Privacy Policy

1. Information We Collect

We collect only what we need to operate the Service:

• Source code you submit. Uploaded files and repository source are processed to generate your report and transmitted to our AI analysis provider. Repository files are fetched from an immutable Git commit during processing and are not saved as source files in our database.
• Repository job data. For repository scans, we temporarily retain encrypted repository job context, encrypted partial findings, and the encrypted final report so the scan can survive restarts and the report can be recovered in the purchasing browser. Findings and reports may contain small source-code evidence excerpts. This encrypted data expires after 24 hours.
• Payment information. When you buy a scan, payment is handled by a third-party payment processor. We do not collect or store your full card number or payment credentials. We retain only a limited, non-identifying record needed to confirm your purchase.
• Email address. If you join our waitlist or beta list, we collect the email address you provide.
• Technical and usage data. We collect limited technical information, such as your IP address and request metadata, to operate, secure, and protect the Service. We use bot-detection and anti-abuse technology to distinguish human visitors from automated traffic.
• Cookies. We use a strictly necessary cookie to grant access to a paid scan after payment. We do not use advertising or cross-site tracking cookies.

2. How We Use Information

We use the information we collect to: provide and operate the Service; generate your scan report; verify payments and prevent unauthorized or abusive use; detect and prevent fraud, abuse, and denial-of-service; send you updates about the beta or waitlist if you signed up; maintain the security and integrity of the Service; and comply with legal obligations.

3. How Your Code Is Processed; AI Providers

To generate your report, the code you submit is transmitted to and processed by a third-party artificial intelligence provider that performs the analysis. Your code is sent to that provider solely to produce your report.

We do not use your submitted code to train our own models. Uploaded source and multi-file reports are not stored. Repository files are not saved, while encrypted repository findings and reports, including any evidence excerpts they contain, are retained for no more than 24 hours. The AI provider handles data it receives under its own terms and privacy practices, which we encourage you to review.

4. Service Providers We Share With

We share limited information with service providers that help us operate the Service, and we require them to protect that information and use it only on our behalf. We do not sell your personal information. These providers fall into categories such as:

• Payment processing providers.
• Artificial intelligence analysis providers, as described above.
• Cloud hosting, storage, and infrastructure providers.
• Security, bot-detection, and anti-abuse providers.
• Communication and email delivery providers.

5. Data Retention

We keep information only as long as needed for the purposes described in this policy:

• Uploaded source and repository files are processed transiently and are not saved as source files in our database.
• Multi-file reports are returned to the active browser session and are not retained by VibeCheck.
• Encrypted repository job context, findings, and reports, including source-code evidence excerpts in those reports, expire 24 hours after the repository scan completes or fails.
• Limited transaction records are retained to confirm purchases and to handle refunds or disputes.
• Waitlist email addresses are retained until you unsubscribe or ask us to delete them.
• Abuse-prevention and security records are retained for a limited period and then expire.

6. Your Choices and Rights

You may unsubscribe from waitlist emails at any time using the link in the email or by contacting us. Depending on where you live, you may have rights to access, correct, or delete the personal information we hold about you, or to object to certain processing.

To exercise these rights, contact us using the information at the bottom of this policy. Submitted source is not stored. Temporary encrypted repository reports expire automatically after 24 hours.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including encryption in transit and access controls. No method of transmission over the internet or method of storage is completely secure, and we cannot guarantee absolute security.

8. Children Under 18

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

9. International Users

The Service is operated from the United States. If you access the Service from outside the United States, you understand and consent that your information will be processed in the United States, where data protection laws may differ from those in your country.

10. Do Not Sell My Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page. Your continued use of the Service after an update becomes effective constitutes acceptance of the updated policy.

12. Governing Law

This Privacy Policy and any dispute relating to it are governed by the laws of the State of Texas, without regard to its conflict of laws rules.

13. Contact

For privacy questions or requests, contact us at hello@getvibescan.com or through getvibescan.com.