Effective 8 October 2026 · Version 2026-10-08
This policy describes how the operator of Invince handles personal data. It is meant to be published as-is with the product. It is not legal advice, and it does not create rights beyond applicable law. If a rule of law gives you more protection than this page, that rule wins.
Invince is a software product. The operator can be reached at yonahmartinez30@gmail.com. We have not listed a separate registered-company name here. The Service runs at invince.dev.
For privacy requests (access, correction, deletion, export), email that address or use Profile → Download my data / Danger Zone after you sign in.
This policy covers the Invince website, app, APIs, GitHub App, emails we send, and SDKs that send data to us.
If you install our SDK in your application, you are the controller of your end users' data. We process that telemetry on your instructions as described in the Terms of Service. You must not send us passwords, payment card numbers, government IDs, health data, or children's data through the SDK.
Account. Email, password hash (stored by our auth provider, not as plain text we can read), name, how you said you would use the product, skill level, product mode, notification preferences, and the time you agreed to the Terms and this policy (version 2026-10-08).
Workspace and project. Workspace names, members, plan, connected GitHub repos you authorize, findings, documents, launch-gate results, and settings.
Public checks and Watch. The URL you paste, HTTP status, timing, public headers, and findings from HTML/JS a visitor can already see. We cap stored page size. Watch re-fetches that public URL on a schedule you asked for. Watch cannot see other people's logins or sessions.
SDK telemetry (only if you install it). Errors, breadcrumbs, performance samples, first-party hits, login events you report, bot-classification signals, named actions, and agent traces (steps, token counts, costs you report, loop flags).
Payments. Handled by Whop. We receive membership/plan status by webhook. We do not receive or store full card numbers.
Invites and affiliates. Referral codes, who referred whom, and (in the browser) a Whop affiliate code if present in the URL. We do not receive Whop payout bank details.
Technical. IP address used for rate limiting and abuse prevention, user agent, timestamps, and the cookies needed to keep you signed in.
Communications. Support emails, in-app notifications, and copies of those notices if you leave email on.
We do not sell your personal information. We do not use your repository or SDK content to train our own AI models.
The operator of Invince has not appointed a separate registered-company legal name on this page. Until that exists, the controller for account data is the operator you can email at yonahmartinez30@gmail.com. For SDK telemetry from your app, you are the controller and we are the processor (see the DPA). This table is a description of current processing, not legal advice.
| Activity | Data | Basis | Notes |
|---|---|---|---|
| Account and workspace | Email, name, password hash (held by the auth provider), role, legal-agreement version and time | Contract (Art. 6(1)(b)) | Needed to create the account you asked for and to record that you agreed to the current Terms. |
| Public Check and Watch | URL you submit, HTTP timing/status, public HTML/JS snapshots (capped), findings, Watch history | Contract | You ask us to fetch a public URL. We do not store other people’s session cookies from that site. |
| Repository scan and launch gate | Repo metadata, file paths, snippets used as evidence, pull-request numbers, check-run results | Contract | Only after you install the GitHub App on repos you choose. |
| SDK telemetry | Errors, breadcrumbs, performance samples, first-party hits, login events you report, agent traces | Contract (you are controller of end-user data; we process on your instructions) | Only if you install the SDK. Do not send special-category data, cards, or children’s data. |
| Paid plans | Whop membership/plan status and ids. Card numbers stay at Whop/Stripe. | Contract | Checkout is Whop (which charges through Stripe). Invince does not run a card form. |
| Transactional email | Email address and the notice content (Watch, invites, auth) | Contract; legitimate interests for security notices | Sent through Resend when configured. You can turn product emails off in Profile except security-required mail. |
| Abuse prevention | IP address, user agent, rate-limit counters, blocked IPs | Legitimate interests (Art. 6(1)(f)) — keeping the Service safe | You may object. We may still retain a short record if needed to stop attacks. |
| Shared platform AI | The snippet needed for the feature you clicked | Contract | Gemini or Groq. If you paste your own key, that provider’s terms apply to that request. |
| Support chat, issues, and ratings | Chat messages, issue text, optional rating, optional email, page path | Legitimate interests (Art. 6(1)(f)) to answer support; contract if you are signed in | Chat goes to Google Gemini. Issues, ratings, and a copy of the chat are emailed to the operator so a person can read them. |
| Optional product emails | Email address | Consent, which you can withdraw in Profile | Not required to use Check, Watch, or GitHub features. |
| Legal compliance | Account identifiers, payment-status records, agreement timestamps | Legal obligation (Art. 6(1)(c)) where a law requires a record | For example, a payment dispute. We are not a registered company yet; contact is the operator email on this site. |
Features that explain code, write docs, or suggest fixes send only the snippets needed for that request to an AI provider. The shared platform key uses Google Gemini, with Groq as a fallback. If you add your own key, requests go to the provider you chose (Gemini, OpenAI, Anthropic, or OpenRouter) under that provider's terms. Those providers are independent controllers or processors of that request content. Support chat also uses Google Gemini. Issues, ratings, and a copy of that chat are emailed to the operator so a person can read them.
The GitHub App is authorized by you. Default access is read contents and metadata, plus pull-request read and Checks write when you use the launch gate. Write access to open pull requests is off unless you grant it on GitHub and turn it on in the product. Uninstalling the App revokes access.
We use cookies and similar storage that are necessary to keep you signed in, to complete auth (PKCE), and to reopen a Check you just ran. First-touch Whop affiliate codes are stored in localStorage, not a cookie. We do not currently set third-party analytics or advertising cookies. The full list is on the cookies page. The banner on the site states the same.
We share data with processors who help us run the Service:
The current list, including locations, is on the subprocessors page. A DPA template is available if you need one.
We may also share information if required by law, to prevent harm or abuse, or in a transfer of the product to a successor operator (you would be notified).
Account and project data last until you delete the workspace or account. SDK events (errors, logs, traces, replays) are deleted after 90 days. see retention. After you close an account we delete Your Content within 30 days, and from backups within a further 30 days, unless law requires a longer hold (for example, records of a payment dispute).
We use HTTPS, hashed passwords via our auth provider, row-level security on customer tables, and encryption of stored provider keys. No method of transmission or storage is perfectly secure. See the Trust Center.
Depending on where you live (including the EEA, UK, and California), you may have the right to access, correct, delete, export, restrict, or object to certain processing, and to opt out of “sale” or “sharing” as those words are defined in US state law. We do not sell personal information for money. We do not share it for cross-context behavioral advertising.
You can export account data and delete your account from Profile. For other requests, email yonahmartinez30@gmail.com. We may need to verify it is you. You may complain to a data protection authority where you live.
The Service is for people 18 or older. We do not knowingly collect data from children. If you believe we have, email yonahmartinez30@gmail.com and we will delete it.
We and our processors may handle data in the United States and other countries. Where a transfer tool is required by law, we rely on the processor's published mechanism (for example, Standard Contractual Clauses used by that vendor).
We will change the effective date and version at the top when this policy changes. Material changes require you to agree again on the agree page (or we will email workspace owners). Continued browsing of public pages is not consent to a new version of product access.
yonahmartinez30@gmail.com
We use only the cookies necessary to keep you signed in. No analytics or advertising cookies are set. Cookie list