Privacy and Data Handling

Last updated: {{TERMS_DATE}}

What we collect

• Contact details you give us: name, email, company, and messages.
• Payment details, handled by our payment provider. We never see or store your card number.
• Project access you grant: repository, live URL, and any service accounts.
• Basic site analytics, if enabled, without advertising trackers.

How we use it

Only to deliver and support the service you bought, to send you your report and invoices, and to reply to you. We don't sell personal data, and we don't send marketing emails unless you opt in.

How we handle your code and data

1. Least access. We ask for read-only access first and request write access only for agreed fixes.
2. Production data stays put. We don't copy your users' data out of your systems. If we must look at records to confirm a finding, we look at the minimum and don't keep them.
3. AI tools. We use AI-assisted tools to speed up review. They are configured so your code is not used for model training, and an engineer checks every finding before it reaches you.
4. Storage. Working copies live on encrypted devices and are deleted within 7 days of delivery. Reports are kept so we can support you later; ask and we'll delete them.
5. Secrets. If we find exposed keys, we tell you immediately and never use them beyond confirming the exposure.
6. Off-boarding. When the work ends, we confirm deletion and ask you to revoke our access.
7. NDA. Available on request before we receive any access.

Who else processes data

Our payment provider, our email provider, our scheduling tool, and the AI tooling described above. Each only receives what it needs to do its job.

Your rights

You can ask to see, correct or delete the personal data we hold about you. Email [email protected] and we'll respond within 30 days.