Controller
Core Industry, owner Isam Al Ani, Max Schwarze Weg 27A, 46236 Bottrop, Germany. Email: info@vybentis.dev. Vybentis is a product brand of Core Industry and is not a separate legal entity.
Data and purposes
We process account email addresses, organization and project data to provide the service. A public Quick Scan processes the submitted URL, public response data and pseudonymous rate limit keys. A Complete Scan additionally processes bounded repository evidence, findings, reports and billing references. We never retain detected secret values. We retain only a one way hash and a redacted preview.
Legal bases
Contract performance applies to accounts, purchases and requested scans. Legitimate interests apply to service security, abuse prevention and operational logs. Legal obligations apply to required billing records. Consent applies only where we explicitly request it.
Providers
Neon provides the EU hosted PostgreSQL database, customer identity and protected session service. Vybentis renders the login inside the product. Cloudflare provides the application runtime, edge, queue, storage and isolated scan execution services. Mollie processes payment, subscription, invoice and required tax information. Resend delivers transactional email. GitHub provides the optional read only repository connection and social sign in when enabled. A separate GitLab OAuth connection is restricted to the private Core Industry account; it reads the connected account identity and stores encrypted access and refresh tokens. GitLab repository scans and customer connections are not enabled. Mistral receives only minimized and redacted finding data when an explanation or fix prompt is requested. The configured Alibaba Cloud Model Studio Qwen endpoint receives only bounded questions and minimized deterministic finding metadata for Ask AI. Sentry receives redacted technical errors and traces only when its reviewed integration is enabled. PostHog EU Cloud receives pseudonymous page route categories only after analytics consent and, only when separately reviewed and enabled, content free operational metrics for Mistral calls. After analytics consent, Microsoft Clarity may receive masked DOM and layout structure, interaction events such as clicks and scrolling, public page URLs and referrers, device, browser, operating system and viewport details, performance and diagnostic data, identifiers, IP addresses and approximate location derived from them. Strict masking hides page text but does not remove structural, URL or technical metadata. Advertising storage is always denied, and account, authentication, dashboard, scan and report routes are excluded. Microsoft acts as an independent controller for Clarity under its privacy terms. Other provider processing is governed by the applicable data processing and transfer terms.
Contact and affiliate data
The contact form sends your name, email address, selected topic and message through the protected Vybentis endpoint to Resend for delivery. Contact content is not sent to an AI model. Rate limit keys are pseudonymized. An affiliate link contains a unique name based slug and a random public code that is not derived from the account identifier. A technically necessary first party referral cookie stores that code for no more than 30 days. Conversion, commission and payout data is processed only under the confirmed affiliate terms.
International transfers
Production provider regions, access locations and transfer terms are verified before paid processing is enabled. Where personal data is transferred outside the European Economic Area, Vybentis uses an adequacy decision or appropriate safeguards under Chapter V GDPR, such as the European Commission standard contractual clauses, together with supplementary measures where required. The current provider overview is published on the subprocessor page.
Retention and deletion
Anonymous raw scan artifacts are kept for no more than 24 hours. Repository archives are deleted immediately after normalization. Raw browser traces are kept for no more than seven days. Findings and reports remain while the project exists. Project deletion removes scans, findings, reports, repository connections and product entitlements. Open checkout sessions are closed and a payment completing during deletion is automatically refunded. Legally required billing ledger records remain separately with minimized identifiers. Pseudonymous payment reconciliation data contains no account or project identity and is removed after no more than 30 days. Rate limit counters expire after no more than two days.
Your rights
Subject to the GDPR, you may request access, correction, deletion, restriction, portability and objection. You may withdraw consent with effect for the future where processing relies on consent. You may also complain to a competent data protection authority, including the State Commissioner for Data Protection and Freedom of Information North Rhine Westphalia. Contact info@vybentis.dev. Authentication and payment providers may need to handle parts of a request concerning data they control directly.
Automated decisions
Vybentis uses deterministic rules to calculate technical findings and release readiness results. These results do not produce a decision with legal or similarly significant effects about a person. No solely automated decision making within Article 22 GDPR is used.
Cookies and security
Vybentis uses technically necessary authentication and workflow storage. Optional PostHog and Microsoft Clarity product analytics are disabled by default and start only after explicit consent. Consent can be withdrawn at any time through Cookie settings. No advertising cookies or cross site tracking are used. We apply tenant isolation, encryption in transit, hashed API credentials, bounded scanner execution and access logging. No internet service can promise absolute security.
Changes to this notice
We update this notice when processing purposes, providers, retention rules or legal requirements materially change. The date and document version at the top identify the published version. Material changes affecting an account or contract are communicated through an appropriate product or email notice where required.