Privacy Policy

Ovrtxt ("Ovrtxt") is committed to protecting the privacy of the individuals whose data flows through our authentication infrastructure. This Privacy Policy describes what personal data we collect, why, how it is processed, and the rights you have over it.

1. Who We Are

Ovrtxt is a Texas corporation operating the Ovrtxt authentication platform. For purposes of EU/UK GDPR, Ovrtxt acts as a data processor on behalf of our customers (the data controllers) when processing end-user phone numbers during authentication flows.

2. Data We Collect

From Customers (Platform Users)

• Account registration data: name, company, email address, and billing details.
• API usage metadata: timestamps, endpoint paths, session counts, and error rates.
• Dashboard activity logs for security audit purposes.

From End Users (via Customer Integration)

• Phone numbers in E.164 format, submitted by the customer when triggering a verification.
• Inbound SMS metadata: carrier timestamp, message length, and delivery status.
• Session outcome (approved / expired / denied) and authentication latency.

We never collect end-user names, email addresses, or any data beyond what is technically required to match an inbound SMS to a session.

3. How We Use Personal Data

• To deliver the authentication verification service contracted by our customers.
• To calculate billing based on successful verification counts.
• To detect abuse, rate-limit anomalous patterns, and protect platform integrity.
• To communicate account updates, security notices, and material product changes.

We do not use personal data for advertising, do not sell data to third parties, and do not build user profiles for any purpose beyond service delivery.

4. Phone Number Hashing

Phone numbers submitted to our API are one-way hashed (SHA-256 + per-tenant salt) before storage in our analytics systems. Plaintext numbers are held transiently in memory only for the duration of the active session TTL (maximum 300 seconds) and are then purged.

5. Data Retention

• Active session data is purged within 60 seconds of session completion or expiry.
• Hashed usage records are retained for 24 months for billing and abuse detection.
• Customer account data is retained for the duration of the contract plus 90 days.

6. International Transfers

Ovrtxt is headquartered in the United States. Data may be processed in US and EU data centers. For EU/UK customers, we rely on the EU Standard Contractual Clauses (SCCs) as the transfer mechanism. Our Data Processing Agreement is available for signature upon request.

7. Security

We apply TLS 1.3 in transit, AES-256 at rest, HMAC-signed webhook delivery, and strict access controls to all infrastructure handling personal data. We undergo annual third-party security assessments and are in the process of achieving SOC 2 Type II certification.

8. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or port your personal data. To exercise these rights, contact privacy@ovrtxt.com. We respond to all verified requests within 30 days.

9. Cookies

Our marketing website uses session cookies for authentication and anonymized analytics (via a self-hosted Plausible instance — no third-party ad tracking). The API itself does not use cookies.

10. Contact

Data Protection Officer: privacy@ovrtxt.com
Ovrtxt