Privacy Policy
Last updated: August 2026
1. Information We Collect
Account information (email, name, organization), scan targets and results, API usage metrics, integration credentials (encrypted), payment information (processed by Polar, never stored by us), browser metadata for analytics, and cookies for session management. Analytics: we run self-hosted Umami on our own infrastructure to measure aggregate page views and referrers. Umami does not use cookies, does not collect personal data (no IP tracking, no user IDs, no cross-site tracking), and is loaded only after you accept via the consent banner. With your consent we also load Microsoft Clarity to collect session insights (page interactions, heatmaps, and recordings of browsing sessions) — Clarity uses cookies and is loaded only after you accept; it is disabled if you decline or withdraw consent.
2. How We Use Your Information
To provide and maintain the Service, process scans and deliver results, manage your subscription and billing, send service-related communications (scan completions, security alerts, billing notices), improve the Service, and comply with legal obligations.
3. Data Storage and Security
All data is stored in encrypted PostgreSQL databases on EU-based servers. Credentials are encrypted with Fernet symmetric encryption (AES-128-CBC). Scan data is encrypted at rest. API communications use TLS 1.3. We maintain SOC 2 Type II compliance practices.
4. Data Sharing
We do not sell your data. We share data only with: Polar (payment processing), Resend (email delivery), our infrastructure providers (database, hosting), and third-party services you explicitly connect via integrations. All third-party processors are bound by data processing agreements.
5. Your Rights
You have the right to access, export, correct, or delete your personal data at any time. You may revoke third-party integrations at any time. To exercise these rights, contact support@vergate.dev or use the account deletion feature in Settings. We respond to requests within 30 days.
6. Cookies and Tracking
We use essential cookies for session management (JWT tokens stored in HttpOnly cookies). We do not use third-party analytics, advertising cookies, or tracking pixels without consent. Usage analytics are collected with self-hosted Umami, which is cookieless by design: it stores no cookies, collects no personal data, and tracks no users across sites. If you accept via the consent banner, we additionally load Microsoft Clarity, which records session interactions (mouse movements, clicks, scrolls, and heatmaps) using cookies — Clarity data is stored by Microsoft and is only collected after explicit consent. The Umami tracker and Clarity are only loaded after you explicitly accept via the consent banner shown on first visit; you may decline them, or withdraw your consent at any time using the 'Cookie settings' link in the footer. Declining or withdrawing analytics consent does not affect the Service's functionality. We do not share analytics data with third parties aside from Clarity (operated by Microsoft) when you have consented.
7. Data Retention
Active account data is retained while your account is active. Deleted accounts: data is purged within 30 days. Free scan data: retained for 90 days. Paid scan data: retained until you delete it or your subscription lapses (30-day grace period). Backup data: purged within 60 days.
8. Contact
Privacy questions? Contact our Data Protection Officer at privacy@vergate.dev. For general inquiries: support@vergate.dev.