Proveta privacy notice

Who controls the data

GoStack Software Technologies, Unipessoal, Lda operates Proveta and is the data controller. For privacy questions or requests, email hi@gostack.dev.

Accounts and workspace access

When you sign in with GitHub, we receive your GitHub account identifier, username, and an available verified email address. We use these details to identify you, create your session, and connect you to your workspaces. Proveta does not create or store a password for your account.

We keep workspace memberships, roles, invitations, and access-change records. Invitations use an email address supplied by a workspace admin; accepting one checks that it matches a verified address on your GitHub account. Workspace members can see information permitted by their role.

Sign-in uses a session cookie. We also use cookies during the GitHub sign-in flow to check that the response belongs to your request.

Repositories, findings, and decisions

We store information about connected repositories and GitHub App installations, dependency alerts, affected packages and versions, advisory references, and source status. We use this information to show findings and coverage for the repositories you connect.

Your workspace records include owners, deadlines, decisions, reasons, risk acceptance expiry dates, and activity history. Reports contain records for the selected review period. Decision history preserves the identity recorded at the time, including after a username changes.

Dependency scans and optional fixes

Uploaded scans process the dependency file you provide, its repository path, and its connection to a workspace repository. Repository scans use GitHub Contents read permission to fetch a repository snapshot, which can include source code. Supported project files may be resolved in an isolated environment to identify dependency versions.

We retain scan results and evidence such as package inventories, vulnerabilities, coverage warnings, file paths, commit references, and scan times. When code scanning is on, code findings also keep line numbers and code snippets of up to 200 characters. Uploaded file contents are cleared from the scan job when its result or failure is saved. Queued work can retain its input until it finishes or is expired by queue recovery.

Advisory checks send package names, ecosystems, and versions to OSV, and CVE identifiers to FIRST.org. Package registries receive requests needed to resolve dependencies and check releases. We do not send repository snapshots to OSV or FIRST.org.

If a workspace admin enables fix PRs, a separate GitHub App reads repository files and can write a proposed branch, commit, and pull request. We keep the request, outcome, PR reference, and related activity records. Disabling fixes does not delete existing GitHub branches, PRs, or your workspace history.

Operational emails

Resend delivers workspace invitations and emails to owners when accepted risks expire. These messages use recipient addresses and the details needed to explain the invitation or risk. Delivery records help us avoid duplicate messages and handle failed sends. Operational emails are separate from optional marketing emails.

Template downloads and optional marketing

For the template request, we collect your email address, the “template” request source, and the request time. We use this data to fulfill the download and prevent misuse. The work-email field is required, so we cannot provide the download without it.

If you select the optional marketing checkbox on that form, we also keep a separate signup record with your email address, the “template” signup source, the notice version, and signup time. We use it to send Proveta product and launch emails, and to understand which channels lead to signups.

We do not use either record for automated decision-making. A template request is never treated as marketing permission unless you select the separate optional checkbox.

Why we process personal data

Account, access, and workspace information lets us provide the service you or your organisation requests. Security and activity records help us protect access, investigate problems, and preserve the history of workspace decisions. If your organisation manages the workspace, it chooses which repositories and records to add and who has access.

Our legal basis for the required template-request record is our legitimate interest in fulfilling the download you requested and preventing misuse. We limit this record to the email address, request source, and time, and we keep it separate from marketing.

Our legal basis for product and launch emails is your consent. The marketing checkbox is unchecked by default. If you opt in, we store the notice version you accepted and the database timestamp for the signup.

Retention and withdrawal

Disconnecting a repository or removing a workspace member does not automatically erase historical findings, decisions, scan evidence, or reports. These records preserve the workspace history. Workspace records do not currently have an automatic age-based deletion period. Contact us to request deletion or discuss your organisation’s retention requirements; we review the affected records and any obligations to retain them before responding.

We keep the template-request record for up to 12 months from the request. We keep the marketing signup record for up to 12 months from signup, or until you withdraw consent, whichever happens first. Email hi@gostack.dev to withdraw marketing consent or ask for deletion. Withdrawal does not affect processing that was lawful before your request.

Service providers and transfers

Vercel hosts the website, API, and aggregated Web Analytics. Neon stores account, workspace, finding, scan, report, and template records in Postgres. Vercel also runs isolated processing for dependency scans and optional fixes. The current database is hosted on AWS in US East, and Vercel also uses processing facilities in the United States and other locations used by its subprocessors.

These providers state that they use safeguards for international transfers, including Standard Contractual Clauses where required. Read the Vercel data terms and Neon data terms.

Other providers and website analytics

GitHub handles sign-in and connected repositories. Resend processes operational emails. Stripe processes payments, invoices, and the billing details a workspace admin enters at checkout. OSV supplies advisory information, and public package registries supply dependency metadata and packages used in scans and fixes. These providers may process data outside the European Economic Area. Read the privacy information from GitHub, Resend, and Stripe. Advisory information is available from OSV. The Subprocessors page lists each provider, the data it receives, and its location.

We use Vercel Web Analytics to understand website usage in aggregate. It does not use analytics cookies. Invitation pages are excluded from our analytics integration. Read the Vercel analytics privacy information.

Your rights

You can ask for access, correction, deletion, restriction, or a portable copy of your data. You can object to processing based on legitimate interests and withdraw marketing consent at any time by using the contact address above.

Complaints

You can complain to Portugal’s Comissão Nacional de Proteção de Dados. The CNPD provides a written complaint form on its public contact page.