DRAFT — needs lawyer review. Not in effect. Placeholders in [brackets].

Privacy Policy

Last updated: [date] · Controller: [legal entity name]

What we collect

• Contact data: your email address when you request a Vibe Check, buy a service or subscribe to the newsletter.
• Scan inputs: the URL you submit, and for paid services the repository or files you share.
• Scan results: findings, which can include fragments of exposed secrets. We store these redacted where possible.
• Payment data: processed by our payment provider [Stripe]; we do not store card numbers.
• Basic analytics: [TBD: privacy-friendly, cookieless analytics or none].

How we use it

To run scans, deliver reports and fixes, send the newsletter you asked for, and improve our scanners. We do not sell personal data.

Processors

[TBD at launch: hosting (e.g. Vercel), email/newsletter provider, payment provider, AI model provider used to draft report text. Code snippets sent to an AI provider would be covered by that provider's API data terms.]

Retention

Repository copies: deleted within [30] days of delivery. Reports: kept [12 months] so you can download them again. Newsletter: until you unsubscribe.

Your rights

You can request access, correction or deletion of your data at [contact TBD]. [GDPR/CCPA sections to be added by counsel.]