Privacy Policy

The open-source scanner

The ControlLoop scanner runs on your computer or in your CI. On its own it sends nothing anywhere: it makes no network calls and collects no telemetry.

If you turn on Team mode, the scanner sends the service a structured summary of each scan: the commit, branch, and pull request it ran on, the scanner and policy versions, the verdict, and the findings and components it found, including file paths and line numbers. It is designed never to send source code, file contents, prompt text, environment variable values, or secrets.

What we collect when you use Team

When you sign in and use app.controlloop.ai we store:

• Your GitHub account details: your GitHub user ID, username, display name, avatar URL, and your verified primary email address. We ask GitHub only for permission to read your profile and email addresses. We use the sign-in token once and don't keep it.
• Your organization: its name, its members and their roles, and invitations, including the email address or GitHub username each invitation was sent to.
• Repositories you connect through the ControlLoop GitHub App: the repository name, its default branch, and whether it's private, plus the commits, branches, pull request numbers, and pull request titles that scans ran on.
• Scan results the scanner uploads, the policies and exceptions you set, evidence reports you generate, and an audit log of changes made in your organization.
• Billing records: your Stripe customer and subscription IDs, the subscription's status, and trial and renewal dates. Card details are entered on Stripe's pages and never reach our servers; we show your card's brand and last four digits by asking Stripe when you open the billing page.
• API and CI tokens you create. We store only a one-way hash and the last four characters, so we can't recover a token after it's shown to you.

Hosted scans

If you choose to have the service run scans for you, it copies the repository into a temporary workspace, runs the scanner there without network access, keeps only the scan results, and deletes the copy when the scan ends.

How we use it

We use this data only to provide the service: to sign you in, show your organization its scans and policies, enforce plan limits, bill your subscription, keep the service secure, and answer your support requests. We don't sell personal data, use it for advertising profiles, or use your scan results to train AI models.

Cookies

app.controlloop.ai sets two cookies, both needed for it to work: a sign-in session cookie that lasts up to 14 days, and a security token that protects forms from cross-site requests. Neither tracks you across other sites.

controlloop.ai uses Google Analytics to understand which pages people read, which buttons and videos they use, and where visitors come from, and controlloop.ai and app.controlloop.ai use Google Ads conversion tracking to learn which of our ads lead to trials. Google sets cookies to do this and processes the data on our behalf under the Google Ads Data Processing Terms. Analytics data isn't shared with Google for its own purposes, and we don't build advertising profiles.

If you visit from the UK, the European Economic Area or Switzerland, no analytics or advertising cookies are set until you choose Accept in the cookie banner. Your choice is stored for 180 days in a cookie named cl_consent, shared by controlloop.ai and app.controlloop.ai. You can change it at any time with Cookie settings in the site footer. Elsewhere, a cookie named cl_ads_default tells app.controlloop.ai that no prior choice is needed where you are.

Cloudflare Web Analytics counts page views on controlloop.ai without cookies and without identifying you.

Every page of controlloop.ai has a live chat window, run by Tawk.to, for questions before or after you start a trial. If you use it, what you type and any name or email address you give are sent to Tawk.to and stored there so we can reply. The chat sets its own cookies to keep your conversation going between pages; they aren't used for advertising.

Who processes it for us

We use a few providers to run the service. Each handles data only to provide its part:

• Amazon Web Services, in the United States (Oregon region), hosts the service, its database, and evidence reports. Data is encrypted at rest and in transit.
• Stripe processes payments, stores your card details, and sends billing emails such as receipts and trial reminders.
• GitHub provides sign-in and, through the GitHub App you install, access to the repositories you choose.
• Cloudflare hosts this website, provides DNS, and counts page views without cookies.
• Tawk.to runs the live chat on this website and stores the conversations you start there.
• Google measures site visits (Google Analytics) and which ads lead to trials (Google Ads), when you allow it.

How long we keep it

We keep your account and organization data for as long as your account exists, including after a subscription ends, so you can pick up where you left off if you resubscribe. Ask us and we'll delete it.

Server logs are kept for 90 days and database backups for 14 days, so deleted data leaves our backups within 14 days of deletion. Invitations expire after 7 days. Download links for evidence reports expire after 15 minutes.

Your choices and rights

You can ask us to tell you what personal data we hold about you, to correct it, to give you a copy, or to delete your account or your organization's data. Email controlloop.security@gmail.com with "Privacy request" in the subject. We'll confirm the request came from you, usually through the GitHub account you sign in with, and reply within 30 days.

You can revoke ControlLoop's access at any time in your GitHub settings: remove the ControlLoop GitHub App from your repositories, and revoke the ControlLoop OAuth app under Authorized OAuth Apps.

Depending on where you live, you may have further rights under laws such as the GDPR or the California Consumer Privacy Act, including the right to complain to your data protection authority. We handle the data of organizations and their members as a service provider acting on the organization's behalf.

International transfers

The service is hosted in the United States. If you use it from elsewhere, your data is transferred to and processed in the United States.

Security

Data is encrypted in transit and at rest. Tokens are stored only as one-way hashes. Each organization's data is isolated from every other organization's. If we become aware of a breach that affects your personal data, we'll tell you without undue delay.

Children

ControlLoop is a tool for software teams and isn't intended for anyone under 18.

Changes to this policy

We'll post any change here with a new effective date. For material changes, we'll also email the billing contact of each active subscription before they take effect.

Contact

Privacy questions and requests: controlloop.security@gmail.com.