1. Who controls the information
The operating entity is Vidabug. For account, marketing, billing and security administration it generally determines processing purposes. For a customer application's source files, logs and personal data submitted for analysis, Vidabug generally acts as an operator/processor under that Customer's documented instructions, subject to the final Data Processing Agreement.
Contact the designated Information Officer and privacy mailbox on the Company & Legal Notices page; these must be completed before service activation.
2. What we may receive
Account details; organisation and billing information; authorised repository identifiers and commits; uploaded source archives; dependency manifests; documentation; user-selected test identities; engineering logs; evidence screenshots; recorded video, audio, transcript and test results; service usage and security audit events.
We discourage transferring production customer records, secrets, credentials, biometric data or special-category personal data unless strictly necessary, documented and separately protected.
3. Why and under what authority
Purposes include creating customer accounts, performing approved source analysis, fulfilling the work order, securing systems, processing verified payments, support, compliance, incident response and retaining necessary transaction evidence.
We rely on the applicable legal bases for each role and jurisdiction; there is no assertion that consent is the lawful basis for every necessary operation. Optional marketing and non-essential analytics require separate controls where applicable.
4. AI model providers and international processing
If enabled for an engagement, selected AI providers may receive scoped prompts, excerpts or artefacts needed for the requested task. Providers may process data in other countries. International transfers require appropriate legal grounds and safeguards, including POPIA section 72 and, where relevant, GDPR transfer rules.
An up-to-date, customer-accessible subprocessor and regional-processing register must identify actual vendors, purposes, location and contractual safeguards before customer source code is routed to them. Vidabug makes no claim of local-only data residency.
5. Repository credentials and source ownership
GitHub Apps, OAuth grants or narrowly scoped repository tokens should be handled server-side and encrypted where supported by the deployed credential vault. Customers can withdraw access at the source provider; queued sessions must respect revocation and stop new retrievals.
Repository connection does not authorise distribution of source code or model training, and analysis results remain linked to the selected commit. Never paste repository secrets into public chat messages.
6. Retention, deletion and legal hold
Retention depends on agreed contract, source classification, billing/tax obligations, incident investigation and legal holds. The exact retention schedule for uploaded archives, event logs, recordings and backups must be approved and published before production launch.
Subject to law and contractual duties, customers may request return/export and deletion of their content. Secure deletion of provider replicas and backups may take time and must be described accurately, not advertised as instantaneous.
7. Sharing and security
We disclose data to authorised staff, contracted operators, required infrastructure and selected AI providers on a need-to-know basis, and to public authorities where lawfully required. We do not sell customer source code as an advertising asset.
Security measures will be risk-based and documented in the Security Statement. No SOC 2, ISO 27001, zero-knowledge encryption or penetration-test certification is claimed unless independently evidenced.
8. Your rights and choices
Subject to applicable law, people may request access, correction, deletion, objections and information about processing, and complain to the relevant data protection authority. Where the Customer is the controller/responsible party for customer-project data, requests should ordinarily be routed to that Customer.
Provide verified identity and sufficient detail to avoid disclosing another person's records; requests are not automatically accepted without validation.
9. Cookies and updates
The current public site uses essential local application/session functionality. The appearance switch remembers your chosen visual style locally in your browser using devbugfix.appearance.v1; the style choice is not sent to our server or used for profiling. Future analytics, marketing pixels or preference cookies must be separately disclosed with appropriate controls before activation.
This policy is effective from 1 November 2026 and is reviewed at least once a year. Material changes will be notified as required.