Privacy Policy

Last updated: October 25, 2026

1. Who we are

VibeScan (vibescan.org) is a security audit service for software projects. This policy explains what data we handle and how. For inquiries: info@vibescan.org.

2. What data we collect

Your email, to identify you, send you the report and handle payment.
The project you point us to: the live URL, the repository or the .zip you upload, only to run the audit.
Payment data: processed by Stripe. We do not store card numbers.
Minimal technical data (audit logs, scan status).

3. What we use it for

To run the audit you requested, deliver your report, bill you, keep the certification (if you're a subscriber) and improve the service. We don't sell your data or use it for advertising.

4. Code retention

The code you upload is analyzed in an isolated environment and deleted when the audit finishes. We don't reuse it to train models or for any other purpose. Reports stay linked to your email so you can review them; you can request their deletion anytime.

5. Third parties that help us operate

We share the minimum necessary with providers that process data on our behalf: Stripe (payments), Resend (emails), Vercel and Upstash (hosting and database). The agentic exploitation stage (Strix) may use an AI model provider against the authorized target.

6. Cookies

We use essential cookies/local storage to make the site work and to remember your preferences (for example, your language and consent choice). We don't use third-party advertising cookies.

7. Your rights

You can request to access, correct or delete your data by writing to info@vibescan.org. We respond within a reasonable time.

8. Changes

We may update this policy. We'll publish the current version on this page with its update date.