1. Scope and controller
This policy applies when you visit the Osandones website, use the homepage email handoff, create or use an account, or communicate with an Osandones email address. Product-specific processing beyond account access will be described before those features are made available.
Osandones is the public-facing name used for the processing described here. The full legal identity of the data controller has not been confirmed for publication and must be added before this policy is treated as final. Privacy inquiries may be sent to contact@osandones.com or to the correspondence address shown below.
2. Data we currently process
Depending on how you interact with the website, current processing may include:
- Email handoff data. An email address entered on the homepage is placed in the sign-in page URL so that it can be prefilled.
- Communications. If you email Osandones, we receive your address, message, signature details, and any information or attachments you choose to send.
- Technical and access data. Hosting and network providers may process IP address, request time, requested path, user agent, referrer, response status, and security-event information in standard operational logs.
- Business context. A message may include your name, company, role, intended use, and other professional information relevant to the inquiry.
- Account and authentication data. If you sign in, Neon Auth processes your email address, account identifier, provider details, verification state, session records, and security information needed to authenticate you. Google may provide basic profile information when you choose Google sign-in.
Enterprise SSO, payments, repository access, and software-rights transactions are not part of the current public application. We will update this policy before those features introduce additional processing.
3. Purposes and legal bases
We use the limited data described above to:
- display the email you chose to carry to the sign-in page;
- create accounts, authenticate users, maintain sessions, and prevent abuse;
- respond to invitation, product, legal, and other direct inquiries;
- operate, deliver, troubleshoot, and protect the website;
- detect abuse, investigate incidents, and maintain service integrity; and
- comply with law and establish, exercise, or defend legal claims.
Where Georgian data-protection law applies, the relevant grounds may include taking steps at your request, reviewing your application or inquiry, legitimate interests in operating and securing the website that do not override your rights, compliance with legal duties, and consent where we specifically request it.
Where the EU or UK GDPR applies, the corresponding bases may include steps requested before a contract, legitimate interests, legal obligations, and consent for a clearly identified optional purpose. We do not rely on consent where another basis is more appropriate, and we do not currently operate a marketing subscription through the website.
4. Email handoff and sign-in
The homepage uses a GET navigation to place the entered email in anemail query parameter. This means the address initially appears in the destination URL and may be included in hosting access logs and browser history. The sign-in page validates the value, uses it only to prefill the field, and removes the query string from the visible browser history after the page loads.
Removing the visible query does not erase a request already received by hosting or network systems. The sign-in page applies a no-referrer policy to reduce the risk of sending the query to another site. Do not use the field for secrets or information other than the business email you want displayed.
Email sign-in sends a one-time code through Neon Auth. Google sign-in redirects to Google for authentication and returns to Osandones after authorization. Osandones receives the account data needed to establish a session; it does not receive your Google password. Authentication uses secure HTTP-only cookies and server-validated sessions.
6. Retention
We do not state a fixed retention period that the current implementation cannot verify. Direct communications are kept only as long as reasonably needed to respond, maintain appropriate business records, resolve disputes, and meet legal obligations. Account and session data is retained while an account remains active and as needed for security, dispute resolution, and legal obligations. Technical logs are retained according to operational security needs and the applicable provider's configured retention. Final production retention schedules remain to be documented.
When data is no longer needed for a lawful purpose, it should be deleted, anonymized, or isolated from ordinary use. Backup and security copies may persist for a limited period before ordinary deletion cycles complete.
7. Security
We use and expect our providers to use technical and organizational measures proportionate to the limited data and risks involved. Current measures include server-side email validation, strict input limits, restricted authentication origins, OAuth state and callback validation through the authentication provider, secure session cookies, and reduced referrer disclosure on the sign-in route.
No website or transmission is completely secure. Please do not send credentials, private keys, payment-card data, sensitive personal data, or confidential source code through the public email handoff or an ordinary email message.
8. International transfers
Hosting, network, or email providers may process data outside Georgia or your country. Before final publication, Osandones must identify its production providers, data locations, and the transfer safeguards required by applicable law. Where the Georgian Law on Personal Data Protection applies, transfers must satisfy its legal basis and safeguards. Where the GDPR applies, an appropriate GDPR transfer mechanism must also be used when required.
9. Your rights
Depending on the law that applies, you may have rights to information and access, correction or completion, deletion or destruction, restriction or blocking, portability, withdrawal of consent, objection, and review of certain automated decisions. These rights may be limited where another lawful ground or legal duty requires processing.
Send a request to contact@osandones.com and identify the interaction and email address concerned. We may request proportionate information to verify the request. You may also complain to the competent supervisory authority. Under the current consolidated Georgian law, complaints may be made to the State Audit Office of Georgia or a competent court. If the GDPR applies, you may contact the supervisory authority in the relevant European jurisdiction.
The GDPR does not apply merely because a website can be viewed from Europe. Its territorial rules may apply if processing is connected to an EU establishment, an offer of goods or services to people in the EU, or monitoring their behavior there. The actual product markets and processing activities must be reviewed as Osandones develops.
11. Children
Osandones is intended for developers, organizations, and professional users, not children. We do not knowingly seek personal data from children through the current website. If you believe a child has provided personal data, contact contact@osandones.com so the matter can be reviewed.
12. Updates and contact
We may update this policy when the website, providers, authentication, product, or legal requirements change. The updated date will identify the current version. Material changes should be communicated by a reasonable additional method when required by law.
Privacy, legal, and general inquiries may be sent to contact@osandones.com. The Borjomi address below is a correspondence address and is not described as a registered office.