Privacy Policy
Draft for attorney review. Items in [brackets] must be completed before launch.
Last updated: [DATE]
This policy explains what personal data CloudOneSoftware LLC ("we") collects through ShipShield, why, who receives it and your choices. Controller: CloudOneSoftware LLC, [registered street address], Jersey City, NJ [ZIP], USA · contact@cloudonesoftware.com.
What we collect and why
| Data | Purpose | Legal basis (EU/UK) | Kept for |
|---|---|---|---|
| Email address and sign-in provider ID | Create and secure your account | Contract | While your account is open |
| Scan records: target name, scores, findings with secrets masked, short code snippets | Show results and history | Contract | While your account is open, or until you delete them |
| Plan and Stripe customer ID | Billing | Contract; legal obligation | As required by tax law (typically 7 years) |
| Newsletter email (if you subscribe) | Send the monthly teardown | Consent | Until you unsubscribe |
| IP address (temporarily) | Rate limiting and abuse prevention | Legitimate interest | Up to 26 hours |
What we do not collect
Code you paste into the free scanner on our home page is analysed in your browser and never sent to us. For repository scans we download the public repository temporarily to analyse it and do not keep the source code. We do not use advertising or analytics trackers, and we do not sell or share personal data for cross-context behavioural advertising.
Who receives data (processors)
- Cloudflare, Inc. — hosting and security
- [Supabase, Inc. or Google LLC (Firebase / Google Cloud)] — database and sign-in
- Stripe, Inc. — payments (we never see your full card number)
- Anthropic PBC — AI explanations, only when you request one; secrets are masked first
- GitHub, Inc. — download of public repositories you ask us to scan
- Google Fonts — web fonts are loaded from Google's servers, which receive your IP address [consider self-hosting fonts before marketing in the EU]
International transfers
Our providers may process data in the United States and other countries. Where required we rely on the EU–US Data Privacy Framework or Standard Contractual Clauses. [ATTORNEY TO CONFIRM]
Your rights
Depending on where you live (for example the EU/UK GDPR or US state laws such as California's CCPA/CPRA), you may have the right to access, correct, delete or export your data, to object to or restrict processing, to withdraw consent, and not to be discriminated against for using these rights. Email contact@cloudonesoftware.com; we answer within 30 days. You may also complain to your data-protection authority.
Security
Data is encrypted in transit, access is limited by user ID and database security rules, and secret values found in scans are masked before storage.
Children
ShipShield is not directed at children under 16 and we do not knowingly collect their data.
Cookies and storage
See our Cookie Policy.
Changes
We will post changes here and email account holders about material changes.