Privacy Policy

This is a starting draft and has not been reviewed by a lawyer. It describes how this business and this website actually work. Have it reviewed before relying on it.

Who we are

Overwatch Collective is a solo-operated aviation media and commercial drone business based in Utah, United States. You can reach us at ops@theoverwatchcollective.co.

What we collect

When you contact us. Our contact, partnership and drone enquiry forms collect the details you type in: your name and email address, and optionally a phone number, organisation, and whatever you write in the message. Drone enquiries also collect the service type, location, dates and budget you provide.

When you become a client. If we work together we keep a client record: your name or business name, a contact name, email address, phone number and billing address, along with the invoices and quotes we issue you and any private notes we make about the work.

If you use the client portal. Where we give you a login to view your own documents, we store your email address and a securely hashed password. We never see or store your password itself. Your portal account can only ever access your own invoices and quotes.

When you pay by card. Card payments are handled entirely by Stripe on Stripe's own pages. We never see, receive or store your card number, security code or expiry date. What we keep is a reference number from Stripe confirming the payment, the amount, and the date.

When you browse. We run our own analytics rather than a third-party service. It records the page you viewed, the site that referred you (the domain only, never the full address), a rough device type, and the country your request came from. It does not use cookies, does not store anything on your device, and does not follow you to other websites.

Your IP address is never stored. It is combined with a secret value and converted into a one-way code so we can tell that two page views in a day came from one person rather than two. That secret is replaced every night, which means the code stops being linkable to you within twenty-four hours.

If your browser sends a “Do Not Track” signal, we record nothing at all.

Cookies

Our own analytics uses no cookies. Two other things on this site do:

• Signing in. If you use the client portal, a cookie keeps you signed in. Without it the portal cannot work.
• Google Analytics. A second analytics service that does set cookies. If you block it, as many browsers do by default, nothing is sent.

Embedded video from Twitch, YouTube or Vimeo, and Stripe's payment pages, may set their own cookies. Their policies govern those.

Why we collect it

Contact details are used to respond to your enquiry and, if we go on to work together, to carry out that work, invoice you and keep proper business records. Analytics are used to understand which pages people find useful. We do not sell your information, and we do not use it for advertising.

Who else can see it

We use a small number of service providers to run the site and the business. They process data on our behalf and are not permitted to use it for their own purposes:

• Supabase — stores enquiries, client records, invoices and site content.
• Cloudflare — hosts and delivers the site, and forwards email sent to our address.
• Resend — sends notification emails, and sends you your invoices and quotes.
• Stripe — processes card payments. Stripe receives your card details directly and is responsible for them; we receive only confirmation that a payment succeeded.
• Google Analytics — a second analytics service that does use cookies.

How long we keep it

Enquiries are kept for as long as we may need them for the enquiry or the work that follows, and for our own business records afterwards.

Invoices, quotes, client records and payment references are kept for seven years, because tax and accounting rules require us to be able to produce our business records. This applies even if you ask us to delete your information — we will close your portal account and remove what we can, but we cannot delete the financial record of work we actually did for you.

Detailed analytics records are deleted after thirty days; only anonymous daily totals are kept beyond that.

Your choices

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Email ops@theoverwatchcollective.co and we will respond within a reasonable time. Depending on where you live you may have additional rights under laws such as the GDPR or the CCPA.

Your portal account

If we have given you a login, you can ask us to close it at any time by emailing ops@theoverwatchcollective.co. Closing your account removes your access; your invoices remain in our business records for the period described above.

Please choose a password you do not use anywhere else, and tell us promptly if you think someone else has got hold of it.

Security

Client records and invoices are held in a database where access is restricted per account, so one client's login cannot reach another's documents. Traffic to and from this site is encrypted. No system is perfect, and we will tell you promptly if something happens that affects your information.

Children

This site is not intended for children under 13, and we do not knowingly collect their information.

Changes

If we change this policy we will update the date shown at the top of this page.