Privacy policy

1. Who is responsible

The data controller is Sebastián Saumont, operating under the trade name Ovantly, based in Santiago, Chile. For any privacy or security matter, the contact is hola@ovantly.com.

We apply Chilean Law No. 19,628 on the protection of private life, and already comply with Law No. 21,719, which replaces it and takes effect on December 1, 2026.

2. What data we process and why

If you visit this site

The server hosting the site logs technical data for each request (IP address, browser, requested page, date and time) in order to operate and defend against abuse. We use no cookies and no tracking pixels, and our fonts are served from our own domain: your browser doesn't talk to any third party while you browse.

To know how many people visit the site we use Vercel Web Analytics, from the same provider that hosts it. It sets no cookies and does not identify you: it records the page viewed, where you came from, the country and the device type, and builds an aggregate count from that. The script and the data are served from our own domain, so your browser doesn't talk to a third party here either. Legal basis: our legitimate interest in knowing whether the site is understood and used, with the minimal impact of measurement without identification.

If you choose the light or dark theme, your browser stores that preference in its local storage so it's remembered on your next visit. It isn't a cookie, it isn't sent to our server, and you can clear it from your browser settings.

If you fill in the audit form

We receive your name, company, work email, website, team size and whatever you write about your business. We use it to assess whether your market is reachable and to reply to you by email. Legal basis: handling a request you initiated yourself, prior to a potential contract.

If you use the domain checker

You type a domain name and we look up its public DNS records (MX, SPF, DKIM and DMARC) through the public DNS resolvers of Cloudflare (1.1.1.1) and Google (8.8.8.8), which receive only that name. We don't store the domain or the result. The domain travels inside the request, not in the page address, so it doesn't end up in the site's access logs either. If you share a link to a result, the domain goes after the "#" sign, a part of the address that browsers never send to our server.

To prevent abuse, we count for one minute how many lookups arrive from each IP address. That count lives only in the server's memory and is discarded automatically.

If we contact you cold

We prospect B2B software and cybersecurity companies to offer them our services. To do so, we process professional data about people in decision-making roles:

• name, company, domain and work email;
• city or country, and the company's size range;
• the address of your professional LinkedIn profile, when there is one;
• contact status: whether we wrote to you, when, and whether you replied.

Where it comes from: B2B business information platforms (Apollo.io and Snov.io), your company's public website and your public LinkedIn profile. We don't buy bulk databases: every contact is filtered by industry, company size and role before entering the list.

Before writing to you we also check the public DNS records of your company's domain (such as SPF and DMARC), using the same engine as our domain checker, so we can mention a specific finding if there is one. This is public company configuration data, not personal data, and we use it only to personalize that email. We also publish aggregate statistics from those checks, such as our DMARC study, without identifying any company.

What we do with it: send you plain-text emails, during business hours and at a low volume, and possibly view your profile or send you a connection request on LinkedIn.

Legal basis: legitimate interest in business-to-business contact, limited to your professional role. That's why every email identifies who is writing and lets you opt out with a single word. If you reply "no" or ask to be removed, we won't write to you again.

If you are a client

We process the contact details of the people at your company we work with, and your billing details, to perform the contract and meet tax obligations.

When we prospect on behalf of a client, the client decides who is contacted and acts as the controller of that data; Ovantly processes it only on the client's instructions, under a data processing agreement, and deletes or returns it when the service ends.

3. What we don't do

• We don't sell, rent or transfer personal data to anyone.
• We don't process sensitive data or data about your personal life.
• We don't make automated decisions that have effects on you.
• We don't use the prospects we work for one client in another client's outreach, or in Ovantly's own.

4. Providers and data location

These providers process data on our behalf and only to deliver their service to us:

Several are outside Chile, which means an international transfer of data. We only work with providers that offer data processing agreements and contractual protection safeguards.

5. How long we keep it

Website technical logs

As set by the hosting provider to operate and protect the service; we don't export them or combine them with other data.

Form requests

12 months from the last contact, if they don't become a business relationship.

B2B prospects

12 months from the last contact. Deleted afterwards.

Opt-out or objection requests

We delete everything else and keep only your email and your company's domain on an exclusion list, so we never write to you again. It's the minimum we need to honor your request.

Clients

For the duration of the contract and, afterwards, for as long as Chilean tax regulations require for accounting records.

6. Security and vulnerability reporting

The concrete measures, not a generic statement:

• All site traffic is encrypted with TLS, with HSTS.
• The database isn't reachable from the internet with public credentials: it has row-level security enabled with no permissions for anonymous roles, and only the backend accesses it, with credentials that never reach the browser.
• The form goes through our server, which validates and limits every field before storing it. No internal URL or key is exposed in public code.
• The site sends security headers (content security policy, framing protection, referrer and permissions policies).
• We collect only the fields we use, and access is limited to whoever needs it to operate.

If a breach affecting your data occurs, we will notify the authority and the affected people where required, through the fastest available means and without undue delay.

Vulnerability reporting

If you find a vulnerability in ovantly.com or our infrastructure, email us at hola@ovantly.com with the subject "Security". We acknowledge receipt within 3 business days. If you act in good faith, don't access third-party data beyond what's needed to demonstrate the issue, don't degrade the service or use social engineering, and give us reasonable time to fix it before publishing, we won't take legal action against you. The contact is also published at /.well-known/security.txt.

7. Your rights

At any time and free of charge, you can ask us to access the data we hold about you, correct it, delete it, object to its processing, receive it in a portable format, or have it blocked while a request is being resolved.

Write to hola@ovantly.com with the subject "Privacy". If you write from the email address we have on record, that is enough to verify it's you; otherwise we'll ask for the minimum needed to confirm it. We reply within 30 calendar days.

If you're not satisfied with our response, you can file a complaint with Chile's Personal Data Protection Agency once it begins operating, or with the courts under current law.

8. Changes to this policy

If a provider, data source or retention period changes, we update this page and the effective date above. Changes that reduce your rights are announced on this same page before they apply.