Invited-beta privacy notice
How VSRX handles beta information
This draft notice describes the intended free, invitation-only external beta of VSRX, including what it would collect, why it would be used, and the choices available to participants. The external beta is not available until its invitation controls pass verification. Approved versions will require affirmative recorded acceptance; viewing this page alone does not constitute acceptance.
1. Information we collect
- Account information: email address, user ID, workspace membership, role, and authentication-related events.
- Project and scan metadata: workspace details, target paths, scan status, timestamps, findings, review decisions, redacted evidence, and report history.
- Invitation and support information: invitation status, service communications, and information you provide when asking for help or exercising a privacy choice.
- Technical information: device, browser, security, diagnostic, and request information needed to operate and protect the Service.
2. What we do not need
The local-first scan workflow is designed to send scan results, metadata, and redacted evidence rather than raw project source files. You remain responsible for removing secrets and personal data from anything you choose to submit.
3. How we use information
We use information to provide and secure the Service, authenticate users, generate reports, maintain workspace boundaries, process invited-beta access, provide support, investigate abuse or incidents, communicate service changes, and improve reliability. We do not sell personal information.
4. Providers and disclosures
The operator reports that the intended beta configuration uses the providers below. Their activation and processing details remain pending independent sanitized evidence, and the external beta is not yet available. When enabled, information would be shared only as needed for them to provide their described services:
- Supabase: authentication and database hosting;
- Vercel: application hosting and delivery;
- Sentry: error monitoring and diagnostics;
- Resend: transactional email delivery; and
- Upstash: rate limiting and abuse protection.
We may also disclose information where required by law, to protect rights and safety, or as part of a merger, acquisition, financing, or sale of assets.
5. Retention
We retain information while your beta workspace is active and only as long as needed for the purposes described here, security, dispute resolution, and applicable legal obligations. You may ask for workspace or account deletion using the privacy contact below. The operator will confirm the applicable deletion timing and any records that must be retained before acting on the request. The beta does not promise a fixed retention period that has not yet been operationally approved.
6. Security
We use reasonable administrative, technical, and organisational safeguards, including authenticated access controls and encrypted transport. No online service can guarantee absolute security; tell us promptly if you believe an account or workspace is compromised once security contact configuration is complete.
7. Cookies and similar technologies
VSRX uses essential session and security storage needed for sign-in and the authenticated workspace. The current product does not require advertising cookies. If optional analytics or other non-essential technologies are introduced, this policy and the applicable consent experience will be updated first.
8. Your choices and rights
Depending on where you live, you may have rights to access, correct, export, delete, or restrict processing of your personal information, and to object to or withdraw consent for certain processing. Contact the operator through the support contact provided with your account to make a request. We may need to verify your identity before completing it.
9. International processing and children
The Service may process information in countries other than your own through the providers listed above. We do not knowingly offer the Service to children under the minimum age required by applicable law.
10. Changes and contact
We may update this Policy as the Service or legal requirements change. The updated version will be posted here with a new effective date. Privacy questions should be raised through the the operator once privacy contact configuration is complete.
Contact configuration incomplete; external beta not available.