Privacy notice

Who controls your data

The controller is Matti Heikkila, an individual operator based in Luxembourg.

Contact: privacy@autovuln.ai. No data protection officer has been appointed.

Data we collect

We collect the following data through the early-access form:

• your email address and name, which are required;
• your company or organisation, if you choose to provide it;
• a source repository URL and related access request, if you choose to provide them;
• the site, form, date, and consent context associated with your signup; and
• limited request information, such as an IP address and browser details, that providers may process to deliver and protect the form.

Submitting a URL does not grant access to a private repository. Do not submit source code, passwords, access tokens, SSH keys, secrets, sensitive personal data, or special-category personal data through the form.

Why we use the data

We use the data to record and manage your early-access request, assess a repository that you choose to identify, contact you about a separate read-only access process, send release and product updates, respond to your requests, and protect the form against abuse.

For a private repository, access will be requested separately through a provider installation flow. You will choose the repositories that the integration can read. The early-access form itself does not grant repository access.

Consent is the legal basis for early-access and product-update emails. Our legitimate interest in operating and protecting the site is the basis for essential security processing.

You can withdraw consent at any time by using an unsubscribe link or contacting us.

Service providers and transfers

Zoho CRM processes the signup data as our service provider. The current Zoho CRM account stores this data in the United States.

The transfer is governed by a Data Processing Addendum and the European Commission's Standard Contractual Clauses. Zoho and its listed subprocessors may process limited data as needed to provide, secure, and support the service.

Cloudflare Web Analytics measures basic site usage, such as page views, approximate visitor counts, referring sites, and technical performance. It does not use cookies, local storage, or fingerprinting. Cloudflare receives an IP address as part of the web request but states that it discards the address and does not store it in its analytics database or logs.

Website hosting and delivery providers may process limited request data to serve and secure these static pages. We do not sell your personal data or share the list for third-party advertising.

How long we keep the data

We keep an active early-access record until you unsubscribe, the early-access purpose ends, or 24 months pass without a meaningful interaction, whichever occurs first.

After an unsubscribe request, we may retain a minimal suppression record so that we continue to honour your choice. Deleted data can remain in protected provider backups during the provider's normal backup cycle.

Your rights

Depending on the circumstances, you can request access, correction, deletion, restriction, or portability. You can object to processing based on legitimate interests and withdraw consent for email updates.

Email privacy@autovuln.ai to exercise a right. You can also lodge a complaint with the Luxembourg National Commission for Data Protection (CNPD).

Cookies and tracking

This site uses cookie-free Cloudflare Web Analytics to understand aggregate traffic and site performance. It does not use advertising or behavioural analytics cookies. The Zoho form analytics loader is not included. Your browser contacts Zoho when you submit the form.

Providers can use strictly necessary technologies to deliver requests, prevent abuse, and protect their systems. We do not use automated decision-making or profiling with signup data.

Changes

We may update this notice when the service or its providers change. The effective date shows the latest version. We will describe material changes on the site or in an email when appropriate.