Privacy notice

Draft version 0.2 · Drafted 2026-09-27 · Not yet in effect — pending legal review

1. Who we are

VentureLint is a brand of Sofus (Dutch Chamber of Commerce/KvK 50937782). [OWNER: legal form and postal address of Sofus.]

For personal data about your VentureLint account and your use of the service, Sofus is the controller.

Contact for privacy questions and requests: privacy@venturelint.com.

[COUNSEL: confirm whether a Data Protection Officer must be appointed. None is appointed today.]

2. What this notice covers and current status

This notice covers the website at venturelint.com, the signed-in workspace, the VentureLint GitHub App, assessment reports, and report share links.

Live assessments of private repositories are not yet enabled in production. The public demo on the website uses fixed sample data only: no repository is connected and no customer code is processed. This notice describes the processing that takes place once you sign in and, when enabled, connect a repository.

Signing in with GitHub and connecting a repository are required to use VentureLint; without them we cannot run an assessment. Answering the founder declaration is optional. If you leave a declaration question unanswered, the related control is shown as not determined in the report.

3. Personal data we process

Your GitHub identity

When you sign in with GitHub we receive and store your numeric GitHub user ID, your GitHub login, your display name, and your avatar URL. We do not request or store your email address. The GitHub access and refresh tokens issued during sign-in are discarded immediately after we read your identity; they are not stored.

Sign-in and session data

• A session token held in a secure, HTTP-only cookie. We store only a SHA-256 hash of the token, with its creation, last-seen, and expiry times.
• Short-lived sign-in and installation setup records, which contain only hashes of random security values and expire after 10 minutes.

Workspace data

Your workspace (organization), your membership and role, and the projects you create.

GitHub installation and repository metadata

The GitHub App installation ID, the GitHub account it is installed on, the permissions GitHub granted, and for each repository you connect its GitHub ID, owner and name, default branch, and latest known commit.

Repository contents during an assessment

To run an assessment, VentureLint retrieves the repository at the exact commit you select, and, only if you enable it, a bounded part of its commit history for secret scanning. Repository contents can include personal data, for example names or email addresses in source files or commit history. The contents are placed in a temporary isolated workspace, analyzed without being executed, and deleted immediately when the scan finishes or fails. We do not keep a copy of your source code.

Repository evidence from GitHub

Repository settings, branch rules, workflow definitions, pull-request and review activity, check runs, and deployment information, summarized into evidence signals for the assessment.

Assessment results

Scanner output, normalized evidence, findings, control results, and reports (JSON and PDF). Private findings can include file paths and line numbers. Detected secret values are redacted and never stored in findings or reports.

Content you write

Founder declaration answers (for example about architecture, operations, backups, incidents, and data handling), your attestation, who submitted each version and when, and remediation notes or risk acceptances you add to findings. Obvious credentials are rejected before remediation notes are stored.

For most declaration questions, the answer text is also sent to OpenRouter, Inc. (USA), which routes it to TypeSafe, Inc.'s Jev model, an automated judging service, so it can assess whether the answer describes a practice that meets the published control condition. Every request restricts OpenRouter to TypeSafe's endpoint only, only while OpenRouter lists it as offering zero data retention, and never falls back to a different provider. Only the control's title, objective, published condition, and your answer text are sent — never your repository name, source code, scanner output, or GitHub data, and never the answer to the technical-owner question (name and contact route). The judgment can pass an answer, but it never fails one. An answer that meets the condition counts as a founder-declared pass. Any other answer, and any result the service cannot give (for example because it is off, fails, or times out), counts as not determined. If the review finds an answer unlikely to meet the condition, only you see that note, in your private report. A judged answer is never counted as verified, and a control marked as a blocker never passes on a judgment alone. We can switch this off for the whole service; it is not a setting you control per account. See section 8.

Share links

For each share link: a SHA-256 hash of the link token (never the token itself), an optional expiry, revocation time, a view count, and the last-viewed time and format. We do not record the IP address, browser, referrer, or identity of anyone who opens a share link.

Security and audit records

• An audit log of security-relevant actions (for example sign-in, session changes, sharing, deletion), recording the actor, action, and time. It does not contain secrets or repository content.
• GitHub webhook delivery records: delivery ID, event name, installation ID, a hash of the payload, processing status, and timestamps. The webhook payload itself is not stored.
• Data export and deletion job records.

Operational telemetry

Structured operational events containing: environment, request ID, route category, HTTP method, status, duration, a safe error code, and, for assessments, opaque workflow and assessment IDs, scanner status, and file, byte, and finding counts. These events do not contain query strings, headers, request bodies, IP addresses, source code, declaration text, or tokens. Cloudflare's automatic request logs and traces are disabled, but our logging platform (Cloudflare Workers Logs) still attaches the full request URL to every custom log record we do write, at 100% sampling. Requests whose URL can carry a GitHub sign-in code, an installation setup token, or a report share token (GitHub sign-in and installation routes with a query string, and share links at /r/*) therefore write no log record at all — only an aggregate count in Analytics Engine. Other requests do produce a log record, which can include the request path (for example an opaque project, assessment, or report ID).

IP address

On sign-in and GitHub App installation routes, your IP address is used transiently as the key for rate limiting. VentureLint does not write it to its database or its logs. Our hosting provider, Cloudflare, processes network connection data such as IP addresses to deliver and protect traffic to the service.

What we do not do

• No advertising, analytics, or cross-site tracking scripts or cookies.
• No browser local storage.
• No source code, repository identity, scanner output, or GitHub data is ever sent to an AI provider. Most declaration answer text is sent to TypeSafe for automated judging only, as described above and in section 8. We can switch this off for the whole service.
• We do not sell personal data.

4. Data about other people

Some of the personal data VentureLint processes is about people other than the person signed in.

• The technical owner you name. The founder declaration asks for a technical owner's name and a contact route (control VL-OWN-001). This can be a person other than the signed-in founder.
• Other members of your workspace. If you invite colleagues to your workspace, their GitHub identity and role are visible to other members of that workspace.
• The GitHub account the App is installed on. This can be an individual or organization account different from the person who installs it.
• People named in repository contents. Commit history and file contents scanned during an assessment can contain names or email addresses, for example as commit authors or in code comments. This content passes through the temporary, isolated scan workspace described in section 3 and is deleted once the scan finishes; we do not keep a copy. Scanner findings themselves store only a file path, a line number, and the rule that matched. GitHub review evidence stores a review's status and timestamp but not the reviewer's name or GitHub login — that identity is discarded when we read GitHub's response.

[COUNSEL: whether GDPR article 14(5)(b) applies to any of the categories above, and who is responsible for informing the people concerned.]

5. Purposes and lawful bases

• Create and secure your account and sessions (GitHub identity, session data): performance of the contract, GDPR art. 6(1)(b).
• Connect repositories and run assessments you request (installation and repository metadata, repository contents, GitHub evidence): performance of the contract, art. 6(1)(b).
• Produce, store, and share reports you request (assessment results, declarations, share-link records): performance of the contract, art. 6(1)(b).
• Export and delete your data on request (all project and account data): performance of the contract, art. 6(1)(b); legal obligation for data-subject requests, art. 6(1)(c).
• Protect the service against abuse, fraud, and attack (transient IP address, audit and webhook records): legitimate interest in securing the service and our users' data, art. 6(1)(f).
• Operate, monitor, and fix the service (operational telemetry): legitimate interest in a reliable service, art. 6(1)(f).
• Comply with the law and respond to lawful requests (data needed for the request): legal obligation, art. 6(1)(c).

[COUNSEL: confirm lawful bases, and confirm VentureLint's role (controller or processor) for personal data contained in customer repositories and declarations. If VentureLint is a processor for that data, a data processing agreement is required.]

6. Cookies

VentureLint sets only strictly necessary cookies. All are Secure, HTTP-only, and same-site. There are no analytics or advertising cookies.

• __Host-vl_session: keeps you signed in; up to 8 hours.
• __Host-vl_oauth_verifier: protects the GitHub sign-in flow; lasts for the sign-in flow (10-minute validity).
• __Host-vl_install_verifier: protects the GitHub App installation flow; lasts for the installation flow (10-minute validity).

7. Who receives personal data

• Cloudflare hosts and runs VentureLint. See the subprocessor list in section 8.
• OpenRouter, Inc. receives most declaration answer text and routes it to TypeSafe, Inc.'s Jev model for judging, as described in section 3 and section 8. We can switch this off for the whole service.
• GitHub is where your identity and repositories live. We receive data from GitHub when you sign in, install the App, and run an assessment. Your use of GitHub is governed by GitHub's own terms and privacy statement.
• People you share a report with. A share link shows only the public report, a separately built projection that excludes private file paths, code snippets, contributor identities, secret values, remediation notes, and the repository name (a generic label is used).
• Authorities, only where the law requires it.

8. Subprocessors

Cloudflare, Inc. provides the following services used by VentureLint:

• Workers and static assets: all web and API requests.
• D1 database: account, workspace, repository metadata, declarations, evidence, findings, report metadata, audit and share records.
• R2 object storage: report JSON and PDF files, temporary raw scanner output, project exports.
• Workflows: orchestration of assessments, exports, and deletion.
• Containers / Sandbox: temporary isolated repository checkout and static scanning.
• Browser Run: rendering report PDFs from VentureLint-generated HTML.
• Workers Logs and Analytics Engine: the operational telemetry described in section 3.
• Rate limiting: transient rate-limit keys (IP address on sign-in routes).

OpenRouter, Inc. (USA): System One / Jev automated judging API, routed to TypeSafe. Processes founder declaration answer text for applicable controls (never the technical-owner answer, repository identity, source code, scanner output, or GitHub data). VentureLint sends this text to OpenRouter, Inc. (USA), which routes each request under a zero-data-retention constraint to TypeSafe, Inc.'s Jev model (typesafe/jev-1.13-20260917); TypeSafe is OpenRouter's model provider for this call, not a service VentureLint contracts with directly for this data. Every request tells OpenRouter to use only TypeSafe's endpoint, only while OpenRouter lists it as offering zero data retention, and never to fall back to a different provider (only: ["typesafe"], allow_fallbacks: false, zdr: true, data_collection: "deny"); OpenRouter's published zero-data-retention endpoint list includes this TypeSafe endpoint. OpenRouter states that prompts sent this way are not retained unless a customer opts in to prompt logging, which VentureLint does not. OpenRouter processes this data in the United States, and does not guarantee a processing region on VentureLint's plan — EU in-region routing is available only to enterprise customers. OpenRouter's Terms of Service (openrouter.ai/terms, updated 2026-08-31) state that its Data Processing Agreement is incorporated by reference into the Terms for organizational or commercial customers, and the DPA document itself (openrouter.ai/data-processing-agreement, updated 2026-08-26) incorporates the EU Standard Contractual Clauses (Module 2, Controller to Processor). The DPA takes effect when a customer accepts the Terms, so it covers VentureLint's account. A countersigned copy is offered only on OpenRouter's Enterprise plan. [COUNSEL: confirm the DPA incorporated in OpenRouter's Terms is sufficient under Art. 28(9).] TypeSafe separately holds a direct data processing agreement with VentureLint (accepted 2026-09-27, typesafe.ai/legal/data-processing, updated 2026-04-24, concluding the EU Standard Contractual Clauses Module 2/3 and the UK Addendum) that governs TypeSafe's direct API; that agreement does not govern this OpenRouter-routed call, on which TypeSafe acts as OpenRouter's provider rather than VentureLint's direct processor. The judgment returned is either that the answer meets the control's condition, that it does not, or that the result is not determined; it is never treated as verification. We can switch this use off for the whole service with the DECLARATION_JUDGE_ENABLED kill switch.

GitHub is a data source you choose to connect, not a VentureLint subprocessor.

9. Where data is stored and processed

• Database (Cloudflare D1): the production database was created with Cloudflare's EU jurisdiction setting.
• Object storage (Cloudflare R2): the production bucket uses Cloudflare's EU jurisdiction setting.
• Scanner containers: configured with Cloudflare's EU jurisdiction constraint.
• Request processing (Cloudflare Workers): runs on Cloudflare's global network, generally in a data center close to the visitor, which can be outside the EU/EEA.
• Workflows, Browser Run, logs, analytics, and rate limiting: our configuration does not restrict these to a region. [OPEN: verify and state the processing location of each.]

EU storage jurisdiction does not mean that all processing takes place in the EU, and we do not claim that it does.

Cloudflare, Inc. is based in the United States. Transfers of personal data outside the EEA rely on [COUNSEL: transfer mechanism, for example the Standard Contractual Clauses in Cloudflare's data processing addendum]. GitHub, Inc. is based in the United States; data you hold on GitHub is governed by your agreement with GitHub. OpenRouter, Inc. is based in the United States and receives declaration answer text there, under the zero-data-retention routing described in section 8, before routing it to TypeSafe, Inc. (also based in the United States), which computes the judgment. OpenRouter guarantees EU-only processing only on its Enterprise plan, which VentureLint does not use. Transfers to OpenRouter rely on the EU Standard Contractual Clauses (Module 2) in OpenRouter's DPA (see section 8).

10. How long we keep data

• Temporary repository checkout: deleted immediately after the scan finishes or fails.
• Raw scanner output: up to 7 days (checked hourly), or earlier if you purge it.
• Evidence, findings, control results, declarations, remediation notes, reports (JSON and PDF): for the life of the project, until you delete the project or your account. Revoking a share link does not delete the report.
• Project data exports: 7 days.
• Sign-in and installation setup records: 10 minutes.
• Sessions: valid for at most 8 hours; removed when you sign out, sign in again, or delete your account. Expired sessions are deleted automatically 30 days after expiry.
• Assessment request de-duplication records (hashes only): 24 hours.
• Webhook delivery records (no payload): deleted automatically 90 days after the delivery was last received.
• Audit log: entries tied to a project (for example sharing or deletion actions on it) are deleted when you delete that project. Sign-in and account-level entries (for example GitHub authorization, session changes) are not tied to a project, so deleting a project does not remove them. When you delete your account, your user reference as the actor is removed from remaining entries, but some entries still reference your (now pseudonymous) user record as the affected object.
• Admission-control records (rate and abuse limits; an operator's entry may include a short free-text reason): not tied to a project. Removed when the account, organization, or repository the record applies to is deleted. Records that apply service-wide are not deleted by any account action.
• Deletion record: 90 days, containing only action, type, status, and timestamps; no deleted content.
• Deleted account: a pseudonymous user record remains: GitHub ID and login are replaced by pseudonymous values and your name and avatar are removed. [OPEN: retention period for this record]
• Database backups (Cloudflare D1 Time Travel): up to 30 days after deletion from the live database.
• Operational logs and telemetry: [OPEN: confirm Cloudflare Workers Logs and Analytics Engine retention for our plan].

Project and account deletion completes in the live stores within a target of 24 hours. Backup copies may persist for up to 30 days after that, as stated above.

11. Your rights

Under the GDPR you have the right to access, correct, and delete your personal data, to restrict or object to processing, and to data portability. Where processing is based on legitimate interest, you can object at any time.

Self-service tools in your account (workspace owners only):

• Export a project as a JSON file.
• Disconnect a repository. This stops VentureLint from using it; it does not remove the GitHub App from GitHub. To revoke GitHub-side access, uninstall or reconfigure the App in your GitHub settings.
• Delete a project or your account. Disconnect and deletion require that you signed in within the last 15 minutes.

For any other request, contact privacy@venturelint.com. We respond within one month, as the GDPR requires. If your request concerns personal data inside a customer's repository, we may refer you to that customer.

You have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

12. Automated assessment

VentureLint evaluates repositories and projects automatically against a published profile. The result concerns the technical state of a repository at a specific commit; it is not a decision about an individual.

Separately, an automated model (TypeSafe's Jev, described in sections 3 and 8) judges the text a founder writes when answering certain declaration questions, deciding whether it describes a practice that meets the control's published condition. The judgment can pass an answer but never fails one: an answer either meets the condition or counts as not determined. A note that an answer seems unlikely to meet the condition appears only in your private report. This judgment can affect the control's result in your private report and, if you share it, in the public report. It is always labelled as an automated judgment and never as verification; a control that blocks the verdict never passes on a judgment alone.

[COUNSEL: confirm whether GDPR article 22 applies to either form of automated evaluation described in this section.]

[OWNER: per-project opt-out and human-review route for the declaration judgment are pending a decision.]

13. Security

• The GitHub App requests read-only access, only to repositories you select.
• GitHub installation tokens are created for short-lived use and never stored.
• Session and share-link tokens are stored only as hashes.
• Repository code is never executed.
• Public reports are built from a separate, sanitized projection.

To report a vulnerability, contact security@venturelint.com.

14. Changes to this notice

We will publish changes on this page with a new effective date. [COUNSEL: define how material changes are notified to account holders.]