AUTH.OVH Privacy Policy
This policy describes how AUTH.OVH collects, uses, and shares personal data when you sign in with Google or Facebook. Site rules are in the Terms of Service.
Effective date: 21 September 2026. Operator: Eralgo sp. z o.o., Kłudzice 9, 97-330 Sulejów, Poland, KRS 0001064743. Contact: contact@auth.ovh.
What AUTH.OVH is
AUTH.OVH is a single sign-on service. It is not a social app, marketplace, or content site. When you click “Login with Google” or “Login with Facebook” on a partner website, AUTH.OVH handles the provider login and returns you to that partner signed in. Partner sites include websites operated with this service (for example Circoola and weaving.studio properties). AUTH.OVH only runs after you start login on such a site.
What personal data we collect
From Google
We request the OpenID and email scopes only. Google then provides a stable
account identifier (google_user_id) and your email address. If
Google also includes a display name or profile picture in that user-info
response, we may receive those fields as well. We do not request access to
Gmail, Google Drive, Contacts, Calendar, or any other Google content.
From Facebook
We request the email permission. Facebook provides a stable account identifier
(facebook_user_id) and your email address.
Collected automatically
Standard web logs: IP address, browser user agent, date and time of the login attempt, and the partner site you are returning to. We use these to complete the login, prevent abuse, and diagnose errors.
How we use the data
We use this data only to:
- verify that you control the Google or Facebook account you signed in with;
- find or create your user record on the partner site you started from (matched by email and/or provider user id);
- complete the redirect back to that partner site;
- prevent fraud and debug failed logins.
We do not use Google or Facebook account data for advertising, analytics products sold to third parties, credit decisions, or any purpose unrelated to signing you in.
Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide or improve the user-facing sign-in feature, and is not transferred except as needed to complete that sign-in on the partner site you chose.
Who we share it with
We share your email address and provider user id with the partner website that sent you to AUTH.OVH, so that site can sign you in. That sharing is the point of the service. Each partner site is a separate controller for the account it then keeps; its own privacy policy applies to what it does after login.
We do not sell personal data. We do not rent it. We do not share it with advertisers.
We may disclose data if required by law, or to protect AUTH.OVH, our users, or others from fraud or security threats.
Infrastructure providers that host AUTH.OVH (servers, logs, backups) may process the data as processors on our instructions.
Retention
The partner site keeps the account it created (email and provider user id) until that account is deleted. AUTH.OVH itself does not keep a separate marketing profile. Transient OAuth tokens are used to finish the login and are not stored as a long-lived Google or Facebook session on AUTH.OVH.
How to access or delete your data
Email contact@auth.ovh from the address you signed in with. Include “AUTH.OVH data request” and whether you want access or deletion. We will confirm within 7 days and complete deletion within 14 days, unless a legal duty requires us to keep a record.
Deleting the AUTH.OVH-mediated login does not automatically delete content you created on a partner site. Ask that site as well if you want its copy of your account removed.
You may also revoke AUTH.OVH’s access to your Google account at Google Account permissions.
Your rights (GDPR)
If you are in the EEA or UK you may request access, rectification, erasure, restriction, portability, and objection, and you may lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland or your local supervisory authority. The legal bases we rely on are performance of the sign-in you requested (contract) and, where needed, legitimate interests in securing the login.
Children
AUTH.OVH is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has signed in through AUTH.OVH, contact us and we will delete the data.
Cookies
AUTH.OVH uses a session cookie as needed to complete the OAuth redirect. Partner sites may set their own cookies after you return. We do not use advertising cookies.
Changes
If we change this policy in a material way, we will post the update on this page with a new effective date. Continued use of AUTH.OVH sign-in after that date means you accept the updated policy.
Contact
Eralgo sp. z o.o.
Kłudzice 9, 97-330 Sulejów, Poland
KRS 0001064743
contact@auth.ovh
This policy is governed by Polish law, without prejudice to mandatory consumer-protection rules of your country of residence.