Privacy policy.

This policy explains what personal data OAKMONT collects, how we use it, and the choices you have. It is written to be readable. If anything is unclear, ask us.

Who we are

The data controller is Oakmont Technologies LLC, 5511 Parkcrest Dr. Suite 103, Austin, TX 78731, USA.
For any privacy matter, use the contact options at the bottom of this page.

What we collect

Account data: your name, work email, organisation and authentication details.
Work content: the briefs, files, pages and documents you submit for us to build or remediate.
Usage data: requests, job and ticket history, and basic technical logs needed to run the service.
Billing data: handled by our payment processor (Stripe). We never store full card numbers.

How we use it

To deliver the work you request, operate your account and provide support.
To improve quality. Edits and corrections may become training examples for our internal models; we work to exclude personal data from those examples.
To meet legal, accounting and security obligations.

Legal bases (GDPR)

Contract: delivering the work and services you order.
Legitimate interests: securing the service, improving quality, and following up on a report you requested.
Legal obligation: tax, accounting and similar duties.
Consent: marketing email and anything else we explicitly ask for. EU users can object to legitimate-interest processing or withdraw consent at any time.

Cookies, analytics and advertising

Essential cookies keep you signed in and remember your language. They cannot be switched off without breaking the service.
Product analytics is self-hosted (Umami) on our own servers. It is cookieless, stores no identifier for you personally, and is never shared or sold.
Behaviour analytics: where you allow it, we use PostHog (PostHog, Inc., USA) on our public pages. It sets its own cookie and records the pages you open, what you click, and a replay of your visit with form fields hidden, tied to a random identifier kept in this browser and to your sign-ups and purchases. We do not send it your name or email address, it does not run inside the signed-in consoles, and withdrawing consent stops it. Replays are kept for 30 days.
Advertising: where you allow it, we load the Meta pixel (Meta Platforms Ireland Ltd.) and report conversions to Meta's Conversions API. This sets the _fbp cookie in your browser and sends Meta a hashed version of your email address, a random identifier kept in this browser, the page you were on and the action you took, and, when you ask for a trial call, a hashed version of the phone number you gave, so campaigns can be measured and audiences built. Hashed versions of an email address or phone number you give us in a form are kept in this browser for up to 90 days and sent with the events that follow, along with a hashed country code taken from your connection, and withdrawing consent deletes them.
Inside the EEA, the UK and Switzerland nothing is sent to Meta until you accept. Elsewhere you can still refuse. Your answer is stored in this browser and you can change it at any time from the control at the bottom of this page.
Meta is a joint controller for the advertising data it receives, processes it in the United States, and we rely on the EU standard contractual clauses plus the EU-US Data Privacy Framework for that transfer.
Technical logs include IP addresses for security and are rotated.

Free tools & leads

The free scanner and health check store the URL you submit and the scan result.
If you enter an email to receive a report, we store it as a lead and use it to send that report and relevant follow-up.
The trial call on the Care page: we call the number you give and keep it, with the language and how you found us, as a lead, so we can follow up on your request. We keep it until you ask us to delete it. If you ask for the link by text, we send that one message and no other. If you ask for a person to call you back, we also keep your name if you give it. Mobile numbers and SMS consent are never shared with third parties or affiliates for marketing purposes.
Ask us and we delete it.

Who we share it with

We do not sell personal data.
Payments: Stripe Payments Europe Ltd. (Ireland). Card data never reaches our servers.
Calls and text messages: Twilio Inc. (United States) carries the phone calls and texts we send.
Hosting: dedicated servers in the EU. Application data, scans and deliverables stay there.
Email delivery: our transactional email provider, for verification, password resets, job updates and, where you asked for them, product emails.
Advertising: Meta Platforms Ireland Ltd., only where you have allowed it (see the section above).
Behaviour analytics: PostHog, Inc. (USA), only where you have allowed it (see the section above).
Error and uptime monitoring runs on our own infrastructure; session recording and heatmaps run only through the consent-gated PostHog described above, and no ad-network code runs beyond the consent-gated Meta pixel.
We disclose data when the law or a competent authority requires it, and where needed to protect our rights, our users or the integrity of the service.
Self-hosted deployments keep your data inside your own environment.

How long we keep it, and your rights

Account and organisation data: for as long as the account is active, then anonymized 30 days after a deletion request.
Work content (briefs, files, deliverables): for the life of the account, so you can re-download it; deleted with the account.
Free scans and health checks: 24 months, so a re-scan can be compared against the first one. Ask and we delete yours sooner.
Leads from the free tools and the contact form: 24 months from the last contact.
Invoices and tax records: 10 years, because accounting law requires it. This survives account deletion.
Security and access logs: 90 days.
You may request access, correction, export, restriction, or deletion of your personal data, and object to processing based on legitimate interests.
We support data-processing agreements (DPAs) for enterprise customers.
If you are in the EU, you may lodge a complaint with your local data protection authority.

Export & deletion (self-serve)

Export: from your portal Settings, download a ZIP of your account and organisation data at any time.
Deletion: from portal Settings, request account deletion. It takes effect after a 30-day grace period, and we email a link to undo it in the meantime.
After the grace period your personal data is permanently anonymized. Finalized invoices are retained for legal and tax obligations.

Text messages (SMS)

When you give us a mobile number and ask us to call or text you, for example with the call-back box on the Care page, or when a Care customer lists you as a family contact, we use that number only for the messages you asked for: answers about your request and, for family contacts, alerts when a daily call goes unanswered.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information may be shared with subcontractors that support the service, such as our telephony provider and customer service. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
Message frequency varies with your request. Message and data rates may apply. Reply STOP to any message to stop receiving them, or HELP for help.

Contact

Questions or a data request? Contact us or email admin@oakmonttechnologies.com.

This is a general policy and not legal advice; enterprise agreements may add specific terms.

Questions

Something here that does not fit your case?

Write to us and a person answers. We would rather change a clause than argue about one.

Write to us How we handle security