Privacy policy
Jay Doolan (trading as SecuriVibe) | Last updated: October 2026
1. Overview
Jay Doolan (trading as SecuriVibe) (“SecuriVibe”, “we”, “us”, or “our”) is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains what personal data we collect, how we use it, and the rights you have in relation to it.
This policy applies to the website at securivibe.com and any services we provide. It is written in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).
We do not sell your personal data to third parties.
2. Data Controller
The data controller responsible for your personal data is:
Jay Doolan (trading as SecuriVibe)
Sole trader, England & Wales
Address: [Trading address placeholder]
Data Protection Enquiries: privacy@securivibe.com
3. Information We Collect
Information you provide to us
When you create an account, contact us, or use our services, we may collect:
- Your name and email address
- Your password, stored only as a one-way hash
- Your GitHub account ID and an access token, if you connect GitHub
- The source code you submit for a review: a repository we clone with your permission, or an archive you upload
- What we produce from it: findings, reports, patches and corrected project archives
- Order records from our payment processor (Polar); we never receive your card number
- Any other information you choose to share with us, such as a description of your project
Information collected automatically
When you visit our website, we automatically collect certain technical data:
- IP address. Analytics tools anonymise it; we keep it with your signed-in sessions and contact requests, and briefly for rate limiting, to protect the service from abuse
- Browser type and version
- Operating system
- Referring URL
- Pages visited and time spent on each page
- Date and time of your visit
Cookie-derived data
We use cookies and similar tracking technologies. Please see Section 4 for full details. You can manage your cookie preferences at any time via the Cookie Settings link in the footer.
4. Cookies & Tracking Technologies
Cookies are small text files placed on your device. We use the following categories of cookies. You can choose which optional categories to accept when you first visit the site, or at any time via the Cookie Settings link in the footer.
| Category | Purpose | Examples | Duration |
|---|---|---|---|
| Essential | Required for the site to function. Cannot be disabled. | Cookie consent preference, session security | Session / 2 years |
| Analytics | Understand how visitors use the site and product so we can improve them. | Google Analytics 4, PostHog (EU) | Up to 26 months |
| Marketing | Enable targeted advertising on third-party platforms. Not currently in use. The category is retained so consent already given stays valid if we reintroduce a tag. | None active | None |
| Functional | Remember your preferences and personalise your experience. | Dismissed banners, display settings | Up to 1 year |
Your consent choice is stored locally on your device. You may withdraw consent at any time by clicking Cookie Settings in the footer and saving updated preferences. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
5. Analytics Partners
When you consent to Analytics cookies, limited event data is shared with the provider below. We do not currently operate any advertising, retargeting, or session-recording tags.
Google Analytics
We use Google Analytics 4 (GA4) to understand website traffic. Data collected includes page views, session duration, and conversion events. Data is processed by Google LLC and may be transferred outside the UK (see Section 10).
- Data retained for up to 26 months within GA4
- IP addresses are anonymised before storage
- GA4 opt-out browser add-on: tools.google.com/dlpage/gaoptout
6. Legal Basis for Processing
Under UK GDPR Article 6, we process your personal data on the following legal bases:
| Legal basis | Processing activity |
|---|---|
| Consent (Art. 6(1)(a)) | Analytics cookies |
| Contract performance (Art. 6(1)(b)) | Delivering security audit services once engaged; processing enquiries that lead to a contract |
| Legitimate interests (Art. 6(1)(f)) | Site security and fraud prevention; responding to support enquiries; improving our services |
| Legal obligation (Art. 6(1)(c)) | Retaining financial records for tax and regulatory compliance; responding to law enforcement requests |
7. Data Retention
We retain personal data only for as long as necessary for the purpose it was collected:
| Data type | Retention period |
|---|---|
| Account data (name, email, password hash, GitHub connection) | Until you close your account |
| Source code you submit (uploaded archives, repository copies), scan results, patches and corrected archives | Until you delete the project, or automatically 30 or 90 days after its last activity if you set a retention period on it |
| Free key-leak scan results (public repositories only: repository name and redacted matches) | Kept so the result link keeps working; email us to remove one |
| Contact enquiry data (email, IP address, browser) | 3 years from last contact |
| Signed-in session records (IP address, browser) | Until the session expires (7 days) or you sign out |
| Analytics data (GA4) | 26 months (Google default) |
| Financial and contractual records | 7 years (UK legal requirement) |
| Cookie consent records | 2 years |
When data is no longer required, it is securely deleted or anonymised.
8. Your Rights (UK GDPR Chapter 3)
As a data subject, you have the following rights. To exercise any of them, please contact us at privacy@securivibe.com. We will respond within one calendar month.
Right of access (Art. 15)
Request a copy of the personal data we hold about you.
Right to rectification (Art. 16)
Request correction of inaccurate or incomplete data.
Right to erasure ('right to be forgotten', Art. 17)
Request deletion of your personal data where there is no legitimate reason for us to continue processing it.
Right to restriction of processing (Art. 18)
Request that we restrict processing of your data in certain circumstances.
Right to data portability (Art. 20)
Receive your data in a structured, machine-readable format and transfer it to another controller.
Right to object (Art. 21)
Object to processing based on legitimate interests, or to direct marketing at any time.
Rights related to automated decision-making (Art. 22)
We do not make solely automated decisions with legal or significant effects.
Right to withdraw consent
Where processing is based on consent, you may withdraw at any time. This does not affect the lawfulness of processing before withdrawal.
9. Third-Party Services
Our website may integrate with or link to third-party services. Each third party has its own privacy policy and data practices, for which we are not responsible. Current third-party services include:
- Google (Analytics)
- PostHog (product analytics, EU region)
- Payment processors (Polar), for Launch scan checkout
- GitHub, when you connect a repository: we read it with the access you grant and, if you ask, open a draft pull request
- Resend, which sends account and scan emails
- Infrastructure providers that host the site and its database, run background jobs and enforce rate limits
- Anthropic (AI analysis): the source code you submit for a scan is sent to Anthropic's API, which may process it in the United States, solely to perform the review you requested
We use PostHog (EU region) for product analytics: understanding how the signup, repository-connection, and scan flows are used so we can improve them. For signed-in users, a small set of product events (e.g. account created, scan started, checkout completed) is processed under our legitimate interest in operating and improving the service, independently of cookie consent; cookie-based browser analytics runs only with your Analytics-cookie consent. PostHog stores this data in the EU. Session recording and autocapture are disabled.
We will update this list as we integrate additional services.
10. International Data Transfers
Some of our analytics, AI and infrastructure providers (including Google, Anthropic and GitHub) are based outside the UK and may process your data in the United States or other countries. These transfers are subject to appropriate safeguards:
- Adequacy regulations: transfers to countries deemed adequate by the UK Secretary of State
- Standard Contractual Clauses (SCCs): where adequacy does not apply, we rely on UK SCCs or the International Data Transfer Agreement (IDTA) approved by the ICO
- Binding Corporate Rules: where applicable within corporate groups
You can request a copy of the relevant safeguards by contacting privacy@securivibe.com.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Where changes are material, we will update the “Last Updated” date at the top of this page and, where appropriate, notify you by email or a prominent notice on the site.
We recommend reviewing this page periodically. Continued use of the site after any changes constitutes your acceptance of the updated policy.
12. Contact & Data Protection Enquiries
For any questions about this policy or to exercise your rights, please contact our data protection team:
Jay Doolan (trading as SecuriVibe): data protection enquiries
Email: privacy@securivibe.com
Address: [Trading address placeholder]
If you are not satisfied with our response, or believe we are processing your personal data in a way that does not comply with UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF