Last updated: November 10, 2026
1. Introduction
This Privacy Policy explains how Vidoc Security Lab ("Vidoc", "we", "us" or "our") collects, uses and protects personal data when you:
- visit our website at vidocsecurity.com (the "Website"), or
- use the Vidoc platform at app.vidoc.dev and related services (the "Service").
This Policy forms part of our Terms of Service. If you do not agree with it, please do not use the Website or the Service.
This Policy does not restrict our use of aggregated or de-identified information in line with applicable law.
2. Data Controller and Contact
The data controller for personal data processed in connection with the Website and the Service is:
Vidoc Security Lab, Inc.
1111B S Governors Ave STE 21466, Dover, DE 19904, USA
Email: contact@vidocsecurity.com
Vidoc Security Lab, Inc. is headquartered in the United States. Our day-to-day operations, including research & development, engineering and customer support, are carried out in Poland by our subsidiary, Vidoc Sp. z o.o., and our infrastructure is hosted in the European Union. Individuals in the EEA can contact us directly about their personal data at contact@vidocsecurity.com.
For any questions about this Policy or our data practices, contact us at contact@vidocsecurity.com.
3. What Data We Collect
3.1. Website visitors
- Name and surname, email address, company name and other details you provide via contact or demo request forms, newsletter sign-up or direct communication with us
- Technical data, such as IP address, browser type, operating system and pages visited
- Cookie and similar tracking data (see Section 12)
3.2. Account and identity data (Service users)
When you register, log in via a third-party identity provider, or take part in onboarding (including product testing), we collect the data below to authenticate you, create your account and configure your workspace:
- Name (if provided by your identity provider) and email address
- Auth0 user identifier
- Organization identifier and membership information
- Onboarding information you choose to provide (e.g. role, company size, experience)
3.3. Organization and workspace data
- Organization name and internal identifier
- Relationship between users and organizations (membership and roles)
- Settings and configuration associated with your organization
3.4. Codebase and repository data
When you connect repositories and run scans, we process:
- Repository metadata (e.g. name, owner, size, branches)
- Source code files and file paths from your repositories
- Pull request metadata (e.g. title, branch, commit SHA, PR identifier)
- Code platform profile data of pull request authors and commenters (username, name, email address and avatar)
- Comments and replies in pull requests, including feedback on findings and reactions
- Security issues identified in your code (including file path, location, severity and category)
- AI Chat conversations (your questions and the responses)
- Memory and learnings (rules and context saved from your team's feedback)
- Scan configuration (e.g. which branches and files are scanned)
3.5. Usage and analytics data
- Actions taken in the product (e.g. scans started, issues triaged)
- Number of scans and files scanned per organization
- Technical logs and telemetry (timestamps, request metadata, performance metrics)
- Limited product analytics to understand feature usage and improve the Service
3.6. Billing and subscription data
- Subscription plan and status
- Basic billing metadata (e.g. organization ID, plan type, usage limits)
- Stripe customer identifier
We do not store full payment card numbers. These are handled by our payment processor, Stripe.
4. How We Use Your Data and Legal Bases
Where the GDPR or UK GDPR applies, we rely on the following legal bases:
| Purpose | Examples | Legal basis |
|---|---|---|
| Provide and operate the Service | Authenticating users, connecting GitHub repositories, running scans, displaying security issues and scan history | Contract (Art. 6(1)(b) GDPR) |
| Respond to inquiries and demo requests | Replying to contact forms, emails and requests for a demo or quote | Steps prior to entering into a contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) |
| Manage subscriptions and billing | Creating subscriptions, enforcing usage limits, invoicing via Stripe | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Secure the Service | Monitoring for abuse, unauthorized access and security incidents; audit logs | Legitimate interest (Art. 6(1)(f)) |
| Improve the Website and the Service | Website traffic analytics, product analytics, debugging, performance optimization | Legitimate interest (Art. 6(1)(f)) |
| Transactional communication | Onboarding emails, subscription notifications, security updates, support | Contract (Art. 6(1)(b)) |
| Marketing | Newsletter, product updates and marketing emails | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Legal compliance | Accounting, tax and responding to lawful requests | Legal obligation (Art. 6(1)(c)) |
| Support product testing and early access | Processing onboarding data, usage patterns and feedback from users in beta or evaluation programs | Legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, our interest is to run, secure and grow our business, provided it is not overridden by your rights.
5. Customer Code and Scan Data
When you connect repositories to the Service, any personal data contained in your source code or scan results is processed on behalf of your organization. In that case, your organization is the data controller and Vidoc acts as a data processor. This processing is governed by our Terms of Service and, where applicable, a Data Processing Agreement with your organization.
This Policy covers personal data for which Vidoc is the controller, such as account, usage, billing and Website data.
6. AI and Model Training
We use artificial intelligence (AI) and large language models (LLMs) to support code analysis and security issue validation.
We do not use your codebase, scan results or other user data to train or fine-tune our own or third-party AI models, other than transient processing strictly necessary to provide the Service.
We may log prompts and responses in a limited, access-controlled way for debugging, safety and abuse prevention, but never to train models on your proprietary data.
7. Service Providers
We share personal data only with providers that help us deliver the Website and the Service. Each receives the minimum data needed for its function, under a data protection agreement, and may not use the data for its own purposes.
| Provider | Purpose | Applies to |
|---|---|---|
| Vidoc Sp. z o.o. (Poland) | Research & development, engineering, customer support | Website and Service |
| AWS | Cloud infrastructure and storage (code files, scan data) | Service |
| PlanetScale | Database hosting | Service |
| Temporal Cloud | Workflow orchestration for scans | Service |
| Axiom | Application logs | Service |
| AI providers (e.g. OpenAI, Google Gemini, Azure OpenAI, VoyageAI) | Code analysis and embeddings, strictly to provide the Service | Service |
| OpenRouter | Routing of requests to third-party AI models, strictly to provide the Service | Service |
| Braintrust | Monitoring and evaluation of AI model requests and responses | Service |
| GitHub | Repository integration and pull request data | Service |
| Auth0 | Authentication | Service |
| Stripe | Subscription management and payment processing | Service |
| PostHog | Product analytics | Service |
| Sentry | Error and performance monitoring | Service |
| Mixpanel | Website and product analytics | Website |
| Customer.io | Email communication and marketing | Website |
| Cloudflare | Website hosting and content delivery | Website |
We may also disclose data where required by law or to protect our rights, or to a successor in the event of a merger or acquisition.
8. Where We Process Data and International Transfers
We store customer data, including code files, scan data and databases, in data centers located in the European Union. Our engineering, R&D and support teams are based in Poland.
Some of the service providers listed in Section 7 may process personal data outside the European Economic Area (EEA), mainly in the United States. Where data is transferred outside the EEA, we rely on:
- Standard Contractual Clauses approved by the European Commission,
- the EU–US Data Privacy Framework, where the provider is certified, and/or
- other lawful transfer mechanisms recognized under applicable data protection laws.
9. Data Retention
We keep personal data only as long as needed for the purposes it was collected for, to meet legal, accounting or reporting obligations, and to resolve disputes. In particular:
- Account and organization data – while your organization has an active account and for a reasonable period afterwards.
- Code and scan data – for the duration of the subscription and a limited period after termination (for backups and legal compliance), after which it is deleted or anonymized.
- Inquiries and sales contacts – up to 1 year from our last contact.
- Marketing data – until you unsubscribe or withdraw consent.
- Cookies – as described in Section 12.
Contact us if you need details on retention periods for your organization.
10. Data Security
We use technical and organizational measures to protect your data, including:
- encryption of data in transit and at rest where appropriate (e.g. code files and database records),
- access controls and authentication limiting access to authorized personnel,
- audit logging and monitoring for anomalous activity.
No method of transmission or storage is completely secure, but we apply industry-standard safeguards.
11. Your Rights
Depending on your jurisdiction, you may have the right to:
- access the personal data we hold about you,
- correct inaccurate or incomplete data,
- request deletion of your data,
- restrict or object to certain processing, including direct marketing at any time,
- receive a copy of your data in a portable format,
- withdraw consent at any time, without affecting earlier processing.
To exercise your rights, contact us at contact@vidocsecurity.com. We may need to verify your identity first, and we aim to respond within 30 days.
If you are in the EEA or UK, you can also lodge a complaint with your local data protection authority. In Poland, this is the President of the Personal Data Protection Office (UODO).
12. Cookies and Tracking Technologies
Our Website uses cookies and similar technologies to run the site, analyze traffic and support marketing. We use:
- Essential cookies – required for basic Website functionality,
- Performance cookies – help us understand how visitors use the Website,
- Functional cookies – remember your preferences,
- Marketing cookies – used for analytics and targeted advertising.
Non-essential cookies are used only with your consent, which you can change at any time in our cookie banner or browser settings. Disabling some cookies may affect how the Website works.
13. Children's Privacy
The Website and the Service are not intended for children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact us.
14. Changes to This Policy
We may update this Policy from time to time and will revise the "Last updated" date above. For material changes, we may provide additional notice, for example by email or in the Service.
15. Contact Us
For questions, concerns or requests about this Policy or our data practices, contact us at:
Vidoc Security Lab, Inc.
Email: contact@vidocsecurity.com