Privacy Policy

1. Data Controller

2. Data We Collect

• Account information: Email, display name, GitHub profile (via OAuth).
• Billing information: Processed by Stripe. We do not store card numbers.
• Usage metadata: Scan frequency, rule execution, feature usage, health scores.
• Technical data: IP address, browser type, device info, pages visited.
• Communications: Support requests, feedback, and correspondence.

3. Code and Repository Data

Source code is processed in ephemeral Docker sandboxes and destroyed immediately after scan completion. Your code is never stored at rest. Repository metadata (names, branches, file paths) may be retained in scan reports. In Governance Layer mode, code stays local — we only receive health scores and rule metadata.

4. Legal Basis (GDPR Art. 6)

• Contract (Art. 6(1)(b)): Account management, service delivery, billing.
• Legitimate Interests (Art. 6(1)(f)): Service improvement, abuse detection, security.
• Consent (Art. 6(1)(a)): Analytics (PostHog, opt-in only).
• Legal Obligation (Art. 6(1)(c)): Tax records, regulatory compliance.

5. How We Use Your Data

• Provide the Service (scans, reports, Pull Requests, dashboard).
• Process billing and send transactional notifications.
• Detect and prevent abuse and security incidents.
• Improve the Service and develop new features.
• Comply with legal obligations.

We do not sell your personal data.

6. LLM Sub-processors

Managed providers: Anthropic (Claude API) and Google (Gemini via Vertex AI), both with contractual no-training guarantees. OpenAI and Azure OpenAI are blocked.

BYOLLM (Enterprise): Customer-supplied providers are Customer's responsibility.

7. Sub-processors

• Vercel — Web hosting
• Railway — Application hosting
• Supabase — Database, auth, storage
• Anthropic — LLM (managed mode, zero retention)
• Google Cloud — LLM (Vertex AI, zero retention)
• Stripe — Payment processing
• Resend — Transactional email
• GitHub — Repository access, OAuth
• Inngest — Background jobs
• PostHog — Analytics (consent-gated)
• Upstash — Rate limiting
• Sentry — Error monitoring (PII scrubbed)

8. International Transfers

Data is transferred to the US under Standard Contractual Clauses (2021/914) with supplementary measures (encryption, access controls). Request SCC copies from privacy@govnu.dev.

9. Data Retention

• Account data: active account + 30-day grace → crypto shred.
• Billing records: active + 7 years (legal obligation).
• Source code: ephemeral (scan duration only).
• Server logs: 90 days rolling.

Request immediate deletion via data settings or privacy@govnu.dev.

10. Your Rights (GDPR)

• Access — request a copy of your data
• Rectification — correct inaccurate data
• Erasure — right to be forgotten
• Restriction — limit processing
• Portability — receive data in machine-readable format
• Object — object to legitimate interest processing
• Withdraw Consent — for consent-based processing
• Lodge Complaint — with your supervisory authority

Exercise via account settings or privacy@govnu.dev. Response within 30 days.

11. Your Rights (CCPA/CPRA)

California residents: right to know, delete, correct, opt-out of sale (we don't sell), and non-discrimination. Exercise via account settings or privacy@govnu.dev.

12. Children's Privacy

Not directed to children under 13. No knowing collection per COPPA.

13. Automated Decision-Making

AI outputs are advisory and require human review. No legal effects on data subjects. Billing decisions based on objective criteria, contestable via support@govnu.dev.

14. Security

AES-256 encryption at rest, TLS 1.2+ in transit, Row Level Security, ephemeral sandboxes, RBAC, MFA for production, PII scrubbing, audit logging.

15. Breach Notification

Supervisory authority notified within 72 hours (GDPR Art. 33). Affected data subjects notified where high risk (Art. 34). Customers per DPA.

16. Changes to This Policy

30 days' notice for material changes via email and Site. Continued use = acceptance.

17. Contact