Privacy Policy
Effective date: March 22, 2026
1. Introduction
This Privacy Policy describes how Galeo ("Company", "we", "us") collects, uses, and protects personal information through the Galeo identity and access management platform ("Service"). We are committed to safeguarding the privacy of our customers, their end users, and visitors to our Service.
By using the Service, you acknowledge that you have read and understood this Privacy Policy.
2. Information We Collect
2.1 Account and Tenant Information
When you create a tenant (organization), we collect:
- Organization name and ID
- Administrator name, email address, and password
- Billing and contact information (if applicable)
2.2 End User Information
When tenant administrators provision users or users self-register, we process:
- Name, email address, and optional profile attributes
- Authentication credentials (securely hashed passwords, WebAuthn public keys, TOTP secrets)
- Role and group memberships
- Application access grants and consent records
2.3 Authentication and Security Data
To secure accounts and detect threats, we automatically collect:
- IP addresses and approximate geolocation at time of authentication
- Browser user agent and device identifiers
- Authentication method used (password, passkey, SSO, smart card, etc.)
- Login timestamps, session duration, and access log events
- Failed authentication attempts
2.4 Cookies and Session Data
We use strictly necessary cookies to maintain authenticated sessions and CSRF protection. We do not use advertising or third-party tracking cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| galeo_session | Authenticated session token | Session / configurable |
| galeo_csrf_* | Cross-site request forgery protection | 1 hour |
3. How We Use Information
We use personal information solely for the following purposes:
- Providing the Service: authenticating users, managing sessions, enforcing access policies, and processing OIDC/SAML/OAuth2 flows
- Security: detecting unauthorized access, preventing fraud, enforcing rate limits, and maintaining audit trails
- Administration: tenant management, user provisioning, role assignment, and policy configuration
- Communication: sending transactional emails (verification, password reset, security alerts) via Amazon SES
- Compliance: meeting legal obligations, responding to lawful requests, and maintaining required records
- Improvement: analyzing aggregate, anonymized usage patterns to improve Service reliability and features
4. Data Sharing and Disclosure
We do not sell personal information. We may share data in the following limited circumstances:
- With your tenant's connected applications: when a user authenticates via SSO, we share identity claims (e.g., name, email, roles) with the relying party application as configured by the tenant administrator
- With federated identity providers: when a user authenticates via Google, Microsoft, GitHub, LinkedIn, or other configured providers, authentication data is exchanged per the OIDC/SAML protocol
- Service providers: we use AWS infrastructure services (including SES for email delivery and S3 for tenant branding assets) that process data on our behalf under data processing agreements
- Legal requirements: we may disclose information when required by law, court order, or to protect the rights, safety, or property of the Company, our users, or the public
Your phone number and SMS opt-in data and consent will not be shared with any third parties. The phone number you provide for SMS-based account security is used only to deliver the verification codes you have requested.
5. Data Processing Role
For end user data submitted by tenant administrators, we act as a data processor on behalf of the tenant (the data controller). Tenants are responsible for establishing the legal basis for processing their users' data and for providing appropriate privacy notices to their end users.
For tenant administrator accounts and our direct business relationships, we act as a data controller.
6. Data Security
We implement comprehensive security measures including:
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Passwords hashed with bcrypt using appropriate cost factors
- WebAuthn credentials stored as public keys only (private keys never leave the user's device)
- TOTP secrets encrypted at rest
- Strict Content Security Policy (CSP) headers on all pages
- Regular security assessments and dependency scanning
- Role-based access controls and audit logging for administrative actions
7. Data Retention
We retain personal information for as long as necessary to provide the Service and fulfill the purposes described in this policy:
- Active accounts: data is retained while the tenant subscription is active
- After termination: Customer Data is available for export for 30 days, then securely deleted
- Audit logs: authentication and access logs are retained for up to 12 months for security purposes
- Legal holds: data may be retained longer if required by applicable law
8. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal information:
- Access: request a copy of the personal data we hold about you
- Correction: request correction of inaccurate or incomplete data
- Deletion: request deletion of your personal data, subject to legal retention requirements
- Portability: receive your data in a structured, machine-readable format
- Objection: object to certain processing activities
- Restriction: request limitation of processing in certain circumstances
End users should direct data rights requests to their tenant administrator in the first instance, as the tenant is the data controller. Tenant administrators can manage user data through the admin dashboard or contact us for assistance.
9. International Data Transfers
The Service is hosted on AWS infrastructure. Data may be processed in regions where AWS operates. Where data is transferred across borders, we rely on appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.
10. Children's Privacy
The Service is not directed to children under 16. We do not knowingly collect personal information from children. If you become aware that a child has provided personal data, please contact us so we can take appropriate action.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email to tenant administrators or a notice within the Service at least 30 days before they take effect. The effective date at the top of this page indicates when this policy was last revised.
12. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us:
- Email: privacy@getgaleo.com