Privacy Policy

Who we are and what this policy covers

CleanSlop is operated by SHBV Technologies Ltd., a corporation formed under the laws of British Columbia, Canada ("CleanSlop", "we", "us", "our"). This Privacy Policy describes what personal information we collect when you use the CleanSlop website and service (including at app.cleanslop.com), how we use it, who processes it on our behalf, and the rights you have under Canadian privacy law — principally the Personal Information Protection and Electronic Documents Act ("PIPEDA") and, for residents of Quebec, An Act Respecting the Protection of Personal Information in the Private Sector (commonly known as "Law 25").

What we collect

When you use CleanSlop, we collect:

• Account and GitHub identity: GitHub user id, login, display name, avatar, profile creation date (used for referral eligibility when you sign up through a ?ref= link), and OAuth access and refresh tokens needed to sign you in and read repositories you grant.
• Repository and installation data: GitHub App installation ids, repository names and metadata, branch and commit references, and shallow-cloned source extracts used for scanning.
• Scan results: findings, reports, scan status, and related history for the retention window of your plan.
• Optional scan training: when you opt in per repository, we may send scan artifacts to our scan harness for training and quality improvement. Training material may be staged in a separate training store, apart from your dashboard history. You can turn training off per repo or account-wide; turning it off stops new training exports but does not automatically delete material already submitted.
• Billing: Stripe customer and subscription identifiers, payment events, and plan or credit purchase records when you pay.
• Email: a verified email address when GitHub provides one, used for billing display, optional email magic-link sign-in, and product update emails about what's new in CleanSlop (at most once a week). Every product update email has a link to unsubscribe or manage your email preferences; unsubscribing does not affect sign-in or scan emails.
• Triage bookings: meeting time, repository name, scope, optional notes you leave, session id, and attendee emails for you and the assigned engineer when you book a paid triage session.
• Help and feedback: message bodies and thread metadata when in-app Help is configured (PostHog Support tickets keyed by your account id, or our in-house GitHub Issues path when Support is off).
• Product analytics (optional): allow-listed funnel events when PostHog keys are set — account id, plan, result codes, and GitHub login; not email, invite codes, or finding text. Referral funnel events include attribution and signup grant outcomes (not referral slugs in properties). After you Accept, the browser SDK may record pageviews, allowlisted clicks, digest-only errors, and masked session replay.

What we collect automatically

We also collect information automatically when you use the Service:

• IP address. Your IP address may be used for rate limiting, abuse prevention, and security investigations when proxy trust is configured for ingress.
• Session and access cookies. A session cookie keeps you signed in. An invite-clearance cookie may be set when you redeem a code. A signed referral attribution cookie may be set when you open a valid personal ?ref= link before signing up (first-touch, httpOnly). The marketing home page may persist your chosen visual skin in cs-mk-skin. When product analytics is configured, Accept or Decline sets cs_analytics_consent to granted or denied. Dismissing the Product Hunt launch banner sets cs-product-hunt-dismissed.
• Server logs. Standard request metadata for operating and securing the Service.

Sub-processors

The following third-party services process your information on our behalf in order to deliver the Service:

• GitHub, Inc. Sign-in, OAuth tokens, and read-only repository access.
• Stripe, Inc. Payment processing for plans, credits, and triage sessions.
• Resend (when configured). Email magic-link sign-in, optional support or scan notification mail, and product update emails. For product updates, Resend keeps your email address and your subscription preferences.
• PostHog (when configured). Product analytics events; and, when Support is enabled, in-app Help tickets, session replay links, and conversation state (ph_conv_ local storage on your device).
• Scan harness service. Extracted source and scan parameters for analysis; may use a language model on that content for synthesis and judgment steps.
• Google Calendar (when triage is booked). Meeting scheduling for paid triage sessions.
• Slack (optional). Incoming webhook alerts for operations that may include account identifiers, scan or project ids, raw invite codes, repository names, short Help excerpts, and email addresses you submitted.

Several of these providers are United States companies and your data may be processed on servers located outside Canada. By using the Service you consent to these cross-border transfers to the extent required for the features you use. See the international transfer section below.

No advertising, no selling, no marketing sharing

We do not sell your information. We do not rent, trade, or license it to data brokers. We do not share it with advertisers or ad networks. We do not use your repository contents to build marketing profiles, and we do not serve targeted advertising in the Service.

Help and feedback

When PostHog Support is configured, in-app Help tickets go to the PostHog inbox keyed by your account id. Staff reply there. A new ticket includes the page you were on when you started that conversation (Help is not shown on magic-link, share, or transfer URLs). Follow-up messages can include a session id and a session-replay link. The Help chrome may be CleanSlop's or PostHog's built-in widget.

When Support is off and GitHub Help is configured, your messages are stored in our database and mirrored to a GitHub Issues repository we operate. Staff replies may arrive in the widget and, when email is configured, by email. Message-bearing conversations count toward the open-thread limit.

Feedback your coding agent sends for you (cleanslop feedback, or the MCP feedback tool) is stored in our database with the account, the agent's name, and any scan or finding id you name. An excerpt is posted to our Slack, and the message goes to the same PostHog Support inbox as in-app Help, keyed by your account id. No name or email is sent to PostHog with it. Your agent can read staff replies for you.

Public share links

Copy for LLM can mint a time-limited URL under /e/ that shows a scan export without a session. Anyone with the URL can open that snapshot until it expires. The link may appear in LLM-provider logs, browser history, access logs, and clipboards. Rotating the site's auth secret invalidates those links and signs everyone out.

Cookies and local storage

When product analytics is configured, Accept loads posthog-js for analytics cookies, replay, autocapture, surveys, and pageviews. Decline turns those analytics cookies and recordings off. Server-side funnel events can still fire when keys are set, even if you Decline — they use your account id, not your email.

When Help via PostHog Support is configured, a signed-in browser may load posthog-js without Accept and write a ph_conv_ local storage key for the Help session. That key is Help, not analytics. Decline does not remove Help or that key. Signing out or clearing site data clears local Help state; tickets stay with the account in PostHog.

The browser may store your theme choice and a What's new seen marker (local storage and a same-origin cookie with the version only) so we do not repeat the same banner.

Storage, security, and breach notification

Account, billing, and scan metadata are stored in a SQLite database. Extracted repository code and scan artifacts are stored on disk volumes we operate. Data is transmitted over HTTPS. We use safeguards appropriate to the sensitivity of the information, but no system is perfectly secure and we cannot guarantee absolute security.

Breach notification. In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required by Sections 10.1 through 10.3 of PIPEDA, and will keep records of breaches as required by those sections. Where Quebec's Law 25 applies, we will also notify the Commission d'accès à l'information du Québec in accordance with that Act.

Retention and deletion

Scan history is kept for the window advertised on your plan (for example, seven days on Free, longer on paid plans), then emptied from storage while the scan row may remain with cleared payloads. Optional training exports follow operator retention on the harness side and are not governed by the same per-plan scan history window. Account and billing records are kept as needed to run the Service and meet legal obligations.

You can revoke the GitHub App, disconnect repositories, and request account deletion through in-app Help when it is configured. When Help is off, contact [email protected].

Your rights under PIPEDA

Subject to applicable law, you have the right to:

• request access to the personal information we hold about you;
• request correction of information that is inaccurate or incomplete;
• withdraw your consent to our processing of your information where consent is the legal basis;
• request that we delete your information where applicable; and
• file a complaint with a privacy regulator if you are not satisfied with our response.

To exercise any of these rights, email [email protected]. We will respond within 30 days. If you are dissatisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Additional rights for Quebec residents (Law 25)

If you are a resident of Quebec, you benefit from additional protections under Law 25, including the rights in the section above. To the extent applicable:

• Privacy officer. SHBV Technologies Ltd. designates its chief executive officer as the person in charge of the protection of personal information. You can reach our privacy officer at [email protected].
• Cross-border transfer. Sending your data to sub-processors in the United States (see Sub-processors) is a communication of personal information outside Quebec. We rely on your use of the Service and, where applicable, explicit consent for features that require cross-border processing.
• Automated decision-making. Scan findings and AI-generated commentary are produced to assist your review. The Service does not make legally binding or similarly significant automated decisions about you. Nothing we do is intended to trigger the automated decision-making obligations in Law 25 section 12.1.
• Complaint. If you are dissatisfied with our response to a privacy request, you may file a complaint with the Commission d'accès à l'information du Québec.
• Minors under 14. For Quebec residents under 14 years of age, a parent or guardian's consent may be required for certain collection under Law 25. Use the Service only with that consent and with the guardian acceptance described in our Terms of Service.

International data transfer

As described in Sub-processors, using CleanSlop may result in your personal information being transferred to and processed by providers in the United States and other countries. Data processed outside Canada may be subject to foreign laws, including lawful-access laws that differ from Canadian law. If you do not consent to these transfers for the features you use, do not use those features or the Service.

Children

CleanSlop is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has submitted personal information to CleanSlop, email [email protected] and we will delete it.

Under the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13 in a manner inconsistent with COPPA's restrictions. This is why the Service is 13+, not a claim of COPPA certification.

Users who are at least 13 but under the age of majority in their jurisdiction may use the Service only with parent or legal guardian permission as described in our Terms of Service. For GitHub-linked accounts, the GitHub account holder (or their guardian) controls access. Under PIPEDA and comparable Canadian law, information from users under the age of majority is still personal information; parental consent supports meaningful consent for that processing.

If you are in the European Economic Area or the United Kingdom, the Service is also intended for users who are at least 13. Under the GDPR and UK GDPR, when a child's own consent is not sufficient for online services, parental consent is required. The age at which a child may consent on their own varies by country (often between 13 and 16 in EEA member states; 13 in the United Kingdom for information society services). Users below that applicable age need parent or legal guardian permission as described in our Terms of Service.

Changes to this policy; contact

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will also be signalled in-product where practicable. Your continued use of the Service after an update constitutes your acceptance of the updated policy.

For any privacy question, data-access request, correction, or deletion request, email [email protected]. We are the privacy contact for SHBV Technologies Ltd. in respect of CleanSlop.