01 The TL;DR
This Privacy Policy describes how CyberDebunk ("we", "us") collects, uses, and shares personal data when you visit cyberdebunk.com or use the CyberDebunk product (the "Service"). It applies to all users worldwide and is written with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) in mind.
02 Who we are
The data controller responsible for processing your personal data is:
03 What we collect
We collect three categories of personal data, summarized in the table below.
| Category | Examples |
|---|---|
| Account data | Name, email, hashed password (if you use one), organization, role, timezone, profile photo, MFA enrolment, and when you sign in with Google or GitHub: which provider you used and a stable provider account ID (see OAuth sign-in below). |
| Usage data | Pages visited, features used, search queries inside the app, error logs, browser type, IP address (truncated), device type. Includes Google Analytics on the website and app shell when you opt in via our cookie banner (measurement ID G-5PJP8S8KJX); otherwise we do not load GA. No Meta Pixel or ad retargeting. |
| Service data | Repository & cloud metadata you connect (repo names, dependency manifests, IaC files, asset inventories), security findings we generate from it, comments and notes you write inside CyberDebunk. |
| Billing data | Company name, billing address, invoice history. Card details are handled by Stripe. We never see card numbers. |
What we do not collect: we do not read the source code of your repositories for dependency scanning. CyberDebunk only processes manifests (package.json, requirements.txt, lockfiles, IaC files) and configuration metadata for that purpose. We do not request commit content or diffs for dependency scans. We do not store your customer personal data in GitHub. Account and billing data live in our EU systems, not in GitHub repositories.
04 Sign-in with Google or GitHub
When you choose Sign in with Google or Sign in with GitHub on our login page:
- We redirect your browser to Google or GitHub so you can authenticate on their site.
- After you approve, they send us basic profile data: your verified email address, display name, profile photo URL, and a stable account ID from that provider.
- We store those fields on your CyberDebunk account so we can recognize you on future sign-ins and show your profile in the product.
- We use the provider access token once to fetch that profile, then discard it. We do not store Google or GitHub sign-in tokens.
Separate from repo scanning: signing in with GitHub is not the same as connecting GitHub repositories for security scans. Repo access uses a different OAuth flow with its own permissions, covered under Service data above.
Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
Retention: for as long as your account is active, then deleted with your other account data within 30 days of closure (see How long we keep it).
International transfers: Google and GitHub process your sign-in on their own infrastructure, which may be outside the EU (including the United States). Their privacy policies apply to that step:
05 Why we collect it
- To provide the Service - authentication, scanning your assets, generating findings, sending alerts, processing payments.
- To improve the Service - measure which features people use, find bugs, and decide what to build next. Aggregated and pseudonymized.
- To communicate with you - security notifications you opted into, billing receipts, occasional product updates (you can unsubscribe).
- To meet legal obligations - keeping invoices for the period required by German tax law, responding to lawful authority requests.
We do not use your data to train machine-learning models for anyone other than you. The Companion runs on a curated public CVE corpus and your tenant's own data - never cross-tenant.
06 Legal basis (GDPR Art. 6)
| Processing | Legal basis |
|---|---|
| Providing the Service | Performance of contract - Art. 6(1)(b) |
| Sign-in with Google or GitHub | Performance of contract - Art. 6(1)(b) |
| Security & abuse prevention | Legitimate interest - Art. 6(1)(f) |
| Product analytics & improvement (logs, in-app telemetry) | Legitimate interest - Art. 6(1)(f) · pseudonymized |
| Google Analytics (web / shell, when enabled) | Consent - Art. 6(1)(a) |
| Marketing emails | Consent - Art. 6(1)(a) · opt-in only |
| Tax & accounting records | Legal obligation - Art. 6(1)(c) |
08 How long we keep it
- Account data: for the lifetime of your account. Deleted within 30 days of account closure.
- Service data (findings, scans): 24 months rolling, then aggregated. You can shorten this in Settings → Data & Privacy → Retention.
- Backups: 35 days, then permanently overwritten.
- Invoices & tax records: 10 years (required by §147 AO, German Fiscal Code).
- Marketing consent records: until you unsubscribe + 6 months for proof of consent.
09 International transfers
By default, all your data lives in the EU (Hetzner in Germany). The following involve transfer outside the EU:
- Google and GitHub when you sign in with them, or when you connect GitHub for repository scanning. They process that step on their infrastructure (see OAuth sign-in). We do not store customer personal data in GitHub.
- Stripe for payment processing. Covered by Stripe’s processor terms (accepted when you approve Stripe for billing), Standard Contractual Clauses (SCCs), and the EU-US Data Privacy Framework.
- OpenRouter for AI routing used by product features. Covered by a signed DPA and SCCs.
- Anthropic for Companion inference. Covered by SCCs, zero-retention API, and customer-controlled enable/disable.
- Vercel may serve the web app from EU edge locations; account and database data remain on our EU hosts.
You can disable Companion entirely from Settings → Companion, in which case no data leaves the EU.
10 Your rights
Under GDPR you have the right to:
- Access - request a copy of your personal data (Art. 15). Use Settings → Privacy & data.
- Rectify - correct inaccurate data (Art. 16).
- Erase - request deletion (Art. 17, "right to be forgotten").
- Restrict - ask us to keep your data but stop using it further (Art. 18). This is not the same as deletion. Email [email protected] with your grounds (for example contested accuracy, unlawful processing where you oppose erasure, need for legal claims, or pending Art. 21 objection). We mark your account as restricted, retain the data for storage, and stop non-essential processing (marketing, analytics enrichment, Companion personalisation) except where Art. 18(2) allows. We tell you before we lift the restriction (Art. 18(3)).
- Portability - receive your data in a structured, machine-readable format (Art. 20).
- Object - to processing based on legitimate interest (Art. 21).
- Withdraw consent - for marketing or Companion features, any time (Art. 7(3)).
- Lodge a complaint - with your local supervisory authority. In Germany: BfDI.
We respond to all requests within 30 days (typically much faster).
11 How we protect it
- TLS 1.3 in transit, AES-256-GCM at rest, with application-level encryption for sensitive fields.
- GDPR programme in place.
- Mandatory MFA for all employees · least-privilege access · zero standing access to production.
- Bug bounty program · responsible disclosure at [email protected].
- Data breach notification: we will notify affected users and the relevant supervisory authority within 72 hours, as required by GDPR Art. 33.
12 Changes to this policy
We may update this policy as the product evolves or the law changes. Material changes (anything affecting how we use your data) will be announced by email at least 30 days before they take effect. Minor edits - typo fixes, clarifications - are noted in the changelog at the top of this page.
13 Contact
Privacy questions? Want to exercise a right? We read every email.