Privacy Policy
Effective date: 2026-10-17
We are established in Romania, so the EU General Data Protection Regulation (GDPR) applies to all the processing described here. Items marked (GDPR) give the GDPR-specific details.
1. Who we are
keptsec is operated by Secure Stack Consulting S.R.L., Romania (“we”, “us”). We decide how the personal data described here is used. (GDPR: we are the “controller” for this data. We are established in the EU, so we do not need an EU representative.)
Contact for anything about privacy: legal@keptsec.com.
2. Our approach: collect as little as possible
We sell software and machine-generated documents. We do not need much personal data to do that, so we collect only what the Service needs to work, to bill through our merchant of record, and to prevent abuse.
We do not sell personal data, we do not share it for advertising, and we do not use advertising or cross-site tracking cookies.
3. What we collect and why
3.1 Website visits
Our website is hosted on Cloudflare. When you visit, Cloudflare processes technical data such as your IP address, browser user agent, the pages requested and the time, in order to deliver the site and protect it from attacks. We do not add analytics that identify you. If we use statistics, they are aggregate and cookie-free.
3.2 Purchases (handled by Polar)
Paid plans are sold by Polar, our merchant of record. Polar collects your payment details through its payment processor (Stripe), and handles tax, invoices and receipts. We never receive your full card number. Polar’s own privacy policy applies to the data it collects: https://polar.sh/legal/privacy-policy.
Polar shares with us what we need to give you access and support: your name, email address, organisation name, billing country (and tax ID if you gave one), the plan you bought, and order, subscription and refund status.
Purpose: deliver the plan you bought, manage your subscription, answer billing questions. (GDPR: legal basis is performance of a contract, Article 6(1)(b), and legal obligations, Article 6(1)(c), for records we must keep.)
3.3 Access to paid deliverables
To give you access to the private registry, signed artifacts and documents, we store your organisation name, the email addresses you register, and the API keys or registry tokens we issue (stored only in hashed form). When a key or token is used, we log the time, the key identifier, the item requested, the IP address and the response status.
Purpose: authenticate requests, meter usage against your plan, detect leaked or abused keys. (GDPR: performance of a contract, and our legitimate interest in security, Article 6(1)(f).)
3.4 Oracle API and MCP server
When you or your software agent query the oracle, we log: the package, version or call you asked about; the time; your API key identifier (if you use one); the user agent; the response status; and your IP address. Free-tier quotas are counted against a hashed form of your IP address. The full IP address is kept only in short-lived security logs (see section 4) so we can detect abuse.
Please do not put secrets, credentials or proprietary source code into oracle queries. The oracle only needs package names, versions and call names.
Purpose: enforce rate limits and the free quota, meter paid usage, prevent abuse, and measure verdict quality. (GDPR: legitimate interest in running and securing the API, and performance of a contract for paid usage.)
3.5 The GitHub App
If you install our GitHub App on a repository, GitHub sends us events for pull requests in that repository. The App can read:
- pull request metadata: repository name, pull request number, title, branch names, author’s GitHub username, and the list of changed files;
- repository contents needed to work out which dependencies change, mainly dependency manifests and lockfiles.
We keep: the installation identifier, the repository name, the pull request number, the list of dependencies found (as package URLs), and the comment we posted. We do not keep copies of your source code. We process file contents only for as long as needed to produce the comment.
The App only comments on pull requests in repositories that installed it. It has no administration or issue write permissions. You can uninstall it at any time in your GitHub settings. GitHub’s own privacy statement applies to your use of GitHub: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement.
Purpose: provide the App’s comments. (GDPR: legitimate interest in providing a tool the repository owner chose to install.)
3.6 Email, support and security reports
If you write to support@keptsec.com or legal@keptsec.com, we keep your email address and the content of the conversation so we can reply and keep a record. (GDPR: legitimate interest in answering you.)
4. How long we keep data
| Data | Retention |
|---|---|
| Oracle query logs, registry and download logs, key usage logs | 30 days, then deleted or reduced to counts with no IP address or key identifier |
| Customer records received from Polar | While your subscription is active, then as long as Romanian accounting and tax law requires for each type of document (Law 82/1991 on accounting) |
| API keys and registry tokens (hashed) | Until revoked or until your plan ends, then deleted within 30 days |
| GitHub App installation and comment records | Until the App is uninstalled, then deleted within 30 days. Comments already posted stay on GitHub unless you delete them. |
| Support and security emails | 2 years after the last message, unless needed for a legal claim |
5. Who we share data with
We share personal data only with service providers that help us run the Service, and only what each one needs:
- Polar (merchant of record): payments, tax, invoices, refunds. Polar is responsible for the payment data it collects.
- Stripe, through Polar: card processing.
- Cloudflare: website hosting, DNS, the oracle API (Workers), storage of build evidence (R2), and protection against attacks. Privacy policy: https://www.cloudflare.com/privacypolicy/
- GitHub: hosting of our public repositories and the GitHub App platform.
- Cloudflare Email Routing: receives email sent to our keptsec.com addresses and forwards it to our mailbox.
- Google (Gmail), our mailbox provider: stores the support and legal email we receive and send, so we can read and answer it. Privacy policy: https://policies.google.com/privacy
We may also disclose data if the law requires it, or to protect the Service and its users from fraud or abuse. If Secure Stack Consulting S.R.L. is ever sold or merged, this policy will continue to apply to data collected under it.
Transfers outside the EU. Polar, Stripe, Cloudflare, GitHub and Google are based in the United States and may process data there. Google says that information may be processed on its servers outside the country where you live, including in the United States. For these transfers we rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses (GDPR Articles 45 and 46). Google states that Google LLC is certified under the EU-U.S. Data Privacy Framework and that Google also relies on standard contractual clauses where required.
6. Your rights and data requests
You can ask us to give you a copy of your data, correct it, delete it, or stop using it, by writing to legal@keptsec.com. We may need to confirm your identity first. For data held by Polar or GitHub, you can also ask them directly.
(GDPR: you also have the rights to restrict processing, to object to processing based on legitimate interests, and to data portability. We answer within one month. You can complain to a data protection supervisory authority, in particular in the country where you live or work. Our lead authority is Romania’s National Supervisory Authority for Personal Data Processing (ANSPDCP), https://www.dataprotection.ro.)
Depending on where you live, other privacy laws may give you similar rights. We honour them the same way.
7. Security
We use encrypted connections (TLS), store keys and tokens only in hashed form, give our systems the least access they need, and keep personal data out of our build logs and public repositories.
8. Children
The Service is for software developers and organisations. It is not directed at children under 16, and we do not knowingly collect their data.
9. Changes to this policy
We will post any changes at keptsec.com with a new effective date. If a change materially affects how we use your data, we will also tell paying customers by email before it takes effect.
10. Contact
Secure Stack Consulting S.R.L., Romania. Privacy and legal: legal@keptsec.com. Support: support@keptsec.com.
This website itself sets no cookies and loads no third-party scripts, fonts or trackers.