GTM containers, we process:
- Container configurations, tags, triggers, and variables
- GTM account and container metadata
- OAuth access tokens for GTM API access (stored encrypted)
3. How We Use Your Information
We use your information for the following purposes:
3.1 Provide the Service
- Process and migrate your GTM containers from client-side to server-side
- Generate migration plans and validation reports
- Store your migration history and artifacts
- Authenticate and authorize your access
3.2 Improve the Service
- Analyze usage patterns to enhance features
- Develop new migration rules and compatibility mappings
- Debug issues and improve reliability
- Train machine learning models for better tag classification
3.3 Communication
- Send service notifications and updates
- Respond to your inquiries and support requests
- Send security alerts and administrative messages
3.4 Security and Compliance
- Detect and prevent fraud and abuse
- Comply with legal obligations
- Enforce our Terms of Service
4. How We Share Your Information
We do not sell your personal information. We may share your information in the following circumstances:
4.1 Service Providers
We share data with third-party service providers who perform services on our behalf:
- Amazon Web Services (AWS): Infrastructure hosting, data storage (DynamoDB, S3), and compute (Lambda)
- Google Cloud Platform: OAuth authentication and GTM API access
- GitHub: OAuth authentication
4.2 Legal Requirements
We may disclose your information if required by law or in response to:
- Valid legal processes (subpoenas, court orders)
- Government requests
- Protection of our rights, property, or safety
4.3 Business Transfers
If Ovalt is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Service.
5. Data Storage and Security
5.1 Data Location
Your data is stored in AWS data centers in the EU (eu-north-1 region) and US (us-east-1 for CloudFront).
5.2 Security Measures
We implement industry-standard security measures to protect your information:
- Encryption in transit (TLS/HTTPS) and at rest (AWS encryption)
- Access controls and authentication (JWT tokens, OAuth)
- AWS Secrets Manager for sensitive credentials
- Regular security audits and monitoring
- Principle of least privilege for data access
5.3 Data Retention
We retain your information for as long as your account is active or as needed to provide the Service. You may request deletion of your data at any time. We may retain certain information for legal compliance or legitimate business purposes.
6. Your Privacy Rights
6.1 Access and Correction
You have the right to access and update your personal information through your account settings.
6.2 Data Portability
You can export your GTM containers and migration data at any time through the Service.
6.3 Deletion
You may request deletion of your account and associated data by contacting us at privacy@ovalt.org. We will delete your information within 30 days, subject to legal retention requirements.
6.4 GDPR Rights (EU Users)
If you are in the European Economic Area, you have additional rights under GDPR:
- Right to object to processing
- Right to restrict processing
- Right to lodge a complaint with a supervisory authority
- Right to withdraw consent at any time
6.5 CCPA Rights (California Users)
If you are a California resident, you have the right to:
- Know what personal information we collect and how it's used
- Request deletion of your personal information
- Opt-out of the sale of your personal information (we do not sell your data)
- Not be discriminated against for exercising your privacy rights
7. Cookies and Tracking
We use cookies and similar tracking technologies to:
- Essential Cookies: Required for authentication and security
- Functional Cookies: Remember your preferences and settings
- Analytics: Understand how you use the Service (aggregated, non-identifiable)
You can control cookies through your browser settings. Disabling essential cookies may affect Service functionality.
8. Third-Party Links
The Service may contain links to third-party websites (e.g., Google Tag Manager documentation). We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.
9. Children's Privacy
The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
10. International Data Transfers
Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from your jurisdiction. We ensure appropriate safeguards are in place for such transfers in compliance with applicable laws.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by:
- Posting the updated policy on this page
- Updating the "Last updated" date
- Sending you an email notification (for significant changes)
Your continued use of the Service after changes constitutes acceptance of the updated policy.
12. Contact Us
If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us: