Política de privacidad
Última actualización: 30 October 2026
Este documento está en inglés, que es la versión vinculante.
Who is responsible
Agnes is a trade name of Kings of Aces, a general partnership (vennootschap onder firma), Vergert 89, 6662 DX Elst, the Netherlands, Chamber of Commerce (KvK) number 97590517. Kings of Aces is the controller for the personal data described here. Questions and requests: [email protected].
For personal data that happens to be in the repositories you connect (names or email addresses in code, for example), your organisation is the controller and we process it on your behalf, under the data processing terms in section 8 of our terms of service.
What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name and email address; a password (stored only as a hash) if you sign up with one; if you sign in with GitHub, Google, Microsoft, GitLab or Apple, your account ID there, name, email address and profile picture (Apple sends no picture, and its email address can be a relay address that Apple forwards to you) | Your account, signing in, and emails about your account (confirming your address, resetting your password) | Contract, Art. 6(1)(b) |
| Two-step verification secret and backup codes (encrypted) | Protecting your account | Contract, Art. 6(1)(b) |
| IP address and browser (user agent) of each signed-in session | Keeping sessions secure, showing where you are signed in, and limiting sign-in attempts | Legitimate interest in security, Art. 6(1)(f) |
| Connections to your git provider: installation and account identifiers, and access tokens (encrypted) | Reading the repositories you choose, read-only | Contract, Art. 6(1)(b) |
| Projects and reports: repository and branch names, commit identifiers, and analysis results (file paths, line numbers and the tools’ messages, which can quote names from your code) | Providing the analysis and its history | Contract, Art. 6(1)(b) |
| Your plan, subscription status and billing period, and your customer ID at Stripe | Providing the plan you pay for | Contract, Art. 6(1)(b) |
| Web server logs: IP address, time, requested address and browser | Operating the service and detecting abuse | Legitimate interest in security, Art. 6(1)(f) |
| Error reports, with users, cookies and query strings removed before they leave our servers | Finding and fixing faults | Legitimate interest in a working service, Art. 6(1)(f) |
| Emails you send us | Answering you | Contract or legitimate interest, Art. 6(1)(b) and (f) |
Your source code is copied to our servers only for the duration of an analysis, inside an isolated container without network access, and deleted when the run ends; reports do not contain it. Payment details (card or bank details) never reach us: Stripe’s Link service handles them as merchant of record (see below). If you give feedback after deleting your account, it is stored without any link to you.
We do not sell personal data, do not use it for advertising, and make no automated decisions about you with legal or similarly significant effects.
Who else receives data
We use these sub-processors, each bound by a data processing agreement:
| Party | What for | Where |
|---|---|---|
| netcup GmbH | The servers that run Agnes, its database and the analyses | Germany |
| Cloudflare, Inc. | DNS and the network in front of our servers (sees your IP address and requests); storage of reports and encrypted backups | Storage in the EU; network worldwide |
| Resend, Inc. | Sending account emails | United States |
| GitHub, Inc. | Sign-in with GitHub and read-only access to the repositories you connect | United States |
| Functional Software, Inc. (Sentry) | Error tracking | European Union (Sentry’s EU data region) |
Signing in with another service. If you sign in with Google (Google Ireland Limited), Microsoft (Microsoft Ireland Operations Limited), GitLab (GitLab Inc.) or Apple (Apple Distribution International Limited), that service confirms who you are and sends us the details listed above. Each is an independent controller for your account with them, under its own privacy policy. We use these details only to identify you, and you can remove a sign-in method in Settings at any time.
Payments. When you buy a plan, you pay through Stripe’s Link service, which sells the subscription to you as merchant of record. Stripe (Stripe Payments Europe, Ltd. and its affiliates) is an independent controller for the payment and invoicing data it collects, under its own privacy policy. We receive only what we need to provide your plan: your customer ID, the plan, its status and its dates.
To check your dependencies, we send package names and versions, never code or personal data, to the public OSV vulnerability database and the npm registry.
Where a party outside the European Economic Area receives personal data, the transfer relies on the EU-U.S. Data Privacy Framework or the European Commission’s standard contractual clauses. We share data with authorities only when the law requires it.
How long we keep it
- Account data, connections, projects and reports: until you delete them or your account. Deleting is immediate; copies in our encrypted backups disappear within 30 days.
- Run history: a limited number of past runs per project (the oldest are removed automatically).
- Session IP address and browser: for as long as the session lasts; it ends when you sign out or it expires.
- Web server logs: in logs of limited size that are overwritten automatically, normally within days.
- Error reports: at most 90 days.
- Emails with us: as long as needed to handle your question, and at most two years.
- Accounting records: seven years, as Dutch tax law requires.
Cookies
Agnes uses only cookies that are strictly necessary, so it does not ask for consent: a session cookie that keeps you signed in, a cookie that remembers your language for a year, and short-lived cookies that protect a sign-in step, a connection to your git provider, or the page shown after you delete your account. We use no analytics, advertising or tracking cookies.
Security
Connections are encrypted; access tokens, two-step verification secrets and backups are encrypted; repository access is read-only; and every analysis runs in an isolated container without network access. Our database is reachable only from the server itself.
Your rights
You can ask us for access to your personal data, and to correct, delete, restrict or transfer it, and you can object to processing based on our legitimate interests. Much of this you can do yourself: Settings shows your account, and deleting your account removes your data. For anything else, email [email protected]; we answer within one month. You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
Children
Agnes is for businesses and is not meant for anyone under 16.
Changes
We update this policy when what we do changes. The date at the top shows the current version; for changes that matter to you, such as a new sub-processor, we email you in advance.