Privacy Policy & Data Protection

1. Data Controller & Operating Entity

Zelsis ("we", "our", or "us") operates Zelsis, a service that scans code for security holes and bugs before release. This Privacy Policy outlines our global data processing practices for international users, in full alignment with the European Union General Data Protection Regulation (GDPR), the Turkish Law on the Protection of Personal Data (KVKK No. 6698), the California Consumer Privacy Act (CCPA/CPRA), and standard international data privacy principles.

2. Zero Codebase Retention Architecture

Source code submitted for static security analysis, secret detection, and architectural hygiene checks is processed in ephemeral serverless execution environments. Your code is scanned in memory and never stored. We keep findings plus a short snippet around each one; snippets are erased after 90 days. Finding metadata (rule, file path, line, severity, status) stays in your scan history until you delete the project or your account. We never index, sell, or train public AI/LLM models on your proprietary source code.

3. Categories of Personal Data Collected

• Account Credentials: Name, email address, GitHub username, avatar URL (when authenticated via GitHub OAuth).
• Telemetry & Audit Logs: Timestamps of security scans, pass/warning/failed clearance scores, rule violation counts.
• Anonymous Site Counts: We count page views and clicks on our own pages, together with the page, the referring site or utm_source, and the day. No cookie is set, and no IP address, user agent or other identifier is stored for this. Visitors who send Do Not Track or Global Privacy Control are not counted.
• Technical Metadata: IP address, browser user-agent, secure encrypted session tokens.
• Billing Records: Subscription plan tier, license keys, and transaction identifiers tokenized by PCI-DSS Level 1 certified payment gateways (Polar / Stripe). We never process or store raw payment card credentials.

4. Legal Grounds for Processing (GDPR Art. 6)

• Contractual Performance: Providing automated release gate services, processing repository audits, and managing developer subscriptions.
• Legitimate Interests: Protecting platform security, preventing abuse or denial-of-service attacks, and optimizing scanner performance.
• Product Emails: One onboarding email about running your first scan, sent under our legitimate interest in helping you use the service you signed up for. Every such email has a one-click unsubscribe; security alerts you enable and team invites are sent separately.
• Legal Compliance: Satisfying statutory taxation, financial accounting, and international reporting obligations.

5. Subprocessors & Cloud Infrastructure

To deliver high-availability, zero-latency release gates, Zelsis engages vetted third-party subprocessors. Each subprocessor operates under a Data Processing Addendum (DPA) incorporating European Commission Standard Contractual Clauses (SCCs):

6. Data Subject Rights & Erasure (GDPR Art. 17 / CCPA)

You maintain full rights to access, rectify, port, or permanently delete your account and all associated telemetry. You can execute permanent account destruction in your Project Settings dashboard ("GDPR / CCPA Data Erasure") or submit a formal deletion request to contact@zelsis.com.

7. Turkish Personal Data Protection Law (KVKK No. 6698)

For users located in Turkey or subject to the Republic of Turkey Law on the Protection of Personal Data No. 6698 (KVKK), Zelsis processes data strictly under Article 5 (establishment and performance of the contract, fulfillment of legal obligations, and legitimate interests of the data controller). In accordance with KVKK Article 11, data subjects are entitled to inquire about their personal data, request correction, request erasure upon cessation of processing reasons, and learn of third-party transfers. Requests may be directed to contact@zelsis.com.

8. Contact & Inquiries

contact@zelsis.com // Attn: Data Protection Desk