Legal
Draft, not legal advice; lawyer review before publish. Updated 14/09/2026
NIP 9671492331 · ul. Władysława Pytlasińskiego 16/13, 00-777 Warsaw · VAT PL9671492331
Privacy Policy
Company: Beamer, a sole proprietorship registered in Poland ("we", "us", "our") Service: Defusor Website: defusor.beamercloud.com
This Privacy Policy explains what data we collect, how we use it, and your rights.
1. What Data We Collect
1.1 Account
You register before you pay. We collect:
- Email, name, and authentication data through Clerk (Google sign-in or email+password)
- Our user and company records (first signup creates both; the user is keyed to your Clerk id)
- After setup Checkout: Stripe customer and saved payment-method identifiers on the company. After the first paid invoice: subscription identifiers
1.2 GitHub (when you link repositories)
The GitHub App is repo grant, not product login. You confirm a payment method first; linking repositories happens after that and does not itself charge you. When you grant repositories, we collect:
- Installation id and the list of granted repositories
- Git history and GitHub objects needed for analysis: commit metadata, pull requests, reviews, issues, contributor identifiers
- Topology and runtime contracts derived during the job from patches (for example CI, deploy manifests, API specs appearing in diffs), not by checking out your working tree
We fetch a bare git object store to ephemeral disk when a paid analysis job runs, not when you only save a card or only link GitHub. During the job we process patches for evolution tracking. We store extracted rows (commit metadata, pull requests, topology), not the patch text and not a working copy of your source files. Before the first charge, and monthly after that, we select the product repositories from the linked GitHub grant, then read committer identity data on that subset to count git contributors for billing (latest month; identity count only). Extracted rows and the detected contributor count stay in our database (see retention). If you grant all repositories, GitHub includes repositories created later on that account or organization.
1.3 Payment
Stripe processes payment. We do not store card numbers. We store Stripe ids and payment status we need to operate the subscription.
1.4 Analysis artifacts
- Structure-inference prompts/completions sent via OpenRouter (aggregates derived from the dataset)
- Fitted k, labor rate R, run logs and prompt logs
- PDF reports
1.5 Usage
- Pages on our app needed to run the product
- Email delivery events from Resend (bounces, failures)
We do not run a separate advertising analytics product.
2. How We Use Your Data
- Authenticate you and keep the session
- Show the product, collect a payment method, count git contributors for billing, charge when GitHub, the hourly rate, and that count are set, run analysis, and email PDFs
- Operate the service (including out-of-band onboarding or explanation if you ask)
- Security, fraud prevention, and legal compliance
We don't sell your data, share your repository dataset with other customers, or use it for third-party advertising.
3. Data Sharing
3.1 Third-Party Service Providers
Locations retrieved 2026-08-20. Cloudflare Pages hosts the customer site. Clerk also uses Cloudflare; that is Clerk’s stack, not ours.
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Google Cloud | Analysis jobs, webhooks, PDF/object storage, images, logs | Session traffic to the API; bare git objects for the job (ephemeral, no working-tree checkout); PDFs and prompt logs; operational logs | europe-central2 (Warsaw) |
| Cloudflare Pages | Customer site (landing + app) | Page requests, CDN logs | Cloudflare edge (global). Cloudflare, Inc. is US. |
| Neon | Database | User and company records, entitlements, GitHub binding, extracted git dataset, k, R | aws-eu-central-1 (Frankfurt) |
| Clerk | Sign-up, sign-in, account | Email, name, password hashes, Google identity link, sessions | United States (Google Cloud + Cloudflare; no published GCP region; no EU region) |
| Google LLC | Google sign-in | Google account identity, if you choose that method | Google’s infrastructure (not our Cloud Run region) |
| Stripe | Payment | Email, customer and invoice records, payment method (held by Stripe) | United States (Stripe, LLC). A Polish Stripe account contracts with Stripe Payments Europe, Limited; that is not an EU storage pin. |
| Resend | Report and operational email | Email address, PDF attachment, delivery metadata | United States (storage). Sending region is separate and not a residency control. |
| OpenRouter | LLM inference proxy | Structure-inference prompts/completions; token metadata | OpenRouter, Inc. is in the United States. Prompts are forwarded to the model provider. |
| DeepSeek (via OpenRouter) | Default inference model | Those prompts/completions | People’s Republic of China per DeepSeek’s first-party privacy policy |
| Alibaba Cloud / Qwen (via OpenRouter) | Fallback inference model | Those prompts/completions | Endpoint chosen by OpenRouter; not a region we select |
| GitHub | GitHub App | Installation tokens; git history and diffs we fetch (bare objects); PRs/reviews/issues | github.com, United States. Extracted analysis data we keep is in Neon (Frankfurt). |
Providers are bound to use this data only to provide their service to us.
3.2 Legal Requirements
We may disclose data if required by law. We will notify you unless prohibited.
3.3 Business Transfers
If Beamer is acquired, your data may transfer to the new entity under this Policy.
4. Data Security
- In transit: TLS 1.2 or higher
- At rest: encryption provided by the hosts in §3.1
- GitHub App credentials and installation tokens stored as secrets on Cloud Run, not in the client
- Access limited to authorized Beamer personnel
5. Data Retention
| Data type | While subscribed | After the subscription ends |
|---|---|---|
| Extracted git dataset, k, R, PDFs, prompt logs, detected-headcount billing records, login and company records | Kept | 90 days, then deleted |
| Payment records | In Stripe | 7 years (tax) |
You can request earlier deletion at [email protected].
6. Your Rights
Email [email protected].
- Access: copy of data we hold, within 30 days, machine-readable
- Deletion: within 30 days, except records we must keep (tax)
- Export: reports and analysis data on request
- Correction: account fields via Clerk / the app; other corrections by email
- Object / restrict / withdraw consent: where those rights apply
7. GDPR
Polish sole proprietorship; GDPR is the primary framework. Customers get this standard regardless of location.
Legal bases: contract (deliver the service), legitimate interest (security and service integrity), legal obligation (tax).
Supervisory authority: UODO, ul. Stawki 2, 00-193 Warsaw, Poland. uodo.gov.pl
8. CCPA (California)
We do not sell personal information. Rights to know, delete, and non-discrimination apply as described above.
Categories: identifiers (email, name), account and GitHub activity needed for the analysis, commercial information (subscription status).
Sources: you, Clerk, GitHub App, Stripe.
9. Cookies
| Cookie | Purpose | Duration |
|---|---|---|
| Clerk session | Keep you signed in | Per Clerk’s session settings |
| Stripe Checkout | Payment on Stripe’s hosted page | Per Stripe |
No advertising cookies. Disabling cookies will prevent sign-in and payment.
10. Children
Not for anyone under 16. We delete data if we learn it belongs to a child.
11. International Data Transfers
Data is processed in the locations in §3.1, including the United States (Clerk, Stripe, Resend, OpenRouter, GitHub.com) and, for default model inference, the People’s Republic of China (DeepSeek via OpenRouter). Compute and our Postgres dataset are in the EU (Warsaw and Frankfurt) when configured as specified.
Transfers use the mechanisms those vendors publish (including the EU–US Data Privacy Framework and Standard Contractual Clauses where they rely on them).
12. Changes
We email you at least 30 days before material changes. The date at the top is the latest revision.
13. Contact
Privacy: [email protected] Support: [email protected]
Beamer, sole proprietorship, Poland
NIP: 9671492331
ul. Władysława Pytlasińskiego 16/13, 00-777 Warsaw
14. Summary
You create an account, save a payment method, grant GitHub repositories, we count git contributors from the selected product repositories for billing, then charge and analyze. You are billed monthly. The PDF is delivered quarterly. We fetch git history (bare objects, not a working-tree checkout) for the job, keep an extracted dataset in Frankfurt, and email a PDF. Account login data is in the US (Clerk). Card data stays with Stripe. Analysis prompts go through OpenRouter to the model provider (DeepSeek’s policy: China). We don’t sell your data. You can ask us to export or delete it.