Privacy notice

Last updated: 17 October 2026

Overto is operated by Gal Elmalah. It provides a shared place for people and connected agents to work on documents.

Information we use

When you sign in with Google, we request your basic profile and email address. We use your Google account identifier, verified email and profile information to identify you, show your account and enforce company membership. Google sign-in does not give Overto access to your Gmail, Google Drive or Calendar.

We store the companies you create or join, optional onboarding answers, documents and files you upload, comments, and the credentials and permissions needed for your connections. We use this information to provide the service and protect access to it. Essential cookies and short-lived authorization records support login and secure redirects.

Website analytics

We use Cloudflare Web Analytics on our public website to understand visits, page views and page performance. We also count fixed actions such as reaching sections of the landing page, choosing agent setup, and starting signup. These action events do not contain clipboard text, account details, document content, raw page URLs or visitor identifiers. We do not use analytics cookies or fingerprinting to connect your activity across visits. Counts may be sampled and are not a count of unique people. Cloudflare temporarily rate-limits event requests using the connecting IP; that IP is not included in our action events.

Service providers and access

Documents and websites use company or private sharing permissions by default. If an authorized person chooses “Public on the internet,” anyone can read the current published page and its published files, including future updates. Comments, editable source and older versions stay protected. Turning public access off stops subsequent public requests; it cannot recall copies already downloaded.

Cloudflare processes the application data, records and files needed to provide Overto. Google processes sign-in under its own privacy policy. Operational service providers may process request and security metadata as part of providing the service.

Company access follows membership and credential permissions. Connected agents can access information within the permissions you grant them; information you send to an agent is also subject to that agent provider's practices. The service operator may access data where needed to operate the service, respond to support requests or investigate abuse. Storage encryption and HTTPS do not make this an end-to-end encrypted service.

Retention and requests

Account and company records are retained while needed to run the service. Archiving content is not the same as permanently deleting it. This beta does not yet provide a complete self-service company/account deletion flow. Contact galelmalah@gmail.com to request access, correction or deletion of your data; backup and operational copies may take additional time to remove.

This notice will be updated when data practices change. Contact galelmalah@gmail.com with privacy questions.