Legal
Privacy Policy
Last updated 26 October 2026
This policy explains what Michael collects, why, where it is stored, and what you can make us do about it. It covers the hosted service at michaelsec.com and the agent you install. It does not cover a self-hosted console, where you are the operator and we never see the data.
1. Who is responsible
For account data we are the controller. For the inventory your agent reports from your application we act as your processor — you decide what goes in, and our handling is governed by our Data Processing Agreement.
2. What we collect
| Category | What it is | Why |
|---|---|---|
| Account | Name, email, password hash, workspace name, role, sign-in times, IP and user agent | To run your account, secure it, and show you your sessions |
| Billing | Plan, invoices, payment status and provider references. Never card numbers — our payment provider holds those | To charge you and keep accounting records |
| Applications | Application name, platform, framework, optional repository URL, environment label | To choose the right enforcement path |
| Inventory | Package names and versions from your lockfile, and the language/runtime versions | To match vulnerabilities |
| Findings and events | Matched vulnerabilities, severity and priority, rules published, agent reports, containment actions | To rank risk, enforce rules, and explain what happened |
| Alert settings | Alert email, notification level, digest preference | To send the mail you asked for |
| Operational logs | Request path, status, timestamp, tenant identifier | To find faults and abuse |
| Product analytics | Page path, referrer, campaign parameters, a random visitor and session id kept in your browser, and Core Web Vitals timings | To know which pages are read and which are slow. No fingerprinting, no cross-site profile, no advertising ids |
3. What we never collect
The agent does not read or transmit your source code, secrets, environment variables, database contents, or host credentials. It reads the dependency lockfile and runtime versions, and reports those. Any claim that a security product needs your source to do dependency work is a choice, not a requirement — ours does not.
4. Legal bases
- Contract — account, inventory processing, billing, support.
- Legitimate interests — securing the service, preventing abuse, aggregate product analytics.
- Consent — marketing email, which is opt-in and one click to leave.
- Legal obligation — tax and accounting records.
We comply with the Nigeria Data Protection Act 2023 and, for customers in the EU/EEA and UK, with the GDPR and UK GDPR respectively.
5. Where it lives and who touches it
Data is stored in the European Union and the United States, depending on the sub-processor (see the list below). Transfers out of Nigeria or the EEA rely on appropriate safeguards — standard contractual clauses with each provider.
6. Sub-processors
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Managed PostgreSQL for the control plane | Account, workspace, applications, inventory, findings, events | EU |
| Resend | Transactional email | Email address, name, alert content | EU |
| Bachs | Payments | Billing email, payment reference and amount (no card data reaches us) | Global |
| Hostinger | Virtual server running the API and console | Everything stored at rest on the host | EU |
| Cloudflare | DNS and edge protection | Request metadata | Global |
| Google, GitHub | Optional federated sign-in | Verified email address and profile name | Global |
| Sabilytics | Privacy-first analytics on the public site (not the console) | Page path, referrer, UTM parameters, random visitor/session id, vitals timings. No cookies, no cross-site tracking | EU |
We publish changes to this list at least 14 days before a new sub-processor starts handling your data, and you may object as described in the DPA.
7. How long we keep it
- Account and workspace — until you delete them, then 30 days of soft-deletion before purge.
- Inventory snapshots — 90 days. Only the latest matters for matching.
- Findings — while open, then 12 months after resolution.
- Events and incident history — 12 months.
- Backups — 14 days, then overwritten.
- Invoices — 7 years, as tax law requires.
8. Your rights
You may ask for a copy of your data, correct it, delete it, restrict or object to processing, or receive it in a portable format. Write to [email protected]; we answer within 30 days. You can also complain to the Nigeria Data Protection Commission, or your local supervisory authority in the EU/EEA.
Deleting your account in Settings removes your applications, findings, rules and events, and signs out every session. Backups roll off within 14 days.
9. Security
TLS everywhere, scrypt password hashing with per-user salts, session cookies scoped to the console path, agent tokens stored only as SHA-256 hashes, tenant isolation enforced by database row-level security, least-privilege database roles per surface, and nightly encrypted-at-rest backups with a verification pass. Details on the security page.
10. Cookies and analytics
We set two cookies when you sign in: a session cookie, and a short-lived one that protects the sign-in form against cross-site request forgery. Neither is used for advertising, and no cookie is shared with another site.
We also measure how the product is used with Google Analytics 4, on the public
pages and inside the console. It sets its own first-party cookies on
michaelsec.com, and we configure it to anonymise the IP address
before storage, so location is no finer than a country. What we read from it:
which pages are read, which screens are used, where a signup stops, and which
call to action was followed.
What is never sent: your email address, your name, anything typed into a form, install or agent tokens, repository names and contents, package inventories, and findings. Page paths are recorded with their query string, which carries filters and page numbers, not identity. Google acts as our processor for this data under its own processor terms.
Analytics is optional. If your browser sends Do Not Track, we do not
load the tag at all, and blocking it changes nothing about the product: every
feature of Michael works with analytics blocked.
11. Children
Michael is a business tool and is not directed at anyone under 18. We do not knowingly hold data about children.
12. Changes
Material changes are announced by email or in the console at least 14 days before they apply. The date at the top always reflects the current version.
13. Contact
[email protected] · [email protected] for vulnerability reports.