Privacy policy

This policy describes personal data processed by the Scandar beta. The controller is BIDON_ELOUAN. The contact for privacy requests is BIDON_ELOUAN.

Data we store

• Account: name, email address, whether it is confirmed, profile photo, a password hash when you set one, session token, IP address, and user agent.
• Repositories you connect and the manifests and lockfiles you upload, plus the scan results (advisory ids, package names, severities, and the times they were seen).
• Logs of sign-in, rate limits, and admin actions, used to run and protect the service.
• A request to join the beta: name, email, whether it is for a person or a company, team size, an optional website, and what you want to try. The address of the request is kept only to limit repeated submissions.

Why

The account, the scans, and the emails you asked for are provided because you use the service. Sessions, rate limits, and security logs are kept so the service is not abused.

How long

Account data, connected repositories, manifests, lockfiles, and scan results are kept until you delete the account or remove the project. A session lasts seven days and is extended when you come back on a new day. An explanation of an advisory is cached without your user id, so deleting the account does not erase a note that other projects share.

Your rights

You can download a copy of your data and delete your account from Settings. You can also ask for access or correction by writing to the contact address. You can complain to the CNIL.

Who receives it

The subprocessors are listed on the subprocessors page: the host, GitHub, Resend, OpenRouter, and Sentry when those are configured. No payment provider is used during the beta.