Privacy Policy
AI Powered Smart Contract Audit Privacy Policy
Data Controller: Naviget SIA, reg. No. 40103628517, Rīga, Slokas iela 183, Latvia ("we," "us").
Effective Date: 09 July 2026
This Privacy Policy explains how we collect, use, disclose, and protect personal data in connection with AI Powered Smart Contract Audit (sca.aistarts.lv and associated API/MCP/A2A interfaces). It is written to comply with the EU General Data Protection Regulation (GDPR) and applicable Latvian data protection law.
This Policy covers personal data (data relating to an identified or identifiable natural person). It does not change the treatment of Submitted Code as confidential business information, which is separately governed by Section 4 of the Terms of Service.
1. What Personal Data We Collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, Google/GitHub account identifier, profile info returned by OAuth | You, via OAuth provider |
| Authentication secrets | GitHub Personal Access Tokens (for private repo audits), API keys | You |
| Billing data | Payment confirmation, billing email, transaction history, wallet address used for crypto payment (not full payment card numbers — these are handled directly by Stripe) | You; Stripe; NOWPayments |
| Usage data | IP address, browser/device metadata, audit request logs, timestamps, additional instructions text you submit (max. 500 characters) | Automatically collected |
| Communications | Support requests via Telegram (@AFCG_SUPPORT_BOT) or email | You |
| Incidentally processed data | If your Submitted Code or repository metadata (e.g., commit author names/emails) contains personal data of you or third parties, we process it as described in Section 3 | You (via Submitted Code) |
We do not intentionally collect special categories of personal data (Art. 9 GDPR) and ask that you do not include such data in code, commit messages, or free-text instructions submitted to the Service.
2. Legal Bases for Processing
We process personal data on the following legal bases under Art. 6(1) GDPR:
- Contract performance (Art. 6(1)(b)): to create your account, process payments, run audits, and deliver Deliverables.
- Legitimate interests (Art. 6(1)(f)): to secure the Service, prevent fraud and abuse, screen for AML/sanctions risk, improve our detection pipeline in aggregate/de-identified form, and respond to support requests.
- Legal obligation (Art. 6(1)(c)): AML/sanctions screening, tax and accounting records, responding to lawful requests from authorities.
- Consent (Art. 6(1)(a)): where we ask separately, e.g., for optional marketing communications.
3. Personal Data Incidentally Present in Submitted Code
Smart contract repositories occasionally contain personal data unintentionally (e.g., a developer's name/email in commit history or code comments). We do not actively search for such data. Where our automated pipeline processes a repository, any incidental personal data is subject to the same access controls, subprocessor list, retention, and deletion rules as Submitted Code generally (Terms of Service, Section 4.5). If you are a Customer submitting a repository that includes personal data of your own personnel or contributors, you are responsible for having a lawful basis to disclose that data to us (see also the Data Processing Agreement, where applicable).
4. How We Use Personal Data
We use personal data to: provide and maintain the Service; authenticate you; process payments and prevent fraud; perform AML/sanctions screening on crypto deposits (via GoPlus Security); operate support channels; send service-related notices (e.g., changes to these policies, incident notifications); comply with tax, accounting, and legal obligations; and, in aggregate/de-identified form only, to improve the reliability of our audit pipeline.
We do not sell personal data. We do not use personal data to train third-party foundation models beyond the ordinary inference calls needed to produce your audit (see Section 5).
5. Subprocessors and International Transfers
To provide the Service, we share data with the following categories of subprocessors:
| Subprocessor category | Purpose | Location |
|---|---|---|
| LLM/AI providers (e.g., Anthropic and other model providers used in our agent pipeline) | Processing Submitted Code and generating audit content | May be located outside the EEA (e.g., United States) |
| GitHub | Repository access via OAuth/PAT | United States |
| Stripe | Card payment processing | United States/EU |
| AMLBot | AML/sanctions risk screening of crypto deposits | European Union |
| Hosting provider | VPS infrastructure hosting the Service | EU (Latvia) |
| Telegram | Support relay and internal alerting | Outside EEA |
Where a subprocessor is located outside the European Economic Area, we rely on an appropriate transfer mechanism, such as the EU Standard Contractual Clauses, an adequacy decision, or another safeguard recognized under Art. 44–49 GDPR. A current list of subprocessors is available on request at info@aistarts.lv.
We disclose personal data to law enforcement or regulators only where required by applicable law, and we will notify you unless legally prohibited from doing so.
6. Data Retention
- Account and billing data: retained for the life of your account and for 5 years thereafter for tax and accounting purposes as required by Latvian law.
- Submitted Code and Deliverables: retained per the schedule in the Terms of Service (Section 4.5); by default, Submitted Code is deleted or anonymized 90 days after the audit completes, except where retained longer (a) with your consent, (b) to investigate abuse/prohibited-content flags, or (c) as required by law.
- Usage/security logs: retained for up to 12 months for security and fraud-prevention purposes.
- API keys/tokens: retained until revoked by you or deleted upon account closure.
7. Your Rights
Subject to conditions under GDPR, you have the right to: access your personal data; request rectification; request erasure; restrict or object to processing; request data portability; and withdraw consent at any time where processing is based on consent. To exercise these rights, contact us at info@aistarts.lv.
You also have the right to lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv) or your local supervisory authority.
8. Security
We apply technical and organizational measures appropriate to the risk, including: sandboxed Docker execution for audits, restricted network access for audit containers, comment-stripping of Submitted Code before LLM transmission (prompt-injection mitigation), foundry.toml validation, dependency installation with --ignore-scripts --prefer-offline, encrypted storage of secrets, and AML screening via GoPlus Security. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.
9. Cookies and Similar Technologies
The dashboard (sca.aistarts.lv) uses strictly necessary cookies for authentication/session management and, where applicable, analytics cookies. We do not use analytics or marketing cookies. Only strictly necessary session cookies are used for authentication.
10. Children
The Service is not directed at, and may not be used by, individuals under 18. We do not knowingly collect personal data from children.
11. Changes to This Policy
We may update this Policy from time to time. Material changes will be notified via the dashboard or email at least 14 days before taking effect.
12. Contact
Data protection inquiries: info@aistarts.lv
Postal address: Slokas iela 183, Riga, Latvia
Telegram support relay: @aistartsbot