Privacy Notice

1. Data we process

Account: your GitHub username, email and identifier, received when you sign in with GitHub.

Repositories: the repositories you choose to connect, read with read-only permission. We store review results (findings, code excerpts as evidence, screenshots from the test environment) and, if you paste it, your database structure (table and permission definitions, never rows).

Payments: handled by Paddle. We never see or store your card details; we receive the purchase confirmation to assign your credit.

Form and email: if you write to us or request a review through the form, we keep your name, email and message.

Technical: strictly necessary cookies to keep you signed in and server technical logs. We do not use advertising cookies and we do not sell data.

2. Why we use it

To provide the service (checks, reviews, reports and credits), handle payments and refunds, reply to you, keep the service secure and meet legal obligations. The legal basis is performing the service you request and, where applicable, your consent or our legitimate interest in protecting the service.

3. Who we share it with

Only with the providers needed to run UserB, each for its own function: Paddle.com (reseller and Merchant of Record; processes payments), GitHub (sign-in and read access to your repositories), Supabase (platform database and authentication), Vercel (website hosting), Modal (isolated virtual machines where your app is rebuilt and tested), OpenAI (reads excerpts of your app's screens to prepare the tests; requested without storage at OpenAI) and Resend (email delivery).

Some of these providers process data outside Guatemala, mainly in the United States. We do not sell or rent your data.

4. How long we keep it

Each review's temporary environment, with its copy of the code and its fictitious data, is deleted when the review ends. Results and reports are kept while you have an account. If you disconnect a repository or uninstall the GitHub App, we delete the derived projects and results. Payment records are kept as long as the law requires.

5. Your rights

You can request access to, correction or deletion of your data, or deletion of your account, by writing to hola@userb.app. We reply within a reasonable time, usually under 30 days.

6. Security

Each account only sees its own data (database-level access control), service keys never reach the browser or the test machines, and reviewed code runs isolated from our infrastructure. No system is infallible; if we detect an incident affecting your data, we will tell you.

7. Changes

If we change this notice materially, we will tell you before it applies.