Privacy Policy.

2 Who we are (data controller)

The data controller responsible for the processing described here is:

Because the controller is established in the European Union, no Article 27 EU representative is required, and our lead supervisory authority is the French data protection authority, the CNIL (Commission Nationale de l'Informatique et des Libertés).

We have not appointed a statutory Data Protection Officer (we are not legally required to). For any privacy matter, contact us at privacy@openlatch.ai.

3 The data we process and why

3.1 GitHub URLs you submit for scanning

When you submit a public GitHub URL to be scanned, we store that URL and use it to fetch and analyse the referenced artifact. The submitted URL and the resulting scan report become part of our public catalog.

• What we store: the GitHub URL, the artifact metadata, and the scan output.
• What we do not store: we do not require, request, or retain your name, email, or account identity to run a scan. Scans are anonymous.
• Legal basis: legitimate interest in operating an independent, transparent, public security-scoring service (Art. 6(1)(f) GDPR). See Section 6.

3.2 Scan results and findings

Each scan produces a score, sub-scores, and findings, each tied to a documented detection rule and the rubric version that was active. To protect the scanned author's content and any secrets it may contain, evidence is stored as a cryptographic hash (SHA-256) plus a file position — never the raw content of the scanned artifact. Scan results are public and retained indefinitely as a transparency record (see Section 7 and Section 11).

3.2.1 Uploaded artifacts and unlisted (private) scans

Instead of a GitHub URL, you can upload an artifact file (a single capability file or a .zip) to scan it directly. You choose its visibility:

• Public (default): the result is published permanently to the public catalog, exactly like a GitHub scan — and, because you chose to publish it, the exact bytes you uploaded are stored and reproducible (so the report can render diffs and serve a .zip). Treat a public upload as a permanent public record.
• Unlisted: the result is not listed in the catalog or search and is reachable only at an unguessable capability link (/scans/r/<token>). Its uploaded bytes are stored privately and auto-deleted after 90 days. You can delete it sooner, or promote it to public, using that link.

The capability link is unguessable and unlisted — it is not access-controlled. Anyone who has the link can view, delete, or publish the report. We mark the page noindex and send no referrer, which reduces (but cannot guarantee) the chance of it being indexed or leaked. If you lose the link there is no recovery, and sharing the link shares full control. For abuse prevention we apply the same hashed-IP, rolling-window rate limiting (Section 3.3) to capability-link lookups.

Promoting a private result to public is one-way and cannot be undone — once published, it becomes a permanent public record like any other public scan. A private result you can delete yourself via its link, or it expires automatically after 90 days. A public upload has no self-serve delete: once published it can be removed only through the operator and right-of-reply process (Section 8), not from the report page itself.

3.3 Your IP address (abuse prevention only)

To prevent abuse and rate-limit scan submissions, we process the IP address of incoming requests. The raw IP address is hashed (SHA-256) on receipt and is never written to our database or logs in raw form. Only the hash, a coarse counter, and a short time window are stored, expiring on a rolling ~24-hour basis.

Legal basis: legitimate interest in the security and availability of the service (Art. 6(1)(f) GDPR).

3.4 Anonymous, cookieless usage analytics (PostHog)

We use PostHog, configured in cookieless mode and hosted in the European Union, to understand how the service is used in aggregate. This deployment is specifically designed to avoid identifying you:

• No cookies and no persistent identifiers are stored on your device for analytics. Because nothing is stored on or read from your device for this purpose, no cookie-consent banner is required under the ePrivacy rules.
• No user profiles are created.
• Events are limited to a fixed, closed list of interaction names, and every numeric value is bucketed (e.g. a score is recorded as "70–89", not the exact figure). Raw URLs, repository names, IP addresses, and free-text input are never sent to analytics.

Legal basis: legitimate interest in measuring and improving the service (Art. 6(1)(f) GDPR). You can object at any time (Section 8).

3.5 Error and diagnostic monitoring (Sentry)

We use Sentry to capture application errors so we can fix faults and detect abuse. Sentry is configured to not send default personal data, to scrub any data that could contain scanned content, and Session Replay is not used.

Legal basis: legitimate interest in the security and operational integrity of the service (Art. 6(1)(f) GDPR).

3.6 Performance traces (OpenTelemetry)

Server-side traces and metrics help us monitor performance. Trace attributes are limited to hashes, sizes, and counts; raw scanned content is never recorded. Legal basis: legitimate interest in operating a reliable service.

3.7 Server logs

Our hosting and application layers keep standard operational logs (request paths, status codes, timestamps), retained for ~30 days for security and debugging. Legal basis: legitimate interest in security and operations.

3.8 Theme preference

If you switch between light and dark mode, that choice is stored on your own device (localStorage, key ss-theme). It never leaves your browser and is not sent to us. See the Cookie Policy.

3.9 Anonymised catalog-access signals

To understand which capabilities are most looked up — and to support future usage-transparency features — we record a closed set of aggregate access signals when you interact with the catalog. The recorded actions are limited to a fixed list: viewing a capability page, searching or filtering the catalog, copying an install command, fetching a badge, and viewing the sources page.

Your IP address is redacted to the network prefix (/24 for IPv4, /48 for IPv6) at the moment of collection — before the record is written to our database. The raw IP address is never stored, never exported, and never shared with third parties. Only the coarse network prefix, the action type, and a timestamp are recorded. No page URLs, no search queries, no capability slugs, and no personal identifiers are stored in this log.

Legal basis: legitimate interest in understanding aggregate catalog usage and improving the service (Art. 6(1)(f) GDPR). Records are retained for approximately 30 days, then deleted.

4 Newsletter / launch list — not yet active

The website may display an email sign-up field for launch announcements. At the date of this policy, this feature is not active: no email address is collected, transmitted to us, or stored. When the newsletter does launch:

• it will operate strictly on an opt-in consent basis (Art. 6(1)(a) GDPR and the applicable ePrivacy electronic-marketing rules);
• emails will be sent through our processor Resend, from a sending domain shared with OpenLatch (notifications.openlatch.ai), with a reply-to at an @openlatch.ai mailbox;
• every message will contain a one-click unsubscribe, and you can withdraw consent at any time;
• this policy will be updated before any email is collected.

5 Special-category and children's data

SaferSkills is a developer tool and is not directed to children. We do not knowingly collect personal data from anyone under the age of 15 (the age of digital consent in France). We do not intentionally process special categories of data (Art. 9 GDPR). For incidental personal data inside scanned repositories, see Section 7.

6 Our use of "legitimate interests"

Most of our processing relies on the legitimate interests legal basis. For each such activity we have carried out (and keep on file) a three-part balancing test — purpose, necessity, and balancing against your rights:

• Purpose: to provide a free, independent, transparent security-scoring service for publicly shared AI-agent artifacts. EU law expressly recognises network and information security as a legitimate interest.
• Necessity: each category of data is the minimum needed (hashing IPs rather than storing them; bucketing analytics; storing evidence hashes rather than raw content).
• Balancing: we minimise, pseudonymise, and never use this data for advertising or profiling, and you can object at any time (Section 8).

You may request a summary of the relevant balancing assessment by emailing privacy@openlatch.ai.

7 Scanning public repositories and the personal data they may contain

This section is specific to what SaferSkills does. We fetch and analyse publicly available code from GitHub. Public code can contain personal data — for example an author's name, a username, or an email address in commit metadata or in a file. Data being public does not remove it from the scope of data-protection law, so we apply the following safeguards:

• Lawful basis: legitimate interest in independent security research and the network/information security of the AI-agent ecosystem (Art. 6(1)(f) GDPR), which carries a recognised public-interest weight.
• Source and category (Article 14): where we process personal data we did not obtain from you directly (i.e. data inside a scanned repository), the source is the public GitHub repository identified in the report, limited to whatever identifiers that public code contains. We rely on the Article 14(5) disproportionate-effort exemption to give this notice via this public policy and the public report, rather than contacting each individual.
• Data minimisation: our reports are about artifacts and repositories, not people. We reference the organisation/repository, and we do not publish authors' email addresses harvested from scanned code. Detection evidence is stored as hashes and positions, never as raw payload.
• Right to object / right of reply: every public verdict is appealable. Vendors and authors can submit a verified response, and individuals can object to, or request removal of, incidental personal data about them via privacy@openlatch.ai (see Section 8 and Section 11).

8 Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase data ("right to be forgotten"), subject to the public-record limits in Section 11;
• restrict processing;
• data portability;
• object to processing based on legitimate interests — including an absolute right to object to direct marketing;
• withdraw consent at any time where processing is based on consent (this will apply to the newsletter once it launches), without affecting prior processing.

To exercise any right, email privacy@openlatch.ai. We will respond within one month (extendable by two further months for complex requests, with notice). Because the service is anonymous, we may be unable to identify data relating to a purely anonymous visitor; where we cannot identify you we will say so. We may ask for information reasonably necessary to verify a request.

You also have the right to lodge a complaint with a supervisory authority — for us, the CNIL (www.cnil.fr) — or with the authority in your country of residence.

Visitors in the United Kingdom

If you are in the UK, the UK GDPR and PECR give you equivalent rights. You can complain to the UK Information Commissioner's Office (ico.org.uk).

Residents of US states with privacy laws

Depending on your state (e.g. California's CCPA/CPRA, Virginia, Colorado, Connecticut, Texas and others), you may have rights to know, access, delete, and correct your personal information, and to opt out of "sale" or "sharing" and targeted advertising. SaferSkills does not sell or share personal information and does not use it for cross-context behavioural advertising. We honour browser-based Global Privacy Control (GPC) signals; because we run no advertising trackers, there is in practice nothing to opt out of. To make a request or appeal a decision, email privacy@openlatch.ai.

9 Who we share data with (processors)

We do not sell your data. We share the limited data described above only with the service providers who help us run SaferSkills, each under a data-processing agreement:

An up-to-date sub-processor list is available on request at privacy@openlatch.ai, and we will update this table before adding a new sub-processor.

10 International data transfers

We prioritise keeping data in the EU (our hosting and analytics are EU-region where available). Where a processor processes data outside the EEA — principally in the United States (Sentry, and Resend once the newsletter launches) — we rely on the EU-US Data Privacy Framework where the provider is certified, and/or on the European Commission's Standard Contractual Clauses as a fallback, with supplementary measures. You can request a copy of the relevant safeguards at privacy@openlatch.ai.

11 How long we keep data (retention)

Public-record principle. Scan results and the URLs that produced them are kept indefinitely so that security findings remain verifiable and our methodology stays auditable — transparency over erasure. We do not retroactively scrub the public catalog except through the vendor right-of-reply / appeals process, or where we are required to remove incidental personal data about an individual (see Section 7 and Section 8).

12 How we protect your data

We follow privacy-by-design and security-by-design principles, including: hashing IP addresses on receipt; storing scan evidence as hashes rather than raw content; scrubbing personal data from error reports; restricting outbound network access when fetching artifacts; size-capping and validating every public input; and never executing the code we scan (it is parsed as data only). No system is perfectly secure, but we work to protect data against unauthorised access, loss, or misuse.

13 Automated decision-making

Scan scores are produced by deterministic, documented detection rules, not by opaque profiling of individuals. The scoring relates to artifacts, not to people, and does not produce legal or similarly significant effects on you within the meaning of Article 22 GDPR. Every verdict is documented and appealable.

14 Links to other sites

Our reports link to GitHub and to third-party repositories and vendor sites. Those destinations have their own privacy practices, which we do not control.

15 Changes to this policy

We may update this policy as the service evolves (for example when accounts or the newsletter launch) or as the law changes. We are monitoring the EU "Digital Omnibus" reform proposal (a Commission proposal from November 2025, not yet law) and will update this policy if and when it takes effect. Material changes will be reflected in the "Last updated" date above and, where appropriate, announced on the site.

16 Contact

Questions, requests, or complaints about this policy or your personal data:

You may also contact or lodge a complaint with the CNIL (www.cnil.fr).