Privacy policy

OMVION is a sole proprietorship operated by Axton McGoran in British Columbia, Canada. This policy explains what the site collects, why, how long it is kept, and what you can ask us to do about it. It is deliberately specific: everything below describes what the site actually does.

Who is responsible

The controller is Axton McGoran, trading as OMVION, British Columbia, Canada. For any question about this policy, or to make a privacy request, write to [email protected], our monitored contact for privacy matters.

What we collect, and only when you send it

OMVION runs two surfaces. The public site (this page) has no cookies, no tracking and no advertising. Studios that engage us also use a private onboarding portal, reached only by a one-time link we send you, where you confirm your details, sign agreements, upload your build and pay. This policy covers both. The commercial engagement itself is also governed by the mutual NDA and service agreement you sign; where those and this policy differ on the handling of your build or business information, the signed agreement governs.

On the public site, the only personal information we collect is what you type into the enquiry form and choose to send:

We do not ask for anything else and we do not enrich, append to or buy data about you.

Technical data recorded with each submission

Every field above is stored, in full, exactly as you typed it. Stored alongside it, so that we can tell a genuine enquiry from an abusive one:

A short-lived counter keyed to your IP address is also kept for ten minutes to enforce the rate limit. It expires on its own.

Why we are allowed to process it

Under the UK and EU GDPR, where those apply to you: our lawful basis is legitimate interests (Article 6(1)(f)) — responding to a business enquiry you initiated. Where a request is a step toward an agreement, pre-contractual steps (Article 6(1)(b)) also applies. Under Canadian law (PIPEDA and BC PIPA) your submission of the form is the consent, and the purpose is the one stated here.

We do not collect special category data and ask that you do not put any in the notes field.

What happens when you press Next

Pressing Next does two things, and neither waits on you booking a call.

1. Your details are sent to us. The form posts what you typed to our endpoint, which emails it to [email protected] and files a copy. This happens the moment you press Next, whether or not you go on to book a call.
2. A copy is stored. The filed copy is written to Cloudflare Workers KV, a storage service run by Cloudflare, Inc. acting as our processor, so that no enquiry is lost.

If you would rather not use the form, write to [email protected] directly instead.

Booking a call (optional)

After you press Next we show a booking calendar from Calendly (Calendly LLC), embedded on the page. If you choose to book, the name and email you entered are passed to Calendly to set up the meeting, and Calendly processes that booking under its own privacy policy. Booking is optional and changes nothing about the reply you get by email.

Saved in your own browser

As you type, the form is saved in your browser’s local storage so a half-finished enquiry is not lost if you leave and come back. That copy stays on your device, is never sent to us on its own, and you can clear it any time through your browser.

Stored enquiries are read only by Axton McGoran. The emailed copy lands in an OMVION mailbox hosted by Google Workspace, also a processor. Nobody else receives either copy. We do not sell personal information, we do not share it with advertisers, and we do not add you to a mailing list.

The site loads its typefaces from Google Fonts, which means your browser makes a request to Google and Google receives your IP address. If you would rather that did not happen, a content blocker will prevent it; the site remains readable.

The onboarding portal

If you engage us, we open a private onboarding portal for you, reached by a single-use link (valid up to 7 days) that we email you. There is no password for you to manage; the link is the key. In the portal we collect and store, in a database we host: the contact details you confirm (name, role, email, phone, studio website); additional studio contacts you add; your studio logo, banner and description, and the titles you are converting; an electronic signature you draw for the mutual NDA and the service agreement, stored as an image with the date and time of signing; and your quote, pricing band, licence key and engagement history. This data is read only by OMVION. Our lawful basis is performance of our contract with you (GDPR Article 6(1)(b) where it applies); under PIPEDA and BC PIPA, entering the engagement is the consent.

Information we read from your website

To set up your engagement we may fetch a single page of the studio website you give us and read publicly listed details — logo, description, and any contact email or phone shown there — so you do not have to retype them. We read only what you have already published publicly, use it only to service your engagement, and never scrape it for marketing. Tell us and we will remove any of it.

Your game source code

When you upload a build (a .zip of up to 20 GB per title) it is encrypted at rest using AES-256 with a key held only in our server-side vault, never in the browser or this site’s code. It is decrypted only momentarily, on our server, to read the project’s structure for your readiness report, and is never sent to any third party. Access is limited to OMVION personnel who need it. Your source and assets are held only for the purpose of your engagement and will be deleted or returned on your written request, with written certification on request, as set out in the mutual NDA.

Payments

Payments are taken through Stripe, which processes your card as an independent controller under its own privacy policy. OMVION never sees or stores your full card number. We keep only what Stripe returns to run the account: a payment reference, the amount, tax and currency, and whether it succeeded. Under the service agreement OMVION may, once per year on written notice, ask for reasonable evidence of a title’s declared budget to confirm the licence band; anything sent for that is kept confidential under the NDA.

Who else processes your data

We use these providers; each receives only what it needs, acts on our instructions as processor unless noted, and may store data outside Canada (including the US).

We do not sell personal information, share it with advertisers, or add you to a mailing list.

Where it goes

OMVION is in Canada; personal data is stored both with these providers and on OMVION’s own server in Canada. Google Workspace and Cloudflare both store data on servers that may be in the United States or elsewhere. For transfers out of the UK or EEA we rely on the European Commission’s adequacy decision for Canada in respect of PIPEDA-covered activity, and on our processor’s Standard Contractual Clauses. You can ask us for details of either.

How long we keep it

• Enquiries that do not become work: deleted within 24 months.
• Enquiries that become an engagement: kept for the life of the engagement and for 7 years afterwards, which is the Canadian records-retention period for business records.
• The stored copy of a submission, including the technical data above: the same periods as the two lines above, whichever applies.
• Portal and engagement records (confirmed contacts, signatures, payment references, event history): life of the engagement plus 7 years, the Canadian business-records period.
• Uploaded builds: deleted or returned on your written request, and not retained beyond what the engagement requires.
• Rate-limiting counters: 10 minutes, then automatically discarded.

Ask us to delete an enquiry sooner and we will, unless we are required to keep it.

Cookies and analytics

This site sets no cookies. There is no advertising pixel, no cross-site tracking and no script that builds a profile of you. That is why there is no cookie banner: there is nothing stored on your device to consent to.

The site does run Cloudflare Web Analytics, which counts page views and gives us aggregate figures such as which pages are read and roughly where readers are. It is cookieless and it does not fingerprint your device, does not track you between sites, and does not build a profile. What Cloudflare receives is the page URL, the referrer, your approximate location derived from your IP address, your browser and device type, and page timing. Cloudflare acts as our processor and does not use it to build a profile of you. Their own account of how it works is at cloudflare.com/web-analytics. A content blocker will stop it and the site works exactly the same without it.

The site stores one value in your browser’s sessionStorage: your scroll position, so a refresh returns you to the same place. It never leaves your device, we cannot read it, and it is discarded when you close the tab.

Your rights

You can ask us to give you a copy of what we hold, correct it, delete it, restrict what we do with it, or object to our processing. Where the UK or EU GDPR applies you also have the right to data portability and the right not to be subject to solely automated decisions — we make none. Write to [email protected] and we will answer within 30 days.

If you think we have got this wrong you can complain to a supervisory authority: the Office of the Privacy Commissioner of Canada, the BC Information and Privacy Commissioner, the UK ICO, or your own EU authority.

Security

Form submissions travel over TLS, both to your mail client and to our storage endpoint. The mailbox is protected by two-factor authentication. We publish a security contact at /.well-known/security.txt and will acknowledge a report within five working days.

Changes

If this policy changes materially we will change the date at the top. We do not have your contact details unless you have written to us, so we cannot notify you directly.