Privacy Policy

What We Collect

• Account information (email, profile)
• Code snippets (explicitly uploaded)
• Vector embeddings (not source code)
• Payment and transaction information
• Tax information (W-9 forms) - Required by IRS for contractors earning $600+/year
• Usage data (for platform improvement)
• Email addresses (for white paper downloads and research communications)
• Research data (code metrics from public repositories - see Research Data Policy)

What We DON'T Store

• Full source code files
• Complete codebases
• Payment card numbers (handled by Stripe)
• Sensitive credentials

How We Use Your Data

• Analyze code health and generate audit reports
• Process subscription payments
• Provide code health predictions and insights
• Improve the platform (anonymized)
• Send research updates and white papers (if you've downloaded our research)
• Conduct research on code health and business outcomes (public repositories only - see Research Data Policy)

Email Communications

If you download our white papers or subscribe to research updates:

• We collect your email address to send you the requested content
• We may send you updates about new research findings
• You can unsubscribe at any time using the link in our emails
• We use Resend for email delivery (privacy-focused, GDPR compliant)
• Your email is not shared with third parties

To unsubscribe, click the unsubscribe link in any email or contact us at research@echeo.io

Your Rights

• Access: View your data anytime
• Deletion: Delete your account and data
• Portability: Export your data
• Opt-out: Disable notifications or unsubscribe from emails
• Research Opt-out: Request removal of your repository from research (see Research Data Policy)
• GDPR Rights: Right to access, rectification, erasure, portability, and objection (see GDPR Compliance)
• CCPA Rights: Right to know, delete, and opt-out of sale (California residents)

Security

• All data encrypted at rest and in transit
• API keys encrypted using AES-256-GCM
• Tax identification numbers (TIN/SSN/EIN) encrypted using AES-256-GCM
• Row-level security (RLS) policies
• HTTPS enforced for all connections
• Email addresses stored securely and not shared with third parties

Third-Party Services

We use the following third-party services that may process your data:

• Resend: Email delivery (privacy-focused, GDPR compliant)
• PostHog: Product analytics (privacy-focused, GDPR compliant)
• Supabase: Database and authentication (SOC 2 compliant)
• Stripe: Payment processing (PCI-DSS Level 1)

All third-party services are compliant with GDPR and other privacy regulations.