Privacy policy
Last updated: 30 October 2026
This policy explains how Permiscope handles personal data on permiscope.com, in the app at permiscope.app and in the Permiscope scanner. Permiscope is a service for businesses; it is not offered to consumers.
1. Who we are
Permiscope is run by szczesny.com Radosław Szczęsny, ul. Obwiednia Południowa 62B/13, 44-200 Rybnik, Poland, NIP 6472381490 (“we”). For anything about your data, write to privacy@permiscope.com.
2. Our two roles
- Controller for the data of people who visit our website, create an account or contact us, and for data we need to run, secure and bill the service.
- Processor for the data our customers send to Permiscope about their own devices, configurations and people (for example device names and alert recipients). There, the customer organization is the controller and we act only on its instructions under our data processing agreement. Requests about that data are best sent to your employer or the organization that uses Permiscope; we will pass on any we receive.
3. What we collect
Website (permiscope.com)
The website sets no cookies, runs no analytics or advertising scripts and loads nothing from third parties; its fonts are served from our own domain. Our hosting provider, Cloudflare, processes your IP address and request details to deliver the pages and protect them from attacks. We have turned off request logging in our own hosting account.
Account and app (permiscope.app)
- Name, email address and a password hash (we never see or store your password in readable form).
- If you turn on two-factor authentication, the encrypted secret and backup codes.
- Sessions: IP address and browser user agent, so you can see where you are signed in and we can detect abuse. A session expires after a set time and is then deleted.
- Organization membership, role and invitations (the invited email address), and actions in the audit log, which stores a keyed hash of the IP address, never the address itself.
- Alert preferences and the alerts sent to you by email.
The app uses only strictly necessary cookies: the sign-in session cookie and its security companions. There are no tracking cookies, so we do not ask for cookie consent.
Scanner (on a customer’s devices)
The scanner reads the configuration files of AI clients (Claude, Cursor, VS Code and others) and reports which MCP servers are set up: their names, the commands and arguments they run, the names of environment variables and the paths of the projects they belong to. Before anything leaves the device, values of environment variables, headers and credential-like arguments are redacted, and the home folder is replaced with “~” so the operating-system user name is not sent. The device is identified by a one-way hash of its host name and user, plus any label an administrator gives it. The scanner never reads source code, documents, browser data or the contents of your projects, and it is designed never to send secrets.
4. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, sending account and alert emails | Contract, Art. 6(1)(b) |
| Keeping the service secure: sign-in protection, rate limits, audit log, abuse prevention | Legitimate interest in a secure service, Art. 6(1)(f) |
| Answering your messages | Legitimate interest in replying, Art. 6(1)(f) |
| Invoicing and accounting, once paid plans start | Legal obligation, Art. 6(1)(c) |
| Defending or pursuing legal claims | Legitimate interest, Art. 6(1)(f) |
We do not sell personal data, use it for advertising, or use customer data to train AI models.
5. How long we keep it
Deletion is automatic and runs every hour.
| Data | Kept for |
|---|---|
| Account data | Until you delete the account (Account → Delete account), or within 30 days after you ask us to |
| Sessions, sign-in and verification tokens | Until they expire |
| Invitations | 30 days after they expire |
| Scan records | 180 days (the latest scan of each configuration is kept as long as the configuration) |
| Sent notifications (recipient and text) | 90 days |
| Acknowledged alerts | 1 year after the last activity |
| Audit log | 2 years |
| Invoices and accounting records | As long as tax law requires (in Poland, 5 years from the end of the tax year) |
| An organization’s data, after it stops using Permiscope | Deleted within 30 days, as set out in the DPA |
Database backups are overwritten on a rolling basis, so deleted data disappears from them within 30 days.
6. Who we share it with
We use these service providers (sub-processors), each bound by a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting of the website and app, network security, DNS | Global network; company in the USA |
| Supabase, Inc. | Database | EU (Frankfurt, Germany) |
| Resend (Plus Five Five, Inc.) | Sending email | USA |
Transfers outside the European Economic Area rely on the EU–US Data Privacy Framework where the provider is certified, and on the European Commission’s standard contractual clauses. If your organization connects Slack or Microsoft Teams, alerts are sent to the channel it chose; that is the organization’s own service. We disclose data to authorities only when the law requires it.
7. Security
Data is encrypted in transit and at rest; each organization’s data is isolated in the database by row-level security; webhook addresses are encrypted with a dedicated key; secrets are redacted on the device and again on the server. More detail is in the DPA. To report a vulnerability, write to security@permiscope.com.
8. Your rights
You may ask for access to your data, its correction or deletion, restriction of processing, a copy in a portable format, and you may object to processing based on legitimate interest. Write to privacy@permiscope.com; we reply within one month. You can also complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or to the authority where you live or work.
Giving us your data is voluntary, but without an email address we cannot create an account. We do not make decisions about you based solely on automated processing.
9. Changes
We will publish any change on this page with a new date. If a change matters for how we use your data, we will also tell account holders by email before it takes effect.