Privacy Policy

Last updated: 23 October 2026 · Version 2026-10-23

This policy explains what personal data OvuGuard collects when you visit our website or use our scanning service, why we collect it, who we share it with and what rights you have. It applies together with our Terms of Service and Cookie Policy.

1. Who is responsible for your data

OvuGuard (“OvuGuard”, “we”, “us”). Contact: legal@ovuguards.com.

We are the data controller (under the NDPA, the UK GDPR and the GDPR) and the “business” (under the CCPA/CPRA) for the personal data described below. For privacy questions or requests write to privacy@ovuguards.com. If you give us personal data about other people (for example, colleagues named in a scan target), you are responsible for having the right to do so.

2. What we collect

Category	Examples	Source
Account data	Email address, password (stored only as a salted bcrypt hash), terms-acceptance version and time, email-verification status, plan	You
Profile data	Full name, company, job title, phone number, country and postal address — all optional except name and company, and only if you complete your profile	You
Scan data	The targets you submit (URLs, domains, app-store links, APK file names), scan settings, results and reports, and uploaded APK files (deleted right after analysis). Results may incidentally contain publicly visible technical data such as server software versions or public contact details on a target’s site	You and the public internet
Authorization records	Your confirmation that you are authorised to test a target, with date, time and IP address; domain-verification tokens and results	You and our systems
Billing data	Plan, subscription status, Stripe customer and subscription identifiers, invoice and refund amounts and dates. Card details are collected and held by Stripe, not by us	You and Stripe
Security and activity logs	Sign-in successes and failures, password and profile changes, scan and billing events, administrator actions, IP address and timestamps. We never log passwords or reset/verification tokens	Our systems
Technical data	IP address, browser and device type and request metadata in server logs; a first-party session cookie (see the Cookie Policy)	Your browser
Communications	Messages you send to us (support, sales, privacy requests) and the transactional emails we send you (verification, welcome, password reset and changed notices)	You and our systems

We do not intentionally collect special-category (sensitive) personal data, and we do not use your data for advertising or sell it.

3. How and why we use it (legal bases)

Purpose	Legal basis (GDPR / UK GDPR; NDPA equivalent)
Create and run your account; run scans; produce and store reports; provide support	Performance of a contract with you (or steps before a contract)
Take payments, issue invoices, keep accounting and tax records	Contract; legal obligation
Send service emails (verification, security notices, password resets, billing notices)	Contract; legitimate interests in keeping accounts secure
Keep authorization and audit records; detect, investigate and prevent abuse, fraud and unlawful scanning; keep the Service secure	Legitimate interests (protecting OvuGuard, our users and third parties whose systems might be targeted); legal obligation where applicable
Respond to lawful requests from courts, regulators and law-enforcement authorities; establish or defend legal claims	Legal obligation; legitimate interests
Improve and monitor the Service using aggregated statistics	Legitimate interests
Send product news or marketing, if you opt in	Consent, which you can withdraw at any time. We do not currently send marketing email

Where we rely on legitimate interests we balance them against your rights and interests, and you can object (see section 8). We do not make decisions about you that have legal or similarly significant effects solely by automated means; scan scoring is automated but concerns the security of a target, not your creditworthiness or eligibility for services.

4. Who we share it with (subprocessors)

We share personal data only with service providers who process it for us under written terms, with professional advisers, with authorities where the law requires it (section 12), and in a business transfer (for example a merger) subject to this policy. Our current subprocessors are:

Subprocessor	Purpose	Location
Hetzner Online GmbH	Server hosting: application, database, uploads, backups	Data centre in Helsinki, Finland (EU)
Stripe, Inc. / Stripe Payments Europe Ltd.	Payment processing, subscriptions, invoices, customer portal	United States, Ireland and other countries where Stripe operates
Resend (Plus Five Five, Inc.)	Delivery of transactional email	United States (and its infrastructure providers)
Cloudflare, Inc.	DNS for our domain; DNS-over-HTTPS lookups used by the scanner (the hostnames being scanned are sent to the resolver)	Global network

When you scan an Apple App Store link, the app identifier is sent to Apple’s public lookup service, and scans of websites and APIs make requests to the target itself; those parties receive the technical information any visitor would send (such as our server’s IP address). We will update this list before adding a new subprocessor that processes your personal data, and you can ask for it at privacy@ovuguards.com.

5. International transfers

We operate from Nigeria and host data in the European Union, and our subprocessors may process data in other countries, including the United States. Where personal data subject to the GDPR, UK GDPR or NDPA is transferred to a country without an adequacy decision or equivalent recognition, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (with the UK Addendum or International Data Transfer Agreement for UK data), the EU–US Data Privacy Framework where the recipient is certified, or another mechanism permitted by the NDPA and the Nigeria Data Protection Commission, together with supplementary technical measures such as encryption in transit. You may request a copy of the relevant safeguards by contacting us.

6. How long we keep it

• Account and profile data: while your account is open. When you ask us to delete your account we delete or irreversibly anonymise it within 30 days, except for the records below.
• Scan targets, results and reports: kept in your account history while your account is open so you can view and export them, unless you delete them or your plan applies a history limit shown in the product. They are removed or anonymised when your account is deleted.
• Uploaded APK files: deleted immediately after analysis. We do not keep customer binaries.
• Authorization records and security/audit logs (including IP addresses): kept for up to 24 months, then deleted. We may keep specific records for longer where needed to investigate abuse or to establish, exercise or defend legal claims, or where the law requires.
• Billing and accounting records (invoices, refunds, Stripe identifiers): kept for up to six years after the transaction, or as long as tax, accounting or company law requires, even after your account is deleted. After account deletion they are no longer linked to your name or email in our systems.
• Verification and password-reset tokens: expire within 24 hours (verification) or 1 hour (reset) and are stored only as one-way hashes; used or expired tokens are purged.
• Backups: encrypted or access-restricted copies of the database are kept for a limited period and are overwritten on a rolling basis; deleted data leaves backups within 90 days.

7. Security and breach notification

We protect personal data with measures appropriate to the risk, including HTTPS with HSTS everywhere; salted bcrypt password hashing; hashed single-use tokens; signed, HttpOnly, Secure, SameSite session cookies with idle and absolute timeouts; CSRF protection on all state-changing requests; a strict Content-Security-Policy; rate limiting; role-restricted administrator access with an audit trail; server hardening; and access controls and backups for the database. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where required, within 72 hours of becoming aware of it (including the Nigeria Data Protection Commission under the NDPA), and we will notify affected individuals without undue delay where the risk is high.

8. Your rights and how to use them

Depending on where you live you have some or all of these rights: to be informed; to access your data and get a copy; to correct inaccurate data; to have your data erased; to restrict or object to processing; to data portability (receive your data in a structured, commonly used, machine-readable format); to withdraw consent at any time; and not to be subject to certain solely automated decisions. You can correct most of your data yourself on the Profile and Settings pages.

To exercise a right, including data export and account and data deletion, email privacy@ovuguards.com from the email address on your account (or log in and tell us what you need). We may ask you to verify your identity. We will respond within one month (30 days) and can extend that by up to two further months for complex requests, telling you why. There is no charge unless a request is manifestly unfounded or excessive. We may refuse or limit a request where the law allows or requires, for example where records must be kept for accounting or legal claims, and we will tell you why. You can also complain to a regulator (see below), and doing so will not affect the service you receive.

9. Nigeria — Nigeria Data Protection Act 2023

If you are in Nigeria, or your data is processed in Nigeria, the NDPA and its regulations apply. You have the rights set out in section 8, including the rights to be informed, access, rectification, erasure, restriction, objection, portability and to withdraw consent. We process personal data on the legal bases in section 3 (consent, contract, legal obligation and legitimate interests), and we rely on the transfer mechanisms in section 5 for cross-border transfers. You may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng if you believe your rights have been infringed, and you may also seek a remedy in the Nigerian courts. We will register or file with the NDPC and carry out data protection compliance audits where the NDPA requires us to.

10. EEA and United Kingdom — GDPR / UK GDPR

If you are in the European Economic Area or the United Kingdom you have the rights in section 8 under Articles 15–22 of the GDPR/UK GDPR. Our legal bases are in section 3 and our transfer safeguards are in section 5. If we need an EU or UK representative under Article 27, we will publish their details here. You may complain to your local supervisory authority (for example your national data-protection authority in the EEA, or the Information Commissioner’s Office (ICO) in the UK); we would appreciate the chance to address your concern first.

11. California — CCPA / CPRA notice

If you are a California resident: in the past 12 months we have collected the following categories of personal information, as described in section 2 — identifiers (email, IP address, name, phone, postal address), commercial information (plan and billing records), internet or network activity (logs, scan activity), professional information (company, job title), and inferences limited to security scoring of your targets. We collect them for the business purposes in section 3 and disclose them only to the service providers in section 4.

We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of; we do not knowingly sell or share the personal information of anyone under 16. You have the right to know and access, correct, delete, and receive a portable copy of your personal information, to limit the use of any sensitive personal information (we do not use it beyond what is permitted), and not to be discriminated against for exercising your rights. To make a request, email privacy@ovuguards.com; an authorised agent may do so on your behalf with proof of authority. We do not respond to browser “Do Not Track” signals because we do not track you across other sites.

12. Law enforcement and Cybercrimes Act cooperation

We may preserve and disclose personal data, including authorization records, account details, scan targets and IP addresses, where we believe in good faith that this is required by applicable law or valid legal process (including requests made under the Nigerian Cybercrimes (Prohibition, Prevention, etc.) Act 2015 and requests from courts, the NDPC or other competent authorities), or is necessary to protect the rights, property or safety of OvuGuard, our users or the public, or to investigate misuse of the Service against a third party. We review requests for validity and scope and disclose only what is required, and unless the law or the request prevents it we will tell you.

13. Children

The Service is for people aged 18 and over and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact privacy@ovuguards.com and we will delete it.

14. Changes

We may update this policy. The date and version are at the top of this page; for material changes we will notify you by email or in the app before they take effect, as described in the Terms of Service.

15. Contact

• Privacy and data requests: privacy@ovuguards.com
• Legal: legal@ovuguards.com
• Security: security@ovuguards.com