Privacy Policy

This Privacy Policy explains how Shadowfill Ltd ("we", "us", or "our") processes your personal data when you use Penumbra, our AI-powered compliance scanning platform (the "Service").

Shadowfill Ltd is the data controller for personal data processed through the Service. If you have any questions about this policy please contact us at privacy@shadowfill.com.

We collect only the data necessary to provide and improve the Service:

• Account information — your name, email address, and organisation name provided when you sign up via Clerk.
• Repository metadata — repository names, file paths, and commit metadata from the GitHub repositories you connect. We do not store your source code beyond the time needed to complete a scan.
• Scan results — findings, compliance scores, and AI-generated remediation prompts produced for your organisation.
• Usage data — pages visited, features used, and errors encountered, collected via PostHog analytics (only when you accept cookies).
• Technical and device data — IP address, browser type, and operating system, retained only in server logs for security and debugging purposes.
• Billing information — subscription status and plan tier managed by Clerk Billing. Full payment card details are handled by Stripe and are never stored on our servers.

We use the data we collect to:

• Create and manage your account and organisation.
• Run compliance scans and deliver results to you and your team.
• Process subscription payments and enforce plan entitlements.
• Send transactional emails (scan completion, billing, security alerts). We do not send marketing emails unless you have explicitly opted in.
• Detect, investigate, and prevent security incidents and abuse.
• Improve the Service by analysing aggregated, anonymised usage patterns.

We do not sell, rent, or share your personal data with third parties for commercial purposes.

We use a limited number of trusted sub-processors that act on our behalf and are contractually bound to process data only as instructed:

We may disclose personal data if required to do so by law, court order, or regulatory authority, or to protect the rights, property, or safety of Shadowfill, our users, or the public.

We use cookies and similar technologies to operate the Service and, with your consent, to analyse how it is used. You can withdraw consent at any time by clearing your browser cookies; the consent banner will reappear on your next visit.

We retain personal data for as long as your account is active or as needed to provide the Service. If you close your account or request deletion, we will delete your personal data within 30 days, except where we are required to retain it for legal or regulatory obligations (e.g. financial records, which may be kept for up to 7 years).

Anonymised, aggregated usage statistics that cannot identify you may be retained indefinitely for product improvement purposes.

We implement industry-standard technical and organisational measures to protect your data, including encryption in transit (TLS 1.2+), encrypted storage, access controls, and regular dependency auditing via Penumbra itself. No method of transmission over the internet is entirely secure; if you discover a vulnerability please contact us at security@shadowfill.com.

Under UK and EU data protection law you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — request deletion of your personal data ("right to be forgotten").
• Restriction of processing — ask us to limit how we use your data in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — withdraw analytics consent at any time by clearing your cookies.

To exercise any of these rights, email privacy@shadowfill.com. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do we will update the "last updated" date at the top of this page and, for material changes, notify account holders by email. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

For any questions, requests, or complaints relating to this policy:

• Email: privacy@shadowfill.com
• Company: Shadowfill Ltd