Legal / Data transparency
Data Collection Policy
A product-level inventory of what BlackBeeDevs Cloud collects, where it comes from, why it is needed, and the handling rules for audits, credentials, agents, and AI.
1. Notice at collection
At or before account creation and use of product features, BlackBeeDevs Cloud may collect the categories below for the stated business purposes. We do not sell these categories or share them for cross-context behavioural advertising. We retain each category only for the period reasonably necessary for its purpose, security, legal compliance, dispute resolution, and backup completion. For legal bases, rights, and disclosures, read our Privacy Policy.
2. Data inventory
| Category | Examples and source | Purpose | Storage / handling | Recipients |
|---|---|---|---|---|
| Identity and account | Name, email, password submitted by you; verification status | Create, authenticate, recover, and administer accounts | Password is salted and hashed; verification code is hashed and expires in 2 minutes | Supabase; Resend receives email and verification message |
| Session and security | Session, CSRF, invitation and API tokens; IP/request signals | Authentication, permissions, abuse prevention, audit logging | Tokens are hashed where only validation is needed; web session expires in 7 days; structured client ID is shortened and hashed | Supabase, Vercel; Redis if configured |
| Workspace and team | Workspace name, members, roles, invitations, report branding | Collaboration, access control, reporting | Stored in workspace state until removed or workspace/account deletion | Supabase; authorised users; Resend for invitations |
| Projects and domains | Project name, production URL, verification token and result | Organise targets and establish technical control | Stored with project. DNS/HTTP verification may expose a token publicly by design | Supabase; DNS or hosting provider when proof is published |
| Audit and deployment results | URLs, status, redirects, headers, TLS, metadata, performance, accessibility, screenshots, findings | Run and report requested technical analysis | Results stored in workspace history; scanner contacts submitted target and in-scope pages | Supabase; Vercel runtime; target host; authorised report recipients |
| Protected-target credentials | Bearer token, basic username/password, or session-cookie header supplied per scan | Access an authorised protected target during that scan | Used in memory. Audit record stores authentication type, not credential. Logs and errors must not include it | Target host; runtime processing needed for scan |
| CLI/API/agent | Key hash and scope, repository label, connection state, task text, status, commit/PR links | Authenticate tools and coordinate approved work | API secret shown once; hash stored. Task records persist in workspace history | Supabase; connected tool or agent; repository provider when used |
| AI provider and conversations | Provider, model, encrypted API key, prompt, recent messages, project metadata, up to 20 findings, response, usage metadata | Generate analysis and agent handoffs at user request | Key uses AES-256-GCM authenticated encryption. Conversations are stored. Key is decrypted only for provider request | Supabase; user-selected OpenAI or Anthropic |
| Billing | Plan, Stripe customer/subscription IDs, invoice and event records | Checkout, renewal, entitlements, portal, accounting | We store billing identifiers and state, not full card details | Stripe; Supabase; authorised workspace owner |
| Communications | Email, invitation/verification content, delivery ID, support messages | Transactional delivery and support | Stored as needed for account state and troubleshooting | Resend; Supabase; support personnel |
| Preferences and usage | Notification settings, plan consumption, theme/browser settings | Personalise interface, enforce limits, send notices | Server state for settings; browser storage for temporary return links and preferences | Supabase; local browser; Vercel runtime |
3. Website-audit collection boundaries
- The scanner starts from the URL and page/depth limits you choose. It may follow in-scope links and redirects and fetch public technical assets required to analyse a page.
- Private network destinations are blocked and redirects are revalidated to reduce server-side request-forgery risk.
- Audits may observe text and metadata delivered by the target. Do not scan pages containing personal or regulated data unless your organisation has approved that processing.
- Browser analysis and screenshots run only where the deployment environment supports them. A screenshot may capture content visible to the authenticated test session.
- Audit results are point-in-time evidence. Shared report links disclose results to anyone with the link until revoked; treat the link as confidential.
4. Credential-handling rules
Account and API credentials
Passwords and validation-only tokens are stored as one-way hashes. API keys are displayed only when created. Use separate keys per integration, select the narrowest scope, bind to one project when supported, store keys in a deployment secret manager, and rotate after exposure or personnel changes.
Target credentials
Use a dedicated, least-privileged test identity and short-lived token or cookie. Never paste credentials into project names, URLs, terminal history, agent tasks, reports, or support messages. Revoke the session after the audit. BlackBeeDevs records that authentication was used but is designed not to save the submitted secret with the audit.
AI API credentials
Provider keys are encrypted rather than hashed because the Service must retrieve them to call the provider. They are never returned after storage. Workspace owners and administrators can replace or remove providers. Use a dedicated provider project with spend limits and no unrelated privileges.
5. AI request data flow
- An authorised user selects a provider, project, and prompt.
- The server retrieves and decrypts the workspace provider key in memory.
- It constructs a request that may contain the prompt, recent conversation, selected project metadata, and up to 20 open findings.
- The request is sent directly to OpenAI or Anthropic using that key. Provider processing is governed by the workspace’s provider account and terms.
- The response and conversation are stored in BlackBeeDevs Cloud. An agent handoff can be copied into a coding tool by the user.
Source repositories are not automatically uploaded by this feature. A connected coding agent may receive task text through the user-approved agent workflow. Users must review displayed context and remove secrets or unnecessary personal information before sending.
6. Service-provider map
| Provider | Role | Data involved |
|---|---|---|
| Vercel | Application hosting and runtime | Requests, network/device metadata, runtime logs, content processed by server functions |
| Supabase | Persistent application storage | Account, workspace, projects, results, configuration, billing and collaboration state |
| Resend | Transactional email | Recipient, sender, subject, message content, delivery metadata |
| Stripe | Payments and subscription management | Customer details, payment information, subscription, invoice, tax and fraud signals |
| OpenAI / Anthropic | Optional user-selected AI inference | Prompt, selected context/findings, conversation, API authentication, response and usage metadata |
| Target and repository providers | Systems the user directs the Service or agent to contact | Audit requests and credentials; user-approved repository operations |
Providers may use subprocessors and process data in multiple regions. Their agreements and notices apply to independent processing. We may replace a provider with a functionally similar service and will update this page for material changes.
7. User and workspace controls
- Access and correction: update your name and workspace settings in Settings; contact us for a broader export or correction.
- Deletion: delete your account in Settings. Workspace owners should export needed reports first.
- Sharing: revoke shared audit links and remove members who no longer need access.
- Credentials: revoke API keys, disconnect agents, replace AI keys, and expire target-site test sessions.
- Minimisation: scan the fewest pages needed, use public targets where possible, and avoid secrets or personal information in prompts and tasks.
- Privacy requests: email hello@blackbeedev.com. We may verify identity and workspace authority.
8. Changes
We update this inventory when collection practices materially change. This policy supplements, and does not replace, the Privacy Policy or Terms.