Privacy Policy — GoValidate.ai

Data Quality, Reconcile, and Editor process CSV, Excel, and JSON files in your browser. Validation Lock is hosted, and this policy names what we store for it.

  • Privacy Policy
Last Updated: October 3, 2026

Data Controller

GoValidate.ai is operated by GoValidate LLC, a New York limited liability company ("we," "us," or "our"). For privacy inquiries, contact us at support@govalidate.ai.

1. Browser-Based File Processing

Data Quality, Reconcile, and Editor are browser-first. When you load CSV, Excel, or JSON files into those tools, file checks run on your device. The raw file contents and cell values processed by those tools are not uploaded to our servers or stored on our infrastructure.

Validation Lock is hosted. Each comparison makes read-only requests for one Power BI number and one number from a warehouse you connect. We do not copy your warehouse tables into our database. We store the compared values and bounded check metadata described below, not sample mismatch rows.

2. Data We Process on Our Servers

For the three browser tools, raw file contents are processed locally. Our servers still receive and store the metadata and account or service records listed here:

  • File and Reconcile Metadata: Validation requests can include the original file name and selected column labels, file type and size metadata, a 32-bit FNV-1a hash of the normalized file name, a SHA-256 digest of the first 64 KiB when browser cryptography is available, and security indicators such as macro-scan results for Excel files. Reconcile requests also include a user ID when signed in, an anonymous token, the selected comparison mode, and normalization settings. Security-event requests can include a file name; the server logs a hash of the file name. These fields support validation, security checks, and usage limits. Raw file contents and cell values are not sent in these metadata requests.
  • Authentication & Identity Data: If you register or authenticate, we process your user credentials, email addresses, and secure authentication tokens. For anonymous sessions, a cryptographically signed anonymous identity token is processed.
  • Data Sets Digest Subscriptions: If you sign up for the Federal Contracts weekly digest, we store your email address, the page you submitted it from, your selected subscriptions, and signup, confirmation, and unsubscribe timestamps. A salted SHA-256 hash of your email is used as the row key; the email address is also stored in the subscription record. We send the digest only to confirmed addresses, and every issue carries an unsubscribe link.
  • Request and Security Logs: Request logs can include hashed IP and user identifiers. Security event records can include the event type and source, file extension, timestamp, a hash of the file name, and primitive detail values supplied by the client. String values in those details are not redacted by the event endpoint.
  • Validation Lock connection metadata: The name and type of a connection, its status, and, for Power BI, the workspace, model, and dataset identifiers. This record does not contain the secret.
  • Credential references: A reference to a credential. For connections that use a stored secret, the secret is kept in Microsoft Azure Key Vault, not in the database or browser. Deleting a connection marks its row deleted and keeps its name. A stored secret is deleted and purge is attempted when no connection still references it; if the vault blocks purge, it stays soft-deleted until the vault's retention period ends. A delegated sign-in that does not store a secret does not create one.
  • Lock definitions: The comparison you declared, including SQL or DAX query text, lineage mappings with table and column names and DAX measure logic, free-text fields such as metric name, owner, business definition, and report context, manually entered values, and workspace, model, and dataset identifiers. A definition also has a summary of its latest 20 runs and its last and locked results.
  • Run history: Check status and time, compared values, definition and mapping hashes, and bounded comparison metadata. A run can include source hostnames only when the source-identity comparison reports a difference. This is not a copy of your warehouse tables or Power BI model, and it contains no sample mismatch rows.
  • Audit records: The actor identifier, action, outcome, reason, and time for audited Validation Lock actions, including connection changes and Lock deletion.
  • Run-replay records: A hashed marker for each run request, so a retried request returns the earlier result instead of reading your warehouse again. A finished marker becomes removable after 30 days and is removed the next time that Lock runs, or when the Lock is deleted.
  • Alert email addresses: We store the recipient email address, a hash of the adder email, the creator user ID, its confirmation time, and its summary-email preference. The welcome email shows the adder email address to the recipient. Most addresses require confirmation within 24 hours; eligible same-domain addresses can be confirmed immediately. Alerts identify the measure rather than the Lock name and can include compared values, which side moved, the result or reason, and evidence-strength details; weekly or biweekly summaries are optional. Removing an address deletes its recipient record, while send records can retain email hashes. Removal and settings links do not expire, and the settings page identifies the recipient address (partly masked). Unconfirmed addresses expire after 24 hours and are cleaned when another address is added or during the approximately six-hour watched-Lock sweep; there is no separate cleanup timer.
  • Watch records: Whether a Lock is watched, who enabled or disabled it, and operational history such as tick times and outcomes, run status and refusal or error codes, alert type, drift and error class, and weekly check and failure counts for the current and two prior weeks. These records are deleted with the Lock.
  • Billing records: Your Stripe customer and subscription IDs, payment records, and Watch plan status are stored in Azure Table Storage. Stripe processes payments and hosts Checkout; we do not store card numbers.

Validation Lock definitions, connection metadata, run history, audit records, and run-replay records are stored in PostgreSQL hosted by Supabase. The validation_lock_watch_entitlements table is also stored in PostgreSQL. Account and identity records, subscriptions, usage, analytics, rate-limit rows, Stripe indexes and payment records, and Lock demo verdicts are stored in Azure Table Storage. The account-erasure ledger is stored in Azure Table Storage and remains after account deletion. Stored connection secrets use Azure Key Vault. Microsoft Azure hosts the site and API. GitHub Actions builds and deploys the Service and runs scheduled Lock checks.

3. Legal Basis for Processing (GDPR)

Under the General Data Protection Regulation (GDPR), we process personal data on the following legal bases:

  • Contractual Necessity (Article 6(1)(b)): Authentication and identity data are processed as necessary to provide the Service to you.
  • Legitimate Interest (Article 6(1)(f)): File metadata, security logs, and IP address hashes are processed for our legitimate interests in security, fraud prevention, and rate limiting. Behavioral telemetry is processed for our legitimate interest in product improvement, subject to your right to object.
  • Consent (Article 6(1)(a)): Digest subscriptions are processed on your consent, given by confirming the link we email you, and withdrawable at any time through the unsubscribe link in any issue.
  • Legal Obligation (Article 6(1)(c)): We may process data when required to comply with applicable law, regulation, or legal process.

4. Behavioral Telemetry

We collect usage telemetry to improve the usability and performance of GoValidate.ai. Analytics events can contain the following data:

  • Event Data: Analytics events can include page paths, referral and campaign fields, page and interaction timing, device and browser categories, viewport dimensions, country, and interaction measurements. Data Sources page events may include a page slug. Product events can include coarse file-size, row, result, and issue counts and data-quality categories. Error codes are fixed machine codes, not messages. Events do not contain raw file rows, cell values, or column names. Events recorded before October 3, 2026 may include column names in error codes until they are deleted.
  • Identifiers and traffic tags: Events can include anonymous and session identifiers and, when available, a user identifier. Staff and agent events carry a traffic tag and are excluded from dashboard counts by default; the tag does not identify a person.
  • PII Redaction Guard: The ingestion filter drops an event when a field name contains a prohibited key pattern such as email, credit-card, SSN, password, or secret. It checks field names, not arbitrary text values.
  • Geo-Fenced Pointer Tracking: By default, ingestion drops sampled mouse-path events from the EU, UK, and EEA and when location is unknown. A configured region allowlist controls where this tracking is enabled.
  • Retention and PostHog: The intended retention targets are about 90 days for analytics events and hourly aggregates and 12 months for daily summaries. Automatic deletion is not yet switched on in production, so records may remain longer. Analytics are forwarded to PostHog only if PostHog forwarding is turned on.

5. Data Sharing & Service Providers

We do not sell, rent, or trade your personal data. Providers that process data for us include Google (Google Fonts; each page load sends your browser IP address to Google), Microsoft Azure (hosting, Azure Table Storage, and Key Vault), Microsoft Entra ID (sign-in), Microsoft Power BI and Fabric APIs (source reads), Supabase (PostgreSQL database hosting), Resend (email), GitHub Actions (builds, deployment, and scheduled Lock checks), and Stripe (payments and Checkout). Product analytics go to PostHog only if PostHog forwarding is turned on. A Lock also connects to Power BI, Fabric, and the warehouse you configure to retrieve the numbers you ask it to compare. We may also disclose data when required by law, regulation, or valid legal process.

6. Data Protection

We implement industry-standard security measures, including encryption in transit (HTTPS) and at rest for our server-side metadata and identity tables, to protect against unauthorized access or alteration.

7. Data Retention

The intended retention targets are about 90 days for analytics events and hourly aggregates, 12 months for daily summaries, and 730 days without activity for account identity records. Automatic deletion is not yet switched on in production, so records may remain longer. AnalyticsStitching records that connect anonymous IDs to user IDs have no defined retention period or automatic, time-based cleanup. Request and security logs have no fixed retention period stated here. Federal Contracts digest records remain after unsubscribe so we can honor the opt-out; they include the email address, and we do not currently set an automatic expiration for them.

Each Lock keeps a summary of its latest 20 runs until the Lock is deleted. Detailed run records are capped at the newest 100 per Lock, and records older than 30 days are removed the next time that Lock runs. A finished run-replay marker becomes removable after 30 days and is removed on the next Lock run or when the Lock is deleted. Deleting a Lock removes its definition, run evidence, replay records, and watch record. Audit records and deleted-connection names remain after the Lock or connection is deleted until a separate tenant cleanup removes them; no automatic retention period is set. Account deletion removes Validation Lock records and stored credentials only when you are the workspace's last member; deleted credentials stay recoverable in our key vault until its retention period ends.

Confirmed alert recipient records are kept until the address is removed. An unconfirmed address expires after 24 hours and is removed when another address is added or during the approximately six-hour watched-Lock sweep; there is no separate expiration timer. Separate hashed confirmation-send records may be pruned when another alert recipient is added; there is no automatic deletion path for hashed summary-send records. Removal and settings links do not expire, and the settings page identifies the recipient address (partly masked). Deleting a connection marks its row deleted and keeps its name. When a stored secret has no remaining connection reference, we delete it and attempt to purge it. If the vault blocks purge, it remains soft-deleted until the vault's retention period ends.

8. Cookies and Analytics Tools

Azure Static Web Apps sets the sign-in session cookie. The operator analytics dashboard uses the gv_analytics_session cookie only for staff dashboard sessions. Our anti-CSRF check validates the Origin header; we do not set a CSRF cookie. Stripe Checkout may set Stripe cookies, and Google Fonts is loaded from Google. Product analytics are forwarded to PostHog only if PostHog forwarding is turned on. See our Cookie Policy for more detail.

9. Your Rights

We comply with applicable global privacy frameworks, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). You have the following rights regarding your personal data:

  • Right to Access & Portability: You have the right to request a copy of the personal metadata we store about your account.
  • Right to Rectification: You have the right to request correction of inaccurate personal data we hold about you.
  • Right to Deletion: The self-service delete control removes your account and sign-in records, subscriptions, usage, payment records, and analytics events linked to your account, including events from before you signed in on the same browser. If you are the last member of your Validation Lock workspace, it also removes that workspace's Locks, connections and stored credentials. It keeps one record that the deletion happened (internal identifiers only). Some records can remain, including aggregate analytics, request and security logs, rate-limit rows, Federal Contracts digest records, and Validation Lock data in a workspace that another sign-in or account still uses. Email support@govalidate.ai to remove anything that remains.
  • Right to Object & Restrict Processing: You have the right to object to our processing of your data based on legitimate interest (including behavioral telemetry). You may also request that we restrict the processing of your data in certain circumstances.
  • No Sale of Data: GoValidate.ai does not sell your personal data to third parties as defined under the CCPA/CPRA.

To exercise any of these rights, use the compliance controls below or contact us at support@govalidate.ai.

10. Privacy Controls & Data Apparatus

Use the controls below to retrieve or request deletion of personal metadata associated with this account. After the server confirms the deletion request, the browser control clears its fv_* keys, val_anon_id, and session keys.

Detecting local browser identity...

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this policy periodically.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at support@govalidate.ai.