Privacy Policy

We process the minimum data required to find and fix vulnerable dependencies.
This page says exactly what that is, what leaves your repository, how long we
keep it, and what you can require of us.

1. What we collect¶

• GitHub installation ID and username
• Repository names
• Dependency manifests — \package.json\, \
  equirements.txt\ and equivalents
• Webhook event metadata used to trigger analysis

2. Your source code¶

The product has two paths, and they treat your code differently. The distinction matters, so it is stated plainly rather than summarised.

Default · always on: Automated remediation
- When: Runs by default on every installed repository
- Reads: Dependency manifests and advisory metadata
- Stores: Findings, advisory references, and ledger entries
- Source code is not read or stored

Opt-in · you trigger it: Code Intelligence (Chat)
- When: Only when a user explicitly indexes a repository
- Reads: Source files: .py, .js, .ts, .java, .go, .rs
- Stores: Code chunks and vector embeddings in codebase_index
- Source code is stored while indexed

If you never index a repository, no source code is stored. If you use Code Intelligence, the files you index are chunked, embedded and kept until you remove the repository or the retention window in section 6 elapses. Indexing covers .py\, .js\, .ts\, .java\, .go\, .rs.

3. AI processing¶

Manifest content, advisory text and — where you have enabled code indexing — source chunks are sent to Google Gemini in \us-central1\ for analysis, fix generation and embedding.

• We do not store prompts ourselves. What Google retains is governed by the Gemini API terms that apply to our account, which vary by tier and billing status — we will not restate them here as a guarantee we are not the party making.
• Retrieved source is fenced as untrusted data before it reaches the model, so a file cannot pose as an instruction to it.
• Retrieval is filtered to a single repository at the database boundary, so a prompt cannot be assembled from another customer's code.
• Inference currently runs under our own model key. Customer-managed keys are not yet implemented; if you need inference on an account you control, ask us before assuming it.

4. How we use data¶

• Identifying vulnerable dependencies against advisory databases
• Opening remediation pull requests on your behalf
• Maintaining the forensic incident ledger for your organisation

We do not sell your data, and we do not use it for advertising.

5. Legal basis¶

If you are in the UK or EEA, the GDPR requires a legal basis for processing. We rely on:

• Contract: when you install the app, we process your data to provide the service
• Legitimate interest: for aggregate telemetry that improves the product without identifying you
• Consent: you explicitly trigger Code Intelligence when you want it

6. Retention¶

Ledger entries are hash-chained and are not deleted inside the retention window — removing one would break the chain the Verification Guide lets you check. The same windows are set out in the Data Processing Agreement.

7. Your rights¶

You can exercise any of these by writing to privacy@omnisentient.ai. We respond within 30 days.

• Access: A copy of the personal data we hold about you
• Rectification: Correction of inaccurate or incomplete data
• Erasure: Deletion of your data, subject to the ledger constraint above
• Portability: Your data in a structured, machine-readable format
• Restriction: Limit how we process your data while a dispute is resolved
• Objection: Object to processing carried out under legitimate interest
• Complaint: Raise the matter with your supervisory authority

8. Where data is processed¶

Processing takes place in the United States. If you are in the EEA or the UK, your data is transferred there under Standard Contractual Clauses.

| Supabase | Managed database | \AWS us-east-1\ |

| Vercel | Application edge | \Global CDN\ |

| Google Cloud | Gemini inference and embeddings | \us-central1\ |

| GitHub | Version control and webhooks | \us-east-1\ |

The full list, and what each one receives, is on the Subprocessor Disclosure page.

9. Cookies¶

• \omni_session\: Strictly necessary — keeps you signed in
• CSRF token: Strictly necessary — prevents cross-site request forgery

We set no advertising or analytics cookies. See the Cookie Policy for detail.

10. Security¶

• TLS 1.3 for data in transit
• AES-256 encryption at rest
• PostgreSQL row-level security isolating one organisation's data from another

The controls are described in full, with what is and is not enforced, in the Security Policy.

11. Changes to this policy¶

Material changes are announced 30 days before they take effect, and the version and date at the top of this page are updated. Previous versions are available on request.

12. Contact¶

Data protection: privacy@omnisentient.ai

Revision history¶