Privacy Policy
Draft for attorney review. Items in [brackets] must be completed before launch.
Last updated: [DATE]
This policy explains what personal data CloudOneSoftware LLC ("we") collects through ShipShield, why, who receives it and your choices. Controller: CloudOneSoftware LLC, [registered street address], Jersey City, NJ [ZIP], USA · contact@cloudonesoftware.com.
What we collect and why
| Data | Purpose | Legal basis (EU/UK) | Kept for |
|---|---|---|---|
| Email address and sign-in provider ID | Create and secure your account | Contract | While your account is open |
| Scan records: target name, scores, findings with secrets masked, and one-line code snippets unless you turn them off | Show results and history | Contract | While your account is open, until you delete them, or for the automatic-deletion period you choose (30 days, 90 days or 1 year) |
| Plan and Stripe customer ID | Billing | Contract; legal obligation | As required by tax law (typically 7 years) |
| Newsletter email (if you subscribe) | Send the monthly teardown | Consent | Until you unsubscribe |
| IP address (temporarily) | Rate limiting and abuse prevention | Legitimate interest | Up to 26 hours |
What we do not collect
Code you paste into the free scanner on our home page is analysed in your browser and never sent to us. For repository scans we download the public repository temporarily to analyse it and do not keep the source code. We do not use advertising or analytics trackers, and we do not sell or share personal data for cross-context behavioural advertising.
Who receives data (subprocessors)
| Company | Purpose | Data they receive |
|---|---|---|
| Cloudflare, Inc. | Hosting, network and security for the site and API | All requests, including IP address; code sent for dashboard, repository and live-site scans, processed in memory |
| [Supabase, Inc. or Google LLC (Firebase / Google Cloud)] | Database and sign-in, including sign-in emails | Email address, account settings, projects and scan records |
| Stripe, Inc. | Payments and billing portal | Name, email, billing details and payment card (we never see the full card number) |
| Anthropic PBC | AI explanations, only when you request one | Up to 500 characters of the flagged code, with secrets removed first |
| GitHub, Inc. | Download of public repositories you ask us to scan | The repository name; no personal data |
| Google (Google Fonts) | Web fonts | Your IP address when fonts load [consider self-hosting fonts before marketing in the EU] |
International transfers
Our providers may process data in the United States and other countries. Where required we rely on the EU–US Data Privacy Framework or Standard Contractual Clauses. [ATTORNEY TO CONFIRM]
Your rights
Depending on where you live (for example the EU/UK GDPR or US state laws such as California's CCPA/CPRA), you may have the right to access, correct, delete or export your data, to object to or restrict processing, to withdraw consent, and not to be discriminated against for using these rights. You can delete your account and all scan data yourself from the dashboard (Privacy and data → Delete my account and data), or email contact@cloudonesoftware.com; we answer within 30 days. You may also complain to your data-protection authority.
Security
Data is encrypted in transit, access is limited by user ID and database security rules, and secret values found in scans are masked before storage. Details are on our Security and trust page.
Children
ShipShield is not directed at children under 16 and we do not knowingly collect their data.
Cookies and storage
See our Cookie Policy.
Changes
We will post changes here and email account holders about material changes.