Privacy Policy

1. Who we are

StackGrit, at stackgrit.com and app.stackgrit.com, is operated by Kolliaugu OÜ, a company registered in Estonia. In this policy "StackGrit", "we", "us" and "our" refer to Kolliaugu OÜ.

This policy explains what personal data we collect, why, who we share it with, how long we keep it and what rights you have. For any privacy question or request, contact us at info@stackgrit.com.

2. Our role

For your account, billing, emails and use of our website, we are the controller of your personal data under the EU General Data Protection Regulation (GDPR).

The repositories you submit can also contain personal data, such as commit author names and email addresses in the git history. For that data we act as a processor on behalf of the organization that submitted the repository, and we process it only to provide the analysis they asked for. If you are a contributor to a repository analyzed on StackGrit, please direct requests about that data to the organization that uses StackGrit; we will help them respond.

3. Information we collect

• Account information: your name, email address and password (stored only as a secure hash), or the profile details provided by GitHub or Google when you sign in with them.
• Organization information: organization names, team members, roles and invitations.
• Connected accounts: access tokens and installation details for GitHub, Bitbucket and other integrations you connect.
• Source code and repository data: the code, commit history, commit messages and contributor names and email addresses of the repositories or ZIP files you submit.
• Analysis results: reports, findings, scores, contributor insights and your conversations in the project chat.
• Billing information: subscription and invoice details. Payment card data is collected and stored by Stripe; we never see your full card number.
• Technical and usage data: IP address, browser and device information, pages visited, and error reports when something goes wrong in the app.
• Communications: emails you send us and the delivery status of emails we send you.

4. How we use it and why

• To provide the service: create your account, analyze your repositories, show reports, run the project chat and send the emails the service depends on, such as verification, invitations and analysis notifications. Legal basis: performance of our contract with you.
• To handle payments and keep accounting records. Legal basis: performance of contract and our legal obligations.
• To keep the service secure and working: detect abuse, monitor errors and fix failed analyses. Legal basis: our legitimate interest in running a reliable, secure service.
• To improve StackGrit using aggregated usage and website analytics. Legal basis: our legitimate interest in understanding how the product is used.
• To send product updates and newsletters to our users. Legal basis: our legitimate interest in informing customers about the service. Every such email has an unsubscribe link.

We do not sell your personal data, and we do not use it for advertising.

5. How we handle your source code

• Connected repositories are cloned into an isolated working directory on our analysis workers and deleted when the analysis or chat session finishes.
• Uploaded ZIP files are stored until you delete the project, because there is no repository to fetch the code from again for later analyses.
• Reports and chat history are kept and can reference file paths and short excerpts of your code.
• Code is sent to our AI provider, Anthropic, to perform the analysis. Neither we nor Anthropic use your code to train AI models.
• To check dependencies for known vulnerabilities, we send dependency names and version numbers, but no source code, to public vulnerability databases and package registries.
• StackGrit staff only access your data to help with a support request you raise or to fix a failed analysis.

6. Who we share data with

• Service providers (subprocessors) that host and run StackGrit on our behalf, such as our database, AI, hosting, payment and email providers. They may only use the data to provide their service to us. The full list, with what each one does and where it processes data, is on our Subprocessors page.
• People you share reports with. Anyone who has a report share link you create can view that report.
• Integrations you use. When you create an issue from a finding, its text is sent to the issue tracker you chose, such as your GitHub repository.
• Authorities, when we are legally required to disclose data.
• A successor business, if StackGrit is merged or sold, under the same protections described in this policy.

7. International data transfers

Several of our service providers, including our database, AI and hosting providers, process data in the United States. When personal data is transferred outside the European Economic Area, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.

8. How long we keep data

• Cloned repositories: deleted when the analysis or chat session finishes.
• Uploaded ZIP files: until you delete the project.
• Reports, findings and chat history: until you delete the project or your organization.
• Account and organization data: while your account is active. When you ask us to delete your account, we delete it within 30 days.
• Invoices and accounting records: 7 years, as required by Estonian accounting law.
• Error reports: up to 90 days.

9. Cookies and analytics

In the StackGrit app we only use cookies and browser storage that are strictly necessary to keep you signed in and remember your preferences. We measure traffic with Cloudflare Web Analytics, which does not use cookies or track you across sites. Fonts are loaded from Google Fonts, which receives your IP address.

On our website, stackgrit.com, we also use Microsoft Clarity to see how visitors use the pages through heatmaps and session recordings. Clarity sets cookies to recognize repeat visits. You can block these cookies in your browser settings without affecting the website or the app.

Stripe sets its own cookies on its checkout and billing pages to prevent fraud.

10. Security

Data is encrypted in transit and at rest by our infrastructure providers. Repositories are processed in isolated working directories and deleted afterwards, access to integrations uses scoped tokens, and access within StackGrit is limited by organization roles. No method of storing or transmitting data is completely secure, but we work to protect your data and will notify affected customers and authorities of a personal data breach as the law requires.

11. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you
• correct inaccurate data
• have your data deleted
• receive your data in a portable format
• object to or restrict processing based on our legitimate interests
• unsubscribe from product emails at any time

To use any of these rights, email info@stackgrit.com. We respond within one month. You can also lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee) or the data protection authority in your country.

12. Children

StackGrit is a business service and is not intended for anyone under 16. We do not knowingly collect data from children.

13. Changes to this policy

We may update this policy as StackGrit changes. We will post the new version on this page and update the "Last updated" date. If a change materially affects how we use your data, we will also notify you by email before it takes effect.

14. Contact us

Kolliaugu OÜ
Registry code 16120597, VAT number EE102349449
Kolliaugu, Pulli küla, Kambja vald, 62018 Tartumaa, Estonia
info@stackgrit.com