Privacy Policy — VibeScan

Last updated: August 8, 2026 Effective date: August 6, 2026

1. Who we are

VibeScan ("VibeScan," "we," "us," "our") is a product of MakeLabs, operating at usevibescan.com. VibeScan is a consent-based security scanning service for web applications and source-code repositories.

• Legal entity: MakeLabs (sole proprietorship), Udyam Registration Number UDYAM-KR-26-0061081
• Grievance / Data Protection contact: Abhilash, support@usevibescan.com

2. Scope of this policy

This policy applies to:

• Visitors to usevibescan.com
• Users who register an account, verify domain ownership, connect a GitHub repository, sign a consent/authorization, or purchase a plan
• Data generated by the scanning process itself (findings, reports, consent records)

It does not apply to third-party sites we link to, or to the application or repository being scanned except as described in Sections 4 and 5.

3. Legal basis for processing

We process personal data on the basis of:

• Consent — for domain scanning, via verified domain ownership plus a signed authorization; and for repository scanning, via your GitHub authorization granting us access to the specific repositories you connect
• Contract performance — to deliver the scans and reports on your chosen plan
• Legitimate interest — fraud prevention, service security, rate-limiting, and abuse prevention
• Legal obligation — tax, billing, and regulatory recordkeeping

Under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, VibeScan acts as a Data Fiduciary and you (the user) are the Data Principal.

4. What we collect

4.1 Account & identity data

• Name, email, and company name (if provided)
• Authentication data, handled by our authentication provider (Clerk), including any verification/sign-in emails Clerk sends on our behalf
• IP address and device/browser metadata at signup and at the time of any consent/authorization

4.2 Domain ownership & authorization data (website scans — "Feature A")

• Domain(s) submitted for verification
• The DNS TXT verification record and its result
• Authorization records: the checks you authorized, confirmation of authority, whether a signature was captured, timestamp, and IP address at the time of authorization

4.3 GitHub connection & repository access data (repo scans — "Feature B")

• The GitHub account login you connect, and the OAuth access token GitHub issues to us. This token lets us list your repositories and clone the specific repositories you choose to scan, including private ones. We store this token only to perform scans you request, and delete it when you disconnect GitHub (from Settings) or remove the connection.
• The repositories you connect (name, URL, visibility)
• During a repo scan, we make a temporary, shallow clone of the selected repository's source onto our scan server solely to run the analysis. This working copy is deleted immediately after the scan completes or fails — we do not retain your source code. We retain only the scan findings (see 4.4).

4.4 Scan & report data

• Raw findings produced by the scan engine against the authorized target only — for repo scans these include file paths and line numbers referencing where an issue was found
• The plain-English report generated from those findings (see Section 5 on how reports are generated)
• Scan configuration and metadata (scan type, selected tools, scope, timestamps, duration, status)

For secret detection, we record only that a credential-like pattern was matched and where (file and line); we do not store the secret value itself.

4.5 Data handling for exposed/sensitive findings

We do not access, copy, or retain the actual content of anything a scan finds exposed. Specifically:

• Website scans (Feature A): when a check detects a sensitive path is publicly reachable (e.g., an exposed .env or config file), we record only the fact that it returned an accessible response and the path itself — never its contents. Any response body read during the check is used only to determine status/length and is discarded immediately, never logged or stored.
• Repository scans (Feature B): secret detection runs with redaction enabled at the scanning-tool level, and our own code additionally never reads or stores the actual secret value — only the rule matched, a description, and the file/line location. The temporary local copy of your repository — the only place a real secret value briefly exists during a scan — is deleted immediately after the scan, whether it succeeds or fails.
• Report generation: only this already-redacted information (what was found, why it matters, file/line or path location) is sent to our report-translation provider. Account identity, raw scan output, and file contents are never sent.

Redaction rule: we never store a secret value or file content — only the fact that something was found, and where.

Retention: see Section 7 — findings are retained while your account is active and deleted when you delete your account.

[Internal access — placeholder for lawyer language. In practice: no staff/admin panel exists with visibility into other users' findings; access is limited to the account owner and personnel holding direct infrastructure credentials]

4.6 Payment data

Payment is processed by Dodo Payments, acting as merchant of record. We do not store full card numbers; Dodo handles card data under its own compliant systems. Your billing statement may show "Dodo" or "Dodo Payments" rather than "MakeLabs" or "VibeScan."

4.7 Communications

Authentication and account emails are sent through our authentication provider (Clerk). We do not currently operate a separate marketing email system. If you join a waitlist or contact support, we store the email address and message you provide.

5. How we use your data

• To verify domain ownership / GitHub authorization before any scan
• To perform scans strictly within the authorized scope and your plan's daily limit
• To generate your report: raw scan findings are sent to Anthropic's Claude API, which turns the technical findings into a plain-English explanation with suggested fixes. Findings are sent for this purpose only; we do not send your account identity or source code to this API — only the finding data needed to write the report.
• To process payment
• To respond to support requests
• To maintain records required for legal/liability purposes (authorization records, scan logs)
• To improve VibeScan's detection rules, in aggregated/de-identified form only

We do not sell personal data. We do not use findings about your application or code to market to, or solicit, you, your competitors, or your customers.

6. Who we share data with (sub-processors)

We share data only with the service providers needed to run VibeScan:

The scan server is infrastructure we operate ourselves; it is not a third-party SaaS we hand your data to. We do not share authorization records or scan findings with any other third party unless required by law, or with your explicit permission.

7. Data retention

• Authorization/consent records: retained as evidence of authorization for 3 years. These records are not deleted when you delete your account, since they serve as evidence of what was and wasn't authorized.
• Scan findings and reports: retained while your account is active; deleted when you delete your account. You can also clear your scan history manually at any time from Settings.
• Repository source code: not retained — the temporary clone is deleted immediately after each scan
• GitHub access token: retained only while your GitHub connection is active; deleted when you disconnect
• Account data: retained while your account is active; deleted immediately upon account deletion, subject to the authorization-record exception above and any legal retention requirements

8. Cross-border data transfer

Several of our sub-processors (Clerk, Convex, Vercel, Anthropic, GitHub, Dodo Payments) are based in or store data in the United States, so some personal data is processed outside India. Our scan server is located in India.

9. Your rights

Under the DPDP Act, 2023, as a Data Principal you have the right to:

• Access a summary of the personal data we hold about you and how it is processed
• Correct or update inaccurate/incomplete data
• Erase your personal data once it is no longer needed for the purpose it was collected (subject to legal retention requirements, e.g., authorization records kept for liability defense)
• Withdraw consent at any time — including disconnecting GitHub, which deletes the stored token; this will not undo an already-completed authorized scan, but will prevent future ones
• Nominate another individual to exercise these rights on your behalf in case of death or incapacity
• Lodge a complaint with us first, and if unresolved, with the Data Protection Board of India

To exercise these rights, contact: support@usevibescan.com.

10. Security measures

We apply reasonable technical and organizational safeguards appropriate to the sensitivity of the data, including: encryption in transit (HTTPS), scope enforcement and rate-limiting on scans, an authentication secret protecting the scan server, deletion of repository working copies immediately after scanning, and a policy of never writing access tokens or secret values into reports or logs.

11. Data breach notification

In the event of a personal data breach, we will notify the Data Protection Board of India and affected users without undue delay, consistent with the DPDP Rules, 2025 timelines once the phased obligations take effect.

12. Children's data

VibeScan is not directed at, and is not intended for use by, individuals under 18. We do not knowingly collect data from minors.

13. Cookies

VibeScan uses strictly necessary cookies — a session cookie set by our authentication provider (Clerk) to keep you signed in, and a short-lived state cookie used during the GitHub connection flow to protect against cross-site request forgery — and, as of August 2026, an advertising/analytics pixel (Whop) used to measure ad performance. See our Cookie Policy for detail, including whether a consent banner is required for the Whop pixel.

14. Changes to this policy

We will notify registered users of material changes to this policy before they take effect.

15. Contact

MakeLabs (sole proprietorship), Udyam Registration Number UDYAM-KR-26-0061081. Grievance Officer: Abhilash. Support: support@usevibescan.com. See our Contact page for full details.