Privacy Policy

Who we are

Overwatch One LLC (“Overwatch One,” “we,” or “us”) provides IT as a Service, cybersecurity, surveillance, access control, websites, and consulting to businesses and homes in New York City and Bergen County, NJ. This policy explains what personal information we collect through ovrwtch.com, forms.ovrwtch.com, the Ask Scott chat, and our client portals (together, “our sites”), how we use it, and the choices you have.

This policy covers information collected through our sites. Information we handle for clients while providing IT as a Service and other services is covered by our written agreement with that client.

The short version

• We collect only what you choose to send us, plus basic technical information needed to run and protect our sites.
• We use it to answer you, provide the services you ask for, and keep our sites working and secure.
• We do not sell your personal information. If you allow Marketing in our cookie settings, our Affiliates page loads tracking images from our affiliate network, CJ, which may set its own cookies. Marketing is off unless you turn it on, and it stays off if your browser sends a Global Privacy Control (GPC) signal.

What we collect and why

Forms (forms.ovrwtch.com)

When you submit a request form, such as the Internet Provider request form, we collect what you enter. That can include your name, email address, phone number, business name, business location, tax ID (EIN), website, and any notes you add. The submission is stored in our database on Cloudflare and emailed to our team so we can respond. If you submit an Internet Provider request, we share the details from your form with the internet provider so it can create your account.

Ask Scott chat and message form

Ask Scott is an AI assistant on ovrwtch.com. If you use it, we process your messages and the page you were on so it can reply. The chat runs on Cloudflare, including Cloudflare’s AI service. Your chat session is kept for up to 24 hours to answer you. If you share your name, email, phone number, or company, or ask for a person to follow up, we save a record of the conversation and a short summary so our team can contact you. The same applies to questions you send through the Ask Scott message form. Ask Scott is an AI and can make mistakes; please don’t share passwords, payment card numbers, health information, or other sensitive details in the chat.

Client portal sign-in

Our client portals are private pages for existing clients. Depending on the portal, you sign in in one of two ways:

• Portal password. Your organization sets the password through a one-time invite link from us. It is stored on Cloudflare only in a scrambled (hashed) form that we cannot read. After you sign in, the portal sets an essential sign-in cookie that lasts up to 30 days or until you sign out. To limit repeated sign-in attempts, the portal keeps your IP address for up to 15 minutes.
• Cloudflare Access. On portals that use Cloudflare Access, you sign in with your Google account, your Microsoft account, or a one-time code sent to your email. Cloudflare Access sets an essential sign-in cookie for the length of your session.

When you sign in with Google, Google shares your basic profile with Cloudflare Access: your name, email address, Google account ID, and profile details such as your profile picture link. We use only your name and email address, and only to confirm that you are allowed to see your organization’s portal. We do not receive your Google password, and we do not access your Gmail, files, contacts, or calendar.

Signing in with Microsoft works the same way: Microsoft shares only your basic sign-in details, such as your name and email address, with Cloudflare Access. We do not receive your Microsoft password, and we do not access your Outlook mail, OneDrive files, contacts, or calendar.

Cloudflare Access does not store your Google or Microsoft account. It records only your sign-in email address and the time of each sign-in in its access logs, and we use these only to secure the portals. Those logs are deleted automatically on Cloudflare’s retention schedule.

Information collected automatically

Like most websites, our hosting provider processes technical information such as your IP address, browser type, and the pages requested, so the site can load and be protected from abuse. For example, our forms and chat use a one-way scrambled (hashed) form of your IP address to limit repeated submissions. If you allow Analytics in our cookie settings, Cloudflare Web Analytics counts visits and measures page speed without cookies.

Cookies and browser storage

We keep cookies and browser storage to a minimum. Our Cookie Policy lists each item, what it does, and how long it lasts, and you can change your choice at any time with “Cookie preferences” in the footer. We honor the Global Privacy Control (GPC) signal as described there.

Affiliate links (CJ)

Our Affiliates page has links to a few partner products. We may earn a commission if you buy through them. The links run through CJ (Commission Junction), our affiliate network. If you allow Marketing, the page also loads small tracking images from CJ that count how often the offers are shown, and CJ may set its own cookies. These images do not load until you allow Marketing, and they never load if your browser sends a GPC signal. If you click an affiliate link, you go through CJ’s site on the way to the partner, so CJ and the partner can see that visit and may set cookies under their own policies, whatever your choice on our site.

How we use information

• To respond to your questions, requests, and booking inquiries.
• To respond to requests for our services and set up services you ask for.
• To let authorized people sign in to client portals.
• To keep our sites running, prevent spam and abuse, and fix problems.
• To meet legal obligations and protect our rights.

Google API Services User Data Policy

Overwatch One’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• What we access: when you sign in with Google, Cloudflare Access asks Google only for basic sign-in permissions (“openid”, “email”, and “profile”). That gives it your name, email address, Google account ID, and basic profile details such as your profile picture link. We do not ask for access to your Gmail, Drive, contacts, calendar, or any other Google data.
• How we use it: only your name and email address, and only to authenticate your access to client portals.
• Sharing: we do not sell this data, do not use it for advertising, and do not transfer it to others except Cloudflare Access, which provides the sign-in, or as required by law.
• Human access: no one reads it except with your permission, as needed for security, or to comply with law.
• Storage and deletion: Cloudflare Access does not store your Google or Microsoft account. It records only your sign-in email address and the time of each sign-in in its access logs, and those logs are deleted automatically on Cloudflare’s retention schedule. The same applies when you sign in with Microsoft.

When we share information

We do not sell personal information. We share it only:

• With service providers that help us run our sites and business, such as Cloudflare (hosting, storage, sign-in, and AI chat) and our email and scheduling providers, who handle it under their agreements with us to provide their services.
• With the internet provider named in your Internet Provider request, so it can create your account.
• With CJ, our affiliate network, as described under “Affiliate links (CJ)”: only if you allow Marketing, or when you click an affiliate link.
• If required by law, or to protect the safety, rights, or property of our clients, our team, or the public.
• With a successor if our business is reorganized or transferred, subject to this policy.

How long we keep it

We keep personal information only as long as we reasonably need it for the purposes above, such as responding to you, providing services, keeping business records, or meeting legal requirements. Chat sessions expire after 24 hours unless saved as a follow-up request. You can ask us to delete your information at any time (see “Your choices”).

How we protect it

We use administrative, technical, and physical safeguards designed to protect personal information, appropriate to our size and the kind of information we hold. No website or online service is completely secure, so we cannot guarantee absolute security.

If there is a data breach

If we learn of a breach of security involving your private information, we will notify affected people, and government agencies where required, as required by applicable law, including New York’s data breach notification law.

Your choices

• Ask us what personal information we have about you, or ask us to correct or delete it.
• Change your cookie and analytics choices with “Cookie preferences” in the footer.
• Ask us to stop contacting you.

To make a request, contact us using the details below. We may need to confirm your identity first. Some information may need to be kept for legal or security reasons.

Children

Our sites are meant for businesses and adults. We do not knowingly collect personal information from children under 13. If you believe a child has sent us information, contact us and we will delete it.

Links to other sites

Our sites link to other services, such as Calendly, LinkedIn, X, Instagram, and Facebook. Their own privacy policies apply when you use them.

Changes to this policy

We may update this policy from time to time. We will change the “Last updated” date above and, for significant changes, take reasonable steps to let you know.

Contact us

Questions or requests: [email protected] or (212) 960-8139.