Privacy Policy

Last Updated: July 3, 2026

Code Audit is operated by Transplane Pte. Ltd. ("we", "us", or "our"). This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you use our AI-assisted code security audit platform, including uploaded source code, audit metadata, reports, account data, and billing-related records.

1. Information We Collect

We collect information you provide directly, such as email address, display name, organization or workspace name, account preferences, support messages, and billing details handled through our payment provider. We also collect service data created when you use Code Audit, including uploaded source archives, selected repositories or assets, audit configuration, task status, timestamps, file size metadata, usage records, generated findings, reports, report unlock events, device and browser metadata, IP addresses, session cookies, and security logs.

2. How We Use Information

We use information to provide and operate the service, authenticate users, process audit tasks, generate findings and reports, enforce usage limits, administer Credits and report unlocks, manage subscriptions or invoices, provide support, troubleshoot errors, monitor reliability, protect the platform from abuse, improve product quality using aggregated or de-identified operational patterns, and comply with applicable legal, accounting, tax, and security obligations.

3. Source Code and Report Processing

You retain ownership of your source code and generated reports. We process uploaded source code, dependency information, configuration files, code excerpts, and generated evidence only to provide the audit workflow you request, operate related features, investigate support issues you raise, prevent abuse, and satisfy legal obligations. We do not sell your source code. We do not use private source code to train public foundation models. Source code may be retained until you delete it, close your account, or request deletion, subject to backups, fraud prevention, billing records, and legal requirements.

4. AI and Model Provider Processing

Code Audit uses configured AI models, model gateways, and infrastructure providers to analyze code and produce security findings. Depending on the selected model, team group, and administrator configuration, relevant prompts, code excerpts, repository metadata, audit context, and model outputs may be transmitted to those providers or processors solely to deliver the requested audit. We require service providers to process data under their service terms or data-processing commitments, but their handling may also be governed by their own policies.

5. Retention and Deletion

We retain account records, audit metadata, uploaded files, reports, billing records, and support communications for as long as needed to provide the service, maintain security, resolve disputes, enforce agreements, meet tax and accounting obligations, and comply with law. When you delete a project, asset, report, or account, we start the applicable deletion workflow. Some data may remain for a limited period in backups, logs, anti-abuse records, payment records, or legal archives where retention is necessary.

6. Disclosure and Subprocessors

We disclose information only as needed to operate Code Audit: hosting and storage providers, model providers or model gateways, payment processors, email and support tools, analytics and security vendors, professional advisers, affiliates or contractors working under confidentiality duties, and government or law-enforcement authorities when required by valid legal process. We do not sell, rent, or trade personal information or source code to data brokers or advertisers.

7. Security Measures

We use reasonable administrative, technical, and organizational safeguards designed to protect accounts, uploaded source code, reports, and operational logs. These safeguards may include access controls, credential protection, network and application monitoring, encryption where appropriate, least-privilege procedures, audit logging, and review of sensitive operational workflows. No online service can guarantee absolute security, so you should keep credentials confidential and promptly report suspected unauthorized access.

8. Your Choices and Rights

Depending on your location and the nature of the data, you may have rights to access, correct, export, delete, restrict, or object to certain processing of your personal information. You may also withdraw consent where processing depends on consent, without affecting earlier lawful processing. You can use available account settings or contact [email protected] to submit a request. We may need to verify your identity and may retain information where required for security, billing, dispute resolution, or legal compliance.

9. Legal Bases for EEA, UK, and Swiss Users

Where GDPR or similar laws apply, we process personal data based on contract performance to deliver the audit service and manage your account, legitimate interests such as platform security, fraud prevention, service improvement, and customer support, legal obligations such as tax and accounting rules, and consent where we ask for it for a specific purpose. You may object to processing based on legitimate interests where applicable, and we will review the request under the relevant law.

10. California Privacy Notice

If California privacy laws apply to you, you may request information about categories of personal information we collect, sources, purposes, disclosures, and retention. You may also request access, correction, deletion, and non-discrimination for exercising privacy rights, subject to lawful exceptions. We do not sell personal information or share it for cross-context behavioral advertising as those terms are commonly used under California privacy law. Requests can be sent to [email protected].

11. International Transfers

Code Audit is operated by a Singapore company and may rely on service providers or infrastructure in Singapore, the United States, the European Economic Area, or other jurisdictions. Your information may therefore be processed outside your country of residence. Where required, we use appropriate contractual, organizational, or technical safeguards for cross-border transfers and evaluate provider commitments as part of vendor selection.

12. Cookies and Similar Technologies

We use cookies, local storage, and similar technologies for authentication, session management, security, preference storage, fraud prevention, and basic service diagnostics. Some analytics or monitoring data may be aggregated or de-identified to understand product reliability and usage patterns. You can control browser cookies through your browser settings, but disabling essential cookies may prevent login or core workflows from functioning.

13. Children

Code Audit is intended for professional and organizational code-security workflows and is not directed to children. We do not knowingly collect personal information from children under the age required by applicable law. If you believe a child has provided personal information to us, contact [email protected] so we can review and take appropriate action.

14. Changes to This Policy

We may update this Privacy Policy as our service, subprocessors, legal obligations, or operating practices change. When changes are material, we will provide reasonable notice through the product, email, website notice, or another appropriate channel where required. The updated policy applies from the stated effective or last-updated date, and continued use of the service after that date means the updated policy applies to your use.

15. Contact

For privacy questions, data requests, or concerns about how information is handled, contact [email protected]. For legal notices related to the service, contact [email protected]. Please include enough detail for us to identify your account or workspace and understand the request, but avoid sending sensitive source code or secrets through email unless we specifically request a secure transfer method.