Privacy policy

Who is responsible

Isaque Moutta, in Brazil, runs Stingward and is responsible for your data (the controller, under Brazil's LGPD and the EU and UK GDPR). Write to support@stingward.com. Paddle, which sells the report, is responsible for the payment data it collects, as its privacy notice says.

What we collect

• Your email address, which Paddle passes to us after you pay, to send you the order link and notices about it.
• The order: when it was made and paid, its status, the report language, the grade, Paddle's ids for the payment and for you as a customer, and when you confirmed that the app is yours and that you accept the terms.
• The project you send, as a zip file or one GitHub repository.
• The report and the findings it is built from, with secrets masked.
• Technical logs of errors and order events. They name the order, not your code, your email or your link.

We never see your card or bank details: they go to Paddle.

What happens to your code

• Stingward reads it on our server, in a folder that is deleted when the check ends.
• For the automatic review, we send Claude, Anthropic's AI model, a few lines around each finding, with secrets masked, and the rule that found it. We never send the whole project. Under its commercial terms, Anthropic does not train its models on this data.
• To look up known vulnerabilities, package names and versions go to OSV.dev, the US National Vulnerability Database, CISA and FIRST.
• If you connect GitHub, you install our GitHub App on one repository, with read-only access. We download that repository once and remove the access right after.
• The zip or the download is deleted as soon as the report is ready or the order fails, and always within 48 hours.

Who else handles it

These companies process data for us, only to run the service:

• Paddle: the payment, the invoice, tax and refunds. As Merchant of Record, it is also responsible for this data itself.
• Google Cloud: our server, database and file storage, in the United States.
• Anthropic: the automatic review of masked excerpts, with its AI model, in the United States.
• Resend: sending the emails, in the United States.
• GitHub: the repository download, only if you connect one. GitHub also hosts this website and may log visitors' IP addresses for security.
• Cloudflare: the stingward.com domain and the emails you send to support@stingward.com.

Most of these servers are in the United States. Where the law asks for it, the transfer relies on the standard contractual clauses these companies offer. We do not sell your data or use it for advertising.

Cookies

The order pages set one cookie, only when you connect GitHub. It holds your order link for up to 30 minutes so GitHub can bring you back, and it is deleted when you return. The payment window is Paddle's, and Paddle may set its own cookies to take the payment. There are no cookies for analytics or ads.

How long we keep it

• Your code: until the report is ready or the order fails, and never more than 48 hours.
• The report, the findings, your email address and the order link: 30 days after the report or the refund. Then they are deleted.
• An order that was never paid: 2 days.
• Technical logs: 30 days.
• After that, a record of the order stays without your email (dates, status, grade and Paddle's ids), for as long as tax and accounting rules require.

Why we use it

To make and deliver the report you bought (performing the contract), to keep the records that tax law requires (legal obligation), and to keep the service secure and fix errors (legitimate interest).

Your rights

You can ask to see, correct, export or delete your data, to know who we shared it with and to object to how we use it. Write to support@stingward.com from the email you ordered with, and we answer within 15 days. Deleting an order's data also ends the order. You can also complain to Brazil's data protection authority, the ANPD, or to the authority where you live.

Children

The report is sold to adults. We do not knowingly collect data from anyone under 18.

Changes

If this policy changes, the new version is published here with a new date below.