This policy describes how Detektu (“we”, “us”) handles personal information when you use the API dependency intelligence service available at detektu.com (the “Service”). Privacy contact: legal@detektu.com.
1. What we collect and why
We collect the minimum needed to run the Service. Under PIPEDA, we obtain consent in a form appropriate to the sensitivity of the information and a reasonable user’s expectations. Processing necessary to provide the Service is a condition of using it; optional processing, if introduced, will be presented separately.
1.1 Account and organization data
Email address, password if you create one (stored only as a hash), organization name, role, membership changes (who/when), terms-acceptance records (user, organization, version, timestamp). If you sign in with GitHub or Google, additionally: the provider name and its stable subject identifier, the email address and whether the provider verified it, the optional display name and avatar URL, and audit records for linking or unlinking the sign-in method. Provider access tokens are not retained, and provider organizations, teams, repositories, or hosted-domain claims do not grant access to a Detektu organization.
Purpose: providing the Service, authentication, member management, proof of agreement.
1.2 Service configuration and content
Monitored dependencies, custom source URLs and parsing configuration, usage selections, webhook endpoints, notification settings, API keys (stored hashed). Purpose: the core Service — change detection and impact analysis. Usage selections describe your software’s use of third-party APIs and normally contain no personal information.
1.3 Billing data
When an organization starts paid checkout, we send Paddle the account email and an internal organization identifier. Paid plans are sold by Paddle as merchant of record: Paddle collects your billing and payment details directly, as the seller, under its own privacy notice — we never receive or store payment card details. We receive Paddle customer, transaction, and subscription identifiers, the selected plan, subscription status and billing period, and limited event records needed to operate entitlements and reconcile billing. Purpose: checkout, plan entitlements, billing support, accounting, and tax compliance. Retention follows section 5.
1.4 Emails we send
Verification, password reset, invitations, finding alerts, digests, plan and billing notices. We and our email provider keep delivery and suppression records so we can investigate delivery and avoid repeatedly sending to addresses that hard-bounce or report spam. These are transactional or operational messages requested by, or required to provide, the Service.
1.5 Logs and security
IP address, timestamps, requested endpoints, API-key prefix used, rate-limit events. Purpose: operation, abuse prevention, security incident analysis. Retention: 30 days, longer only for incident investigation.
1.6 First-party product measurement
When you start an organization from a public Detektu page, we may store the site-relative landing path, CTA placement, and normalized campaign labels from that Detektu URL. You may optionally answer “How did you first hear about Detektu?” using a controlled list. We separately record organization-level milestones such as completed signup, first dependency, reviewed usage, confirmed destination, checkout, and subscription activation. These records contain an internal organization identifier and plan, but not your email, name, full referrer URL, destination target, or provider profile. Purpose: measuring whether product explanations, acquisition sources, and onboarding work. The optional answer is attribution, not marketing consent. We do not add an analytics cookie, browser identifier, fingerprint, or cross-site identifier for this measurement.
1.7 What we deliberately do not do
No analytics or advertising trackers, no sale of personal information or sharing for cross-context behavioral advertising, no profiling, and no automated decisions producing legal effects. The vendor documents we monitor (API specs, changelogs) are public vendor content, not your data.
2. Providers and third-party services
We use a small set of providers to operate the Service:
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Hetzner Online GmbH | Application hosting and PostgreSQL | Account, organization, configuration, and operational data | Germany (EU) |
| Cloudflare, Inc. | Public website delivery, object storage, and encrypted backups | Website request data, public vendor snapshots, and encrypted service backups | Global; object storage is configured with a Western Europe location preference |
| Postmark (ActiveCampaign, LLC) | Sending transactional email | Recipient address, email content | USA |
| OpenRouter, Inc. (and routed model providers) | LLM interpretation of vendor documentation excerpts | Public vendor doc excerpts only — never your usage selections, source code, or account data; configured with data-collection denied and zero retention | USA |
Paddle is not our processor but the merchant of record for paid plans (section 1.3): it sells the subscription to you and processes your billing and payment data as an independent, accountable organization under the Paddle Privacy Policy.
If you choose federated sign-in, GitHub or Google receives the sign-in request and provides the profile information described in section 1.1. Their processing is governed by the GitHub Privacy Statement or Google Privacy Policy. Detektu uses the resulting access token only to complete that sign-in and does not retain it.
3. International transfers
Primary account, organization, and configuration data is stored in Germany (EU). Public vendor snapshots and encrypted service backups are stored with Cloudflare R2, configured with a Western Europe location preference. Our providers may process data in Canada, the USA, and other countries. Information processed outside your country may be accessible to courts, law enforcement, or national-security authorities under local law. We remain accountable for personal information under our control as PIPEDA requires.
4. When we disclose
We disclose personal information only to the providers above, when required by law or legal process, to protect our rights or users’ safety, or as part of a business transaction (merger, acquisition) under confidentiality. We do not sell personal information.
5. Retention
- Account, organization, and service-configuration data: for the duration of the agreement; deleted or de-identified from active systems within 90 days after a verified deletion request or termination.
- Encrypted backups: expire automatically within 45 days and are isolated from ordinary use. A deletion takes effect in a backup when that backup expires.
- Terms-acceptance records and records needed to establish, exercise, or defend legal claims: until the applicable limitation period expires.
- Billing and tax records: generally six years from the end of the last Canadian tax year to which they relate, and longer where law requires.
- Logs: per section 1.5.
- Email delivery and suppression records: for as long as needed to investigate delivery and protect the sending service from abuse.
- Vendor snapshots and findings are Detektu’s own dataset of public vendor content and are not linked to a deleted organization after deletion.
6. Your rights
Wherever you are, you can ask to access or correct the personal information we hold about you, withdraw consent where processing depends on consent (which may end our ability to provide the Service), or request deletion of your account. Contact legal@detektu.com; we respond within 30 days. You may challenge our compliance or complain to the Office of the Privacy Commissioner of Canada.
7. Regional provisions
The Service is currently not offered to customers in Quebec, the EEA, or the UK. Detektu does not sell personal information or share it for cross-context behavioral advertising. Where local law grants additional rights (e.g. US state privacy laws, Australia’s Privacy Act, Brazil’s LGPD), we honor requests via the section 6 contact.
8. Customers’ own compliance
Content you submit (e.g. team member emails you invite) may contain personal information of your staff; you are responsible for having the authority to share it with us. Detektu acts as your service provider for such content when applicable.
9. Cookies
Detektu sets only cookies that are strictly necessary to operate the Service:
| Cookie | Purpose | Type | Lifetime |
|---|---|---|---|
detektu_session | Authenticated dashboard session (server-side session reference) | First-party, HttpOnly, Secure | 7 days |
detektu_federated_flow | Completing a GitHub/Google sign-in you started (set only during that sign-in) | First-party, HttpOnly, Secure | 1 hour |
Protection against cross-site request forgery uses a request header (X-CSRF-Token), not a cookie.
These cookies are strictly necessary to provide authentication and security for the Service requested by the user. We do not use them for analytics or advertising and do not request consent for them.
When you choose GitHub or Google sign-in, your browser visits that provider, which may use cookies on its own service under its privacy notice. When billing is available and you visit the plan page, Paddle.js requests localized prices; Paddle may process device and network information and use cookies or similar technologies under its privacy notice. Paddle also operates the checkout you choose to open. Detektu does not control those third-party technologies.
If Detektu introduces analytics, advertising, or other non-essential storage technologies, this policy will be updated and consent obtained beforehand where required.
10. Safeguards
Personal information is protected by safeguards appropriate to its sensitivity: encryption in transit, hashed credentials and API keys, tenant isolation enforced at every layer, least-privilege access, and provider contracts. We notify affected users and the relevant regulator of any breach creating a real risk of significant harm, as PIPEDA requires.
11. Changes to this policy
We update this policy when the Service or its providers change. The current version is always available in the footer; superseded versions remain available at stable, versioned URLs. Material changes are announced by email.