PRIVACY POLICY

1. OVERVIEW

Sailop ("we", "us", "our") operates the sailop.com website and the Sailop CLI tool. Sailop is published by Go To Agency SAS, a French simplified joint-stock company with a share capital of €1,000, 9 rue Jean-Jacques Rousseau, 21000 Dijon, France (RCS Dijon 944 980 762, VAT FR25944980762, phone +33 7 56 96 20 95), the controller of the data described in this policy; publication director: Robin Monteiro. This policy explains what data we collect, why we collect it, how we store it, and your rights regarding that data. We are committed to GDPR compliance and treat all user data with the same standard regardless of geographic location.

2. DATA WE COLLECT

We collect the following categories of data:

• Account information: Email address, display name, and authentication provider (Google or GitHub OAuth).
• Usage data: Feature usage frequency, scan counts, CLI command invocations, and error reports. This is aggregate data and does not include the content of your code.
• Scan results: When you use the web scanner, we store the resulting slop score and dimension breakdown. We do not store the source code you scan.
• Payment information: Billing details are processed and stored by Stripe. We never see or store your full card number, CVV, or bank account details. We retain your Stripe customer ID and subscription status.
• Session data: We use secure HTTP-only cookies to maintain your session. No third-party tracking cookies are used.
• Waitlist email: If you ask to be told when the CLI ships, we store that email address, the page you signed up from and the date. We use it for that launch email only, and delete it on request ([email protected]).

3. HOW WE USE YOUR DATA

• To authenticate you and maintain your account.
• To process payments and manage subscriptions via Stripe.
• To provide scan results, history, and usage statistics in your dashboard.
• To improve the product by analyzing aggregate usage patterns (never individual code).
• To send transactional emails (account confirmation, password reset, payment receipts). We do not send marketing emails unless you explicitly opt in.

4. AUTHENTICATION

We use Google OAuth and GitHub OAuth for authentication. When you sign in, we receive your email address and public profile name from the provider. We do not receive or request access to your repositories, files, contacts, or any other data beyond basic profile information.

5. DATA STORAGE AND SECURITY

Your data is stored in a PostgreSQL database hosted on encrypted infrastructure. All connections to our database are encrypted via TLS. Backups are encrypted at rest. Access to production data is restricted to essential personnel only and requires multi-factor authentication.

6. COOKIES

We use strictly necessary cookies to maintain your session. These are secure, HTTP-only cookies that expire when your session ends or after 30 days of inactivity. We do not use advertising cookies or tracking pixels, and no data is shared with ad networks. Audience measurement (see section 7) sets no cookie and stores nothing on your device.

7. THIRD-PARTY SERVICES

• Stripe: Payment processing. Subject to Stripe's Privacy Policy.
• Google OAuth: Authentication only. Subject to Google's Privacy Policy.
• GitHub OAuth: Authentication only. Subject to GitHub's Privacy Statement.

We count visits with Datalenk, a cookieless audience-measurement script loaded from in.datalenk.com and operated by GTA Go To Agency SAS, a French company. It records page views, the referring page, campaign parameters, browser language, viewport width, scroll depth and clicks. It runs in its default mode: it sets no cookie and stores nothing on your device, and it measures nothing when your browser sends Do Not Track. Its data is hosted in Germany by Hetzner and is never stored outside the European Union. Detailed visit data is kept for 25 months, then permanently deleted. We do not use Google Analytics, Facebook Pixel, Hotjar or Mixpanel. Fonts are loaded from Google Fonts, which receives your IP address when your browser requests them.

8. CLI TOOL PRIVACY

The Sailop CLI runs entirely on your local machine. Your code is never sent to our servers. Scan results are computed locally. The only network requests the CLI makes are for license validation (a single API call that sends your license key, not your code) and optional update checks.

9. YOUR RIGHTS UNDER GDPR

If you are located in the European Economic Area, you have the right to:

• Access: Request a copy of all personal data we hold about you.
• Rectification: Correct any inaccurate data.
• Erasure: Request deletion of your account and all associated data.
• Portability: Receive your data in a machine-readable format.
• Restriction: Restrict processing of your data under certain conditions.
• Objection: Object to processing of your data for specific purposes.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

10. DATA RETENTION

We retain your account data for as long as your account is active. If you delete your account, we erase all personal data within 30 days. Anonymized, aggregate usage statistics may be retained indefinitely as they cannot be linked back to any individual. Detailed visit data recorded by Datalenk is kept for 25 months, then permanently deleted.

11. CHILDREN

Sailop is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it promptly.

12. CHANGES TO THIS POLICY

We may update this policy from time to time. Changes will be posted on this page with an updated revision date. If changes are material, we will notify you by email.