Last updated: September 27, 2026
ovniTEK Solutions LLC ("ovniTEK," "we," "us," or "our") respects your privacy. This Privacy Notice explains how we collect, use, and protect information when you visit our website, complete an assessment, purchase or download a report, create or use a customer account, or contact us regarding our services.
By using this website, you acknowledge the practices described in this notice. If you have questions about our privacy practices, please contact us at privacy@ovnitek.com .
When you contact ovniTEK, complete an assessment, or request a personalized report, you may voluntarily provide information such as:
The personal checkup asks for selected answers, not passwords, recovery codes, private keys, account numbers, or an email address to perform a breach lookup. Optional links to independent breach services open their sites; ovniTEK does not send your email to them. We store the breach-check result only if you choose to report it in the checkup. Personal answers and results are used to prepare the free snapshot and, if purchased, the PDF action plan.
We use this information to operate the assessment, calculate results, generate and deliver requested reports, process and support orders, respond to inquiries, and communicate with prospective or existing customers.
Payment-card and PayPal login information is entered directly with PayPal. ovniTEK does not receive or store full payment-card numbers or PayPal account passwords. We receive transaction identifiers, payment status, amount, and related information needed to confirm and support a purchase. If a refund is issued, we may also process its PayPal transaction identifier, amount, status, and related order reference to review the transaction, update operational records, and reconcile the order. We do not initiate a refund merely because a request is submitted.
If you choose to sign in with Google, Google authenticates your account and provides our authentication service with the basic identity information needed to create or access your ovniTEK account. This may include your Google account identifier, name, email address, email-verification status, and profile image when available. ovniTEK does not receive your Google password.
We use Google account information only to authenticate you, maintain your customer account and session, protect account access, provide support, and connect an eligible purchased report to the authenticated account after report ownership is separately verified. We do not request access to Gmail messages, Google Drive, contacts, calendars, or other unrelated Google services, and we do not sell Google user data or use it for advertising.
If you choose to sign in with GitHub, GitHub authenticates your account and may provide the basic identity information authorized by the sign-in flow, such as your GitHub account identifier, username, display name, email address, email-verification status, and profile image when available. ovniTEK does not receive your GitHub password and does not use customer sign-in to access or modify your repositories.
If email/password authentication is enabled and you choose that option, Neon Auth processes the name, email address, password credential, verification status, and password-reset information needed to create and protect the account. Passwords are submitted directly to Neon Auth; ovniTEK's application database and Netlify functions do not receive or store your plaintext password.
Account and session records are processed through Neon Auth and stored with our database records as described in this notice. Google's processing of its sign-in interaction is governed by Google's Privacy Policy and the Google API Services User Data Policy . GitHub's processing of its sign-in interaction is governed by the GitHub General Privacy Statement .
When you visit our website, certain technical information may be processed automatically by our hosting, security, and third-party services. Depending on the service involved, this may include your IP address, browser type, operating system, device characteristics, referring pages, pages visited, and general usage information.
This information may be used to maintain website functionality, improve website performance, understand website usage when analytics consent has been provided, and help protect the website against spam, abuse, and other security threats.
ovniTEK determines why and how personal information collected directly through this website is processed. Where applicable privacy law uses these terms, ovniTEK generally acts as the data controller or business for customer-account, contact, assessment, report-order, and support information. Providers that process information for ovniTEK generally act as service providers or processors under their applicable agreements and terms.
Assessment responses, calculated results, and report data are processed to operate the assessment, generate the requested report, provide authenticated vault access when chosen or required for the full assessment, support the order, maintain security, prevent fraud or abuse, and comply with applicable obligations. We do not sell assessment data, disclose it to advertisers, or use a customer's identified assessment responses to target advertising.
Automated systems ordinarily calculate scores and generate report content. Authorized ovniTEK personnel may access assessment or order information when reasonably necessary to operate and secure the service, investigate a problem, respond to a verified support request, regenerate secure report access, address fraud or abuse, or comply with law. A separately contracted engagement may define different controller and processor responsibilities in its applicable agreement.
A provider may act independently for information you submit directly to that provider. For example, PayPal determines how it processes payment-account information, and Google or GitHub determines how it processes activity within its own sign-in service, under the provider's own terms and privacy notice.
We use Google Analytics to help us understand how visitors interact with our website and to improve our content and services.
Google Analytics may collect information such as device information, approximate geographic information, browser information, pages viewed, and interactions with the website.
Analytics is optional. Google Analytics is not loaded unless you choose to allow analytics through our cookie consent controls. If you decline analytics, we do not load the Google Analytics service through our website.
Separately from Google Analytics, if you visit through a campaign link, the link's UTM source, medium, campaign, content, and term values may be held temporarily in the current browser tab. If you later begin checkout, those limited campaign fields may be stored with the order so we can understand which outreach led to a purchase. This order attribution does not store an advertising identifier, the full referring URL, or a history of pages you viewed.
You can change your analytics preference at any time using the Cookie Preferences option available in the website footer.
Our website uses browser storage to remember your cookie consent preference and your selected light or dark appearance. This allows the website to preserve those choices as you move between pages and return on later visits.
These preferences are stored locally in your browser using local storage. This information is used solely to maintain your selected privacy and display settings and does not contain the contents of your contact form submission.
During an assessment and report checkout, the website also uses session storage to retain random session and checkout identifiers in the current browser tab. The personal checkup also stores a random session-access token there. These values help resume progress, retrieve order status, and authorize a temporary report download. Clearing browser data or closing the tab may remove this local access, but does not necessarily delete associated records held by ovniTEK or its providers.
Our website does not use advertising or remarketing cookies.
Information submitted through our website contact forms is processed using Netlify's form services. Submitted information may include your name, email address, company name, and message.
We use this information solely for purposes such as responding to your inquiry, discussing requested services, and communicating with you regarding potential or existing business relationships. Website feedback may include a rating and optional comments, which we use to evaluate and improve the site and customer experience.
Feedback may be submitted without a name, email address, or company name. Those fields are optional. We will use feedback contact details to follow up only when you select the separate permission checkbox; if you select it, an email address is required. That permission is for a response about the feedback, not marketing. Netlify and anti-abuse services may still process technical submission information, so we do not promise that an identity-free submission is completely anonymous.
We retain contact and feedback submissions as reasonably necessary to respond, review feedback, improve the service, prevent abuse, and meet applicable recordkeeping obligations. Do not use either form to send security-sensitive material; suspected vulnerabilities should be reported using the separate security disclosure process.
For more information about how Netlify handles information, please review Netlify's Privacy Policy .
Our contact-request form uses reCAPTCHA provided through Netlify's form protection services to help prevent spam, abuse, and automated submissions. The reCAPTCHA service is provided by Google and may collect information about your device, browser, IP address, and interactions with the website for security and verification purposes.
reCAPTCHA may set or access information necessary to perform its security and abuse-prevention functions. Its operation is subject to Google's Privacy Policy and Google's Terms of Service .
Netlify processes form submissions and provides the associated spam-prevention functionality. For more information about Netlify's handling of information, please review Netlify's Privacy Policy .
We may use information collected through the website for the following purposes:
We do not sell personal information submitted through this website.
We may use trusted service providers that help us operate our website and provide our services. These providers may process information on our behalf as necessary to perform their services.
Current website-related service providers include:
Resend receives the recipient name, email address, transactional payment-confirmation or report-availability content, order number, and a general link to the Report Vault sign-in page. We do not send assessment responses, scores, findings, report contents, PDF attachments, checkout identifiers, private access tokens, or direct report-download links to Resend. PayPal processes payment information under its own privacy practices. Service providers may process technical and operational information necessary to perform their services for us.
When you select Google or GitHub sign-in, the selected provider shares the basic identity information authorized through its sign-in flow with Neon Auth and ovniTEK. We use that data only for the account purposes described in this notice.
When email/password authentication is enabled, Neon Auth also processes the account credentials, verification activity, and password-recovery requests needed to provide that sign-in method.
We may also disclose information when required by law, legal process, or to protect the rights, property, security, or safety of ovniTEK, our customers, or others.
We retain information for only as long as reasonably necessary for the purpose for which it was collected, to maintain legitimate business records, resolve disputes, enforce agreements, comply with legal obligations, or otherwise fulfill legitimate business needs.
Retention periods may vary depending on the type of information and the reason it was collected.
Security reports and related correspondence may be retained as reasonably necessary to validate and remediate a reported issue, coordinate with the reporter, prevent recurrence, maintain security records, address a legal obligation, or resolve a claim. Do not send credentials, access tokens, private keys, customer records, or other sensitive evidence through ordinary email. The security reporting policy explains how to contact us and request a safer transfer method if sensitive evidence is necessary.
Assessment responses, calculated results, customer contact details, and report-order records are stored while needed to provide the assessment and report, support the transaction, prevent fraud, and maintain the customer's chosen report access. Download activity is linked to the report order so we can support access issues and review fulfillment if a payment is disputed. Our report-download activity records the access method and time, but not the raw access link, IP address, browser fingerprint, or report contents. These records are removed with the related report order when that order is deleted. A signed-in customer may use the self-service account-deletion control to permanently remove the account and the saved reports, linked assessment responses, scores, findings, report-order details, and customer-access records connected to that account. For abuse and fraud review, a restricted deletion audit record may retain the account name and email for up to 90 days after the deletion request. Administrators can review this record; it is not used to restore access to deleted reports or answers. After 90 days the identity is hidden from the dashboard and removed by the daily retention cleanup. A non-identifying deletion event and counts may remain for up to three years.
After account deletion, we retain a separate, minimized financial transaction record for tax, accounting, payment reconciliation, fraud-prevention, chargeback, dispute, and legal-record purposes. The ordinary federal tax-record period is generally three years after the related return is filed or due. Because ovniTEK does not use account deletion to collect the customer's tax-return filing date, the automated retention date conservatively keeps a record through January 1 five years after the transaction year begins (for example, a 2026 transaction through January 1, 2031). That retained record is limited to the product, amount, currency, payment-provider reference, payment status, and transaction and retention dates. It does not contain the customer's name, email address, authentication identifier, assessment responses, scores, findings, or generated report. We may retain a record longer when reasonably necessary to satisfy an applicable legal obligation, active dispute, payment issue, or legal claim.
If you choose to save a report to an authenticated customer account, we retain the Neon Auth user identifier and the record connecting that account to the purchased report until the account or connection is deleted. We do not grant report access merely because an account email resembles the email entered at checkout. Reports or orders that were never connected to the account may require a separately verified privacy request because the account identifier alone cannot safely establish ownership of them.
Authentication and session records, including email verification and password-recovery records when those features are enabled, are processed through Neon Auth. A self-service deletion asks Neon Auth to delete the authentication identity before ovniTEK removes the connected application data. Neon may represent that deletion with an inactive, soft-deleted record rather than immediately removing every underlying database row. Limited copies or deletion records may also remain temporarily in provider backups, security logs, or disaster-recovery systems under the provider's operational retention practices and are not used to restore the deleted customer account in ordinary operation.
The browser checkout token used for immediate report access expires approximately one hour after the order is created. Reports are generated from stored assessment and order data when requested; report PDFs are not emailed through Resend and are not stored in the website source-code repository.
We take reasonable administrative, technical, and organizational measures to protect information against unauthorized access, disclosure, alteration, or destruction.
Assessment, order, account-access, and report data is stored in a Neon-managed PostgreSQL database. Neon states that stored data is encrypted at rest using AES-256 and that connections over public and private networks use TLS 1.2 or later. Netlify, which hosts the website and serverless application functions, states that its platform encrypts data at rest using AES-256 or stronger and traffic in transit using TLS 1.2 or later. These are provider-level safeguards and do not eliminate every risk. Additional information is available in Neon's security overview and Netlify's security overview .
Customer browsers do not directly query the report database. Report operations pass through server-side functions that verify a temporary checkout credential or an authenticated Neon user and confirm the corresponding report-access record. Vault access is keyed to the authenticated user identifier rather than an email match. Administrative report access uses a separate allow-list, authorization checks, and audit records. Sensitive database, payment, email, and report-delivery credentials are configured as deployment secrets rather than included in public website code.
However, no method of transmitting or storing information over the Internet can be guaranteed to be completely secure. We therefore cannot guarantee absolute security.
Checkout identifiers and report-download URLs should be treated as confidential. Anyone who obtains a valid identifier during its active period may be able to access the associated report.
This website is intended for businesses and general audiences and is not directed toward children under the age of 13.
We do not knowingly collect personal information from children under 13 through this website. If you believe a child has provided us with personal information, please contact us so that we can take appropriate steps.
Depending on where you live and applicable law, you may have rights regarding your personal information. These may include the right to request access to, correction of, deletion of, or information about the processing of your personal information.
To make a privacy-related request, contact us at privacy@ovnitek.com . Signed-in customers may also permanently delete their account and its connected saved-report data from the Danger Zone on the My Reports page. This action cannot be undone. Financial records retained for the limited purposes stated in Section 9 are not included in self-service deletion.
We may need to verify your identity before completing certain requests. Your rights may be subject to limitations and exceptions under applicable law.
Some browsers provide Do-Not-Track settings. Because there is currently no universally accepted technical standard for responding to these signals, our website may not respond to all Do-Not-Track requests.
We may update this Privacy Notice from time to time to reflect changes to our website, services, technology, or applicable legal requirements.
When changes are made, we will update the "Last updated" date at the top of this page.
If you have questions, concerns, or requests regarding this Privacy Notice or the information we collect, please contact:
ovniTEK Solutions LLC
Email:
privacy@ovnitek.com
