Privacy policy
Who we are
ShipMender (shipmender.com) is run by [Jason Issac], a sole trader based in the United Kingdom, trading as ShipMender. We are the controller of the personal data described here. Contact: hello@shipmender.com. [Postal address for data protection requests.] [ICO registration number, if required.]
What we collect
- Scan requests: the GitHub repository URL or website URL you submit, your email address, your confirmation that you own or are authorised to test the target, and your IP address (used for rate limiting and abuse prevention).
- Scan content: the public code or publicly accessible website responses we analyse to produce your report. This may incidentally include personal data or secrets contained in that code.
- Reports: the findings we generate.
- Payments: handled by Stripe. We receive confirmation of payment, your email and limited billing details; we never see or store full card numbers.
- The ShipMender Weekly: your email address and subscription status, if you sign up.
- Emails you send us and technical server logs (IP address, time, requested page, browser type).
Why we use it, and our lawful basis
- To run the scan, deliver your report and provide what you paid for: performance of a contract.
- To prevent abuse, enforce rate limits and keep the service secure: legitimate interests.
- To send The ShipMender Weekly: consent, which you can withdraw at any time using the unsubscribe link.
- To keep financial records: legal obligation.
We don't sell your data and we don't use your code to train AI models.
How long we keep it
- Cloned code and scan working files: deleted as soon as the scan finishes.
- Reports and the associated email address: deleted after 30 days.
- Payment and accounting records: 6 years, as required by HMRC.
- Newsletter data: until you unsubscribe.
- Server logs: [30] days.
Who we share it with
Service providers acting on our behalf: Hetzner Online GmbH (hosting, Germany), Stripe (payments), Resend (email delivery) and [newsletter provider]. Some providers may process data outside the UK; where they do, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Addendum. We may disclose data if required by law.
Your rights
Under UK GDPR you can ask to access, correct or delete your data, restrict or object to processing, and receive a copy in a portable format. Email hello@shipmender.com. We will reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
Cookies
The site doesn't use advertising or analytics cookies. [Update this section if analytics are added.] Stripe may set cookies on its checkout pages, which are covered by Stripe's own policy.
Changes
We'll update this page if our practices change and revise the date above.