Privacy Policy for Web Collab

Last Updated: August 3, 2026

This Privacy Policy describes how The Galway Group, LLC ("we," "us," or "our") collects, uses, and discloses your information when you use the Web Collab browser extension and its supporting services, including the My CTO portal API (collectively, the "Services"). Your privacy is important to us, and we are committed to protecting your personal information.

Please read this Privacy Policy carefully to understand our practices regarding your personal information and how we will treat it. By accessing or using the Services, you agree to this Privacy Policy.

1. Information We Collect

1.1 Information You Provide to Us

• Account Information: When you sign in, we collect your name and email address — either from your Microsoft work account (with your consent, via Microsoft's sign-in service) or the email address you verify with a sign-in code.
• Change Requests: When you submit a change request on one of your in-development websites, we collect the comment you write, the address of the page you were viewing, a technical identifier of the element you selected, and a screenshot of that element. This content is created deliberately by you and is submitted only when you press Submit.
• Communications: Information you provide when you contact us or otherwise communicate with us.

1.2 Information We Collect Automatically

• Session Information: A signed session token is stored in your browser so you stay signed in.
• Server Logs: Like most web services, our servers record standard technical information about requests, such as IP address and time of access.

The extension does not track your browsing, collect analytics, log your keystrokes, or read any page content other than the element you deliberately select when submitting a change request. It is active only on your own in-development websites served through our tunneling infrastructure.

1.3 Information from Third Parties

• Microsoft: If you sign in with Microsoft, we receive your name and email address from your Microsoft account profile. We never receive your password.
• Our Business Records: We use our own customer records (Microsoft Dataverse) to determine which client accounts you are authorized to access.

2. How We Use Your Information

2.1 Provide and Improve Our Services

• Authenticate you and determine which client accounts and development servers you may access
• File your change requests as tracked tasks with your development team
• Attribute your requests to you so the team can follow up
• Develop, improve, and optimize the Services

2.2 Communicate with You

• Send you sign-in verification codes and confirmations of the requests you submit
• Respond to your inquiries and provide support
• Send you technical notices, updates, security alerts, and administrative messages

2.3 Ensure Security and Legal Compliance

• Protect the security and integrity of the Services
• Detect, prevent, and address technical issues, unauthorized access, and fraudulent activity
• Comply with legal obligations and enforce our legal rights

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

3.1 Third-Party Service Providers

We share information with vendors and service providers who perform services on our behalf, including:

• Microsoft (identity sign-in, cloud hosting, and our business records platform)
• Cloudflare (the tunneling infrastructure that serves your in-development websites)
• Email delivery providers (sign-in codes and confirmations)

These service providers are only permitted to use your information as necessary to provide their services to us.

3.2 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of our assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

3.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests from public authorities. We may also disclose your information to enforce our agreements, protect and defend our rights or property, prevent or investigate possible wrongdoing, protect the personal safety of users or the public, or protect against legal liability.

3.4 With Your Consent

We may share your information with third parties when you have given us your consent to do so.

4. Data Retention

We retain your information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Change requests are retained as part of your client account's project records for the duration of our business relationship. When we no longer need your information, we will delete or anonymize it in accordance with our data retention policies and applicable law.

5. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information, including the right to access, correct, delete, restrict, or object to the processing of your personal information, and to receive a portable copy of it. To exercise these rights, please contact us using the contact information at the end of this Privacy Policy. We may ask you to verify your identity before responding to such requests.

6. Data Security

We have implemented appropriate technical and organizational measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure — including encrypted connections throughout, signed session tokens, and server-side authorization checks on every request. However, no data transmission over the Internet or information storage technology can be guaranteed to be 100% secure, and we cannot guarantee or warrant the security of any information you transmit to us.

7. International Data Transfers

Your information may be transferred to, and maintained on, computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction. If you are located outside the United States and choose to provide information to us, please note that we transfer the data to the United States and process it there.

8. Children's Privacy

Our Services are not intended for children under the age of 18, and we do not knowingly collect personal information from children under 18. If we learn we have collected or received personal information from a child under 18, we will delete that information. If you believe we might have any information from or about a child under 18, please contact us at the email address listed below.

9. Third-Party Links and Services

The Services may contain links to other websites, products, or services that we do not own or operate — including the in-development websites you preview, which are your own or your company's. We are not responsible for the privacy practices of these third parties.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes to how we treat your personal information, we will notify you through a notice on our website or by email prior to the change becoming effective. The date the Privacy Policy was last revised is identified at the top of the page.

11. State-Specific Privacy Rights

11.1 California Residents

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information we collect, use, and disclose about you; the right to delete personal information we collect or maintain about you; the right to opt out of the sale of personal information (we do not sell personal information); the right to non-discrimination for exercising any of these rights; and the right to limit the use and disclosure of sensitive personal information.

11.2 Virginia, Colorado, Connecticut, and Utah Residents

Residents of these states have similar rights under their respective state privacy laws, including the right to confirm whether we are processing your personal data, access it, correct inaccuracies, delete it, obtain a portable copy, and opt out of processing for targeted advertising, sale, or profiling.

12. Financial Incentive Program

We do not offer any financial incentives in exchange for the collection, use, or sharing of your personal information.

13. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at:

Email: hello@galway.group

BY USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ THIS PRIVACY POLICY, UNDERSTAND IT, AND AGREE TO ITS TERMS.