Privacy Policy

Last Updated: July 24, 2026

Obligata, LLC, a Florida limited liability company ("Obligata," "we," "us," or "our"), respects your privacy and is committed to protecting the personal data of our website visitors and platform users ("you"). This Privacy Policy explains how we collect, use, disclose, and protect your information when you visit obligata.com (the "Site") and use our compliance orchestration platform (the "Services").

Obligata operates as a trust-first orchestration layer. We do not ingest, store, or process your raw database credentials, source code repository contents, or private internal communication histories. We collect only the metadata necessary to verify compliance triggers and coordinate waitlist notifications.

1. Information We Collect

We collect information that you voluntarily provide to us and information collected automatically through your interaction with the Site:

  • Personal Data Provided by You:
    • Waitlist Enrollment: When you sign up for early access, we collect your business email address.
    • Authentication: If you choose to log in using Google Cloud Identity or other OAuth providers, we receive basic identity information such as your name, email address, profile photo, and unique provider identifier.
  • Usage & Device Metadata (Collected Automatically):
    • When you visit the Site, we automatically collect basic browser information, device type, operating system, internet service provider, IP address, and anonymized referral links to monitor performance, optimize layouts, and secure our systems.
    • We also collect metadata about your interaction with compliance simulations and triaging widgets (such as button clicks on demo tools) to improve our user experience.
    • Analytics (opt-in only): If — and only if — you accept analytics cookies via our consent banner, we use Google Analytics to collect aggregated usage statistics. No analytics cookies are set unless you opt in, and you can withdraw consent at any time via the "cookie preferences" link in the footer. See our Cookie Policy for the specific cookies involved.

2. How We Use Your Information

We use the collected information for the following business purposes:

  • To Provide and Maintain the Services: To coordinate waitlist onboarding, authenticate your session, and render simulator widgets.
  • To Communicate with You: To send you updates, early access invitations, security alerts, and support messages.
  • To Improve Our Services: To analyze usage patterns, diagnose technical issues, and refine the interface design.
  • For Compliance and Security: To prevent fraud, verify authorization, and enforce our Terms of Use.

3. Legal Basis for Processing (GDPR/UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), our legal basis for collecting and using your personal data depends on the data context:

  • Performance of a Contract: To fulfill our obligations under our Terms of Use (e.g., providing access to waitlist features).
  • Consent: Where you have explicitly opted in (e.g., submitting your email to join the waitlist).
  • Legitimate Interests: To protect our website from malicious behavior, monitor technical performance, and conduct anonymized analytics.

4. Data Sharing & Third-Party Integrations

We do not sell, rent, or trade your personal data. We share your information only under the following circumstances:

  • Service Providers: We may share data with reliable third-party vendors (such as cloud hosting providers, database services, and email dispatchers) who perform operations on our behalf and are bound by confidentiality agreements.
  • OAuth Providers (Google Cloud Identity): When you choose to authenticate using Google, your identity is verified directly by Google. Your credentials never touch our servers, and we only receive authorized profile metadata.
  • Legal Compliance: We may disclose your information if required to do so by law, court order, or government regulation, or to protect the safety, rights, or property of Obligata, our users, or the public.

5. Data Security & Retention

  • Security: We implement robust technical and organizational security measures, including HTTPS encryption, secure database architectures, and restricted access protocols to protect your data. However, no electronic transmission or storage is 100% secure.
  • Retention: We retain your waitlist information until you request deletion or until we launch full service and transition accounts. Technical log data is kept only as long as necessary to fulfill security and performance verification purposes.

6. Your Data Protection Rights (GDPR & CCPA/CPRA)

Depending on your location, you may have the following rights regarding your personal data:

  • Right to Access: The right to request copies of your personal data.
  • Right to Rectification: The right to request correction of inaccurate data.
  • Right to Erasure: The right to request deletion of your personal data.
  • Right to Object / Restrict Processing: The right to limit how we process your information.
  • Right to Data Portability: The right to request transfer of your data to another organization.
  • Right to Opt-Out of Sale or Sharing: (California) Obligata does not sell your personal data or share it for cross-context behavioral advertising.
  • Right to Non-Discrimination: The right not to receive discriminatory treatment for exercising your privacy rights.

To exercise any of these rights, please contact our compliance team at privacy@obligata.com.

7. Children's Privacy

Our Site and Services are designed strictly for enterprise and commercial users. We do not knowingly collect personal data from children under 18. If we learn we have collected data from a child, we will delete it immediately.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices or regulatory changes. The updated version will be indicated by the "Last Updated" date.