Privacy policy

Who we are

Defexity is the data controller for the personal data described here. For privacy questions, data requests or grievances, email defexity.help@gmail.com.

What we collect and why

• Account details: email, full name (stored encrypted), country, and the dates you passed the age check and accepted these terms. We ask for your date of birth only to check your age at sign-up and never store it. Passwords are handled by our auth provider, Supabase, and stored only as salted hashes.
• Scans you run: the URLs or uploaded archive names, scores and findings. Evidence is redacted so secret values are never stored. Uploaded code is read in memory, never executed and never kept.
• Monitoring and deployment checks (paid plans): the checks you set up, the results of each run, and a screenshot of your own site when a browser check fails. Test-account passwords and API tokens you give a check are stored encrypted and are never shown again. For deployments we keep the commit, branch and URL your host or CI reports.
• Diagnoses: when a check fails we write an explanation and fix prompts. For repositories you connect through GitHub this uses the list of files changed since the last good deployment and short excerpts of those changes, with secrets masked first.
• Website assistants (AI Assistant add-on): the text of the pages and files you add as knowledge (uploaded files are read once and not kept), and the conversations your visitors have with your assistant. Questions and answers are stored encrypted, with a one-way hash of a random visitor ID kept in the widget’s own storage; the widget sets no cookies on your site. For your visitors’ chats you are the controller and Defexity processes them on your behalf, so tell your visitors about the assistant in your own privacy notice.
• AI chat (in the dashboard): the messages you send to Defexity’s assistants and their answers, stored encrypted and visible only to you, not to teammates. To answer, an assistant reads only what its job needs: your latest scan results, the pages and files you added to your website assistant, or, for the Agent, the scans it looks up with your own permissions. Delete a conversation at any time; otherwise it is deleted after your plan’s history period. Your conversations are included in Download my data.
• Security records: a log of sign-ins, password and two-factor changes, API key events and data exports, plus your active sessions. IP addresses are kept only as keyed one-way hashes and device descriptions are encrypted.
• Rate-limit counters keyed by hashed IP address or account, to prevent abuse.
• Your email if you join the monitoring waitlist, used only to tell you when monitoring opens, plus product updates only if you tick that separate, optional box.

We do not run advertising pixels, we do not sell personal data, and we currently run no analytics scripts. If we add privacy-friendly analytics later, it will load only after you choose “Accept all” (or switch on Analytics) in the cookie banner; with “Essential only” it never loads.

To understand which parts of Defexity help people, we also record a few product events on our own servers, such as “a scan was started”, “a fix prompt was copied” or “a finding was rechecked and passed”. These use no cookies, store no IP address and no identifier for visitors who are not signed in. For signed-in users an event is linked to your workspace, not to you personally, and it is deleted with the workspace. They are used only to improve the product, never for advertising, and are not shared with anyone.

Legal basis and consent

We process scan and account data to provide the service you request, abuse-prevention data for our legitimate interest in keeping the scanner safe, and marketing email only with your consent, which you can withdraw at any time by replying to any email or contacting us.

Retention

• Scan reports, monitoring runs and their screenshots, and assistant conversations: kept for your plan’s history period (7 to 180 days), then deleted.
• Rate-limit counters: expire within 24 hours.
• Account data: kept while your account is active. Deleting your account in Settings removes it immediately; backups expire within 30 days.
• Security log: kept for 12 months to investigate account misuse, with identifiers hashed.
• Waitlist emails: kept until monitoring opens or you ask us to remove them.

Who processes data for us

Supabase (sign-in), Brevo (account emails, and alert emails you set up), GitHub (only for repositories you connect), Anthropic (the Claude API writes failure diagnoses from the failing check’s details and, for connected repositories, the changes described above, and, when enabled, writes assistant answers from your knowledge and the visitor’s question) and our hosting provider, each under data processing terms. When paid plans open, Paddle will handle payments as merchant of record. Data may be processed outside your country with appropriate safeguards.

Your rights

Depending on where you live (including under GDPR and India’s DPDP Act), you can access, correct or erase your data, withdraw consent, or nominate someone to act for you. You can download all your data and delete your account yourself in Dashboard → Settings. For anything else, or to raise a grievance, email defexity.help@gmail.com. We respond within 30 days.

Security and breaches

Data is encrypted in transit (HTTPS only) and at rest; names and device details are also encrypted at field level, and each customer’s data is isolated with database row-level security. Optional two-factor authentication protects accounts. See Security. If a breach affects your personal data, we will notify you and the relevant authority as the law requires.

Children

Defexity is a developer tool. You must be at least 13 to create an account, and at least 16 in the EU, EEA and UK, because we do not offer parental-consent sign-up. If we learn an account belongs to someone under these ages, we delete it.

Cookies

We set only strictly necessary cookies unless you allow more in the cookie banner. Details and your choices are in the cookie policy.