Privacy Policy

1. Introduction

Ovesion (Pty) Ltd ("Ovesion", "we", "us", or "our") operates Ovesion, a cybersecurity vulnerability intelligence platform available at app.ovesion.com, supported by the marketing website at ovesion.com.

This Privacy Policy describes what personal information we collect, how we use it, who we share it with, and what rights you have. We are committed to handling your information responsibly and in compliance with the Protection of Personal Information Act 4 of 2013 (POPIA).

By creating an account or using Ovesion, you agree to the practices described in this Privacy Policy.

2. What We Collect

We collect information you provide directly, information generated by your use of Ovesion, and limited technical information required to operate the platform.

Account Information

When you create an Ovesion account, we collect your full name and email address (both required), a hashed password (we never store plain-text passwords), your authenticator-app settings if you turn on two-step sign-in, and your account preferences.

Authentication & Session Data

Ovesion uses Supabase for authentication and database infrastructure. Our sign-in provider keeps sign-in records, including session tokens, sign-in times, the IP address and browser of each session, and password reset requests. This data is used to secure your account.

Technology Stack Data

Ovesion's core function is to match vulnerabilities against your technology environment. To do this, we store the vendors, products and versions you add, any notes you enter, deployment details (for example whether a technology is in production or internet-facing), your environment names and descriptions, environment lifecycle state, and the findings, review decisions and watchlist entries that result. This data is used exclusively to provide the vulnerability intelligence service.

Billing Information

Subscription payments are processed by PayFast, a South African payment provider. We give PayFast your email address so it can process your payment. We do not store your card number, CVV, or bank account details. We do store your subscription plan and billing cycle, payment status and transaction references, and billing history for your account. All transactions are processed in South African Rand (ZAR).

Trial and walkthrough requests

If you request a trial or walkthrough on our website, we collect your name, company, work email, and optionally your phone number and the technologies you mention. We use these only to respond to your request and set up your trial.

Analytics

We use Cloudflare Web Analytics to understand how the website is used. It does not use cookies or track you across other websites, and we see only aggregate figures such as page views, referring sites, countries and device types. The website is served by Cloudflare, which processes visitors’ IP addresses to deliver, protect and measure it. The Ovesion application does not use analytics or tracking tools.

Usage Data

Our providers keep the technical logs needed to run and secure the service.

3. Lawful Basis for Processing

Under POPIA (Section 11), personal information may only be processed on a lawful basis. Here is how that applies to Ovesion.

We process your account information, session data, technology stack data, and billing records because this processing is necessary to perform our contract with you. Without it, we cannot provide the service. Billing records are also retained to meet our legal obligations under South African tax and financial regulations.

We process technical logs (such as sign-in records and email delivery logs), security monitoring data, aggregate website analytics, and trial and walkthrough requests on the basis of our legitimate interest in operating a secure and reliable platform and responding to requests you make, including preventing abuse and detecting fraud. We do not use this data for advertising or profiling.

We do not rely on consent as the primary basis for processing. Where we do rely on consent for a specific activity, we will ask for it explicitly, and you may withdraw it at any time by contacting us.

4. How We Use It

We use the information we collect to:

• Provide the service: Match vulnerabilities against your technology stack, generate your environment threat feed, and deliver prioritised intelligence.
• Manage your account: Create and maintain your account, authenticate your identity, and manage your sessions.
• Process billing: Handle payments, manage your subscription, and maintain billing records.
• Secure the platform: Detect and prevent unauthorised access, abuse, and fraud.
• Understand our website: Count visits and see which pages are read, using aggregate, cookie-free analytics.
• Communicate with you: Send account confirmations, password resets and, on paid plans, CVE alert digests for your environments, which you can unsubscribe from at any time. We do not send marketing emails. If we introduce marketing communications in the future, you will have the right to opt out at any time.
• Comply with the law: Meet our obligations under applicable South African law.

We do not use your data for advertising, profiling, or any purpose unrelated to operating Ovesion.

5. Who We Share It With

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances.

Service Providers

Ovesion uses a small number of trusted third-party providers to operate the platform. These providers act as operators under POPIA and are contractually required to protect your data. We use Supabase for authentication, database, and hosting infrastructure; Vercel to serve the web application; Resend to send account and alert emails and the emails from our website request form; Microsoft 365 for our email mailboxes, which receive your trial and walkthrough requests and support correspondence; PayFast for subscription billing and payment processing; and Cloudflare to serve, protect and measure visits to the Ovesion website, and protect our forms from spam. Alert emails contain the names of your environments, the affected products and the CVEs matched to them. Links to each provider's privacy policy are available on request.

Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Ovesion, our users, or the public.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

6. Data Retention

We keep your account data while your account is active. To close your account, or to delete an environment’s data, email support@ovesion.com. We delete your account and its data within 30 days of a written request, except records we must keep by law, such as billing records under South African tax and financial regulations. You can remove stack entries at any time, and archive environments where your plan allows it. Trial and walkthrough requests are deleted on written request in the same way.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These measures include encrypted data transmission using HTTPS/TLS, hashed password storage (plain-text passwords are never stored), row-level security policies on the database, and optional two-step sign-in with an authenticator app, from Sign-in & security in the account menu.

No method of transmission over the internet or electronic storage is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security. If you become aware of any security concern related to your account, please contact us immediately at support@ovesion.com.

8. International Transfers

Ovesion is a South African company. Our providers operate outside South Africa. Supabase stores your account, technology stack and environment data in the European Union (Stockholm, Sweden). Vercel serves the web application from its global network and processes the technical data needed to deliver it, such as IP addresses. Cloudflare serves the Ovesion website from its global network and processes visitors’ IP addresses to do so. Resend processes recipient email addresses and the content of the emails we send. Microsoft processes the emails our mailboxes send and receive. Your data may be processed in these regions as part of delivering the service.

These transfers are necessary for the performance of our contract with you (POPIA Section 72(1)(b)). Supabase, Vercel, Resend, Microsoft and Cloudflare maintain data processing agreements and standard contractual protections for cross-border data transfers. Payments are handled by PayFast, a South African payment provider.

9. Your Rights

Under the Protection of Personal Information Act 4 of 2013 (POPIA), you have meaningful rights over your personal data. You can request a copy of the information we hold about you. You can reset your password yourself from the sign-in page. Other account changes, such as your name or email address, are made on request to support@ovesion.com. You can request deletion of your account and associated data at any time. Some data may be retained where required by law. Where we rely on legitimate interest as the basis for processing, you can object to that processing. You also have the right to object to decisions made solely by automated means that significantly affect you (POPIA Section 71). Where processing is based on consent, you can withdraw that consent at any time.

To exercise any of these rights, contact our Information Officer at support@ovesion.com. We will respond within a reasonable timeframe and in accordance with POPIA. You also have the right to lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za.

10. Contact & Information Officer

Ovesion has designated an Information Officer as required by POPIA. The Information Officer is responsible for ensuring our compliance with POPIA and handling data subject requests.

11. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email.

Your continued use of Ovesion after any changes constitutes acceptance of the updated policy. If you have questions about any changes, please contact us at support@ovesion.com.