Privacy Policy
Version 1.0.0 · last reviewed 2026-09-19. Structure fixed by legal review; wording subject to final review before launch.
Who we are
The provider of the release attestation service, established in Spain, acting as controller for account data and as processor for the code and evidence you submit.
What we process
Account data (email, name, organisation), usage records, and — as your processor — the release you designate. Source code is never retained after a run. Evidence contains hashes, metadata and outcomes only, and contains no personal data.
Why and on which basis
Performance of the contract (running the service), legitimate interest (security, abuse prevention, access logging), legal obligations (record-keeping) and the establishment, exercise or defence of legal claims (evidence retention).
How long
Account data: for the life of the account and 30 days after closure (reversible). Execution evidence: 6 years from each run, on the basis of Spanish Commercial Code art. 30 (6-year record-keeping) and GDPR art. 17(3)(b) and (e); the evidence contains no personal data. Access logs: 400 days.
Your rights
Access, rectification, erasure, restriction, portability and objection, exercised in the app (Organisation → Danger zone) or by writing to the address in the imprint. Erasure requests are honoured within 30 calendar days, without a grace period; you receive an immediate acknowledgement. Where a legal claim is open, personal data may be retained under art. 17(3)(e) and you are told so. You may lodge a complaint with your supervisory authority (in Spain, the AEPD).
AI
AI-assisted checks are performed on software artefacts, never to make decisions about individuals. The model used is disclosed on each attestation. Providers are bound to no-training and zero-retention terms.
Cookies
No third-party cookies or analytics on public pages. The logged-in product uses first-party session cookies only.
International transfers
Sub-processors outside the EU are bound by Standard Contractual Clauses. See the public sub-processor list.
California residents
We act as a service provider under the CCPA/CPRA. We do not sell or share personal information.