Privacy policy

01 Our two roles, and why the distinction matters

For account, billing and site usage data, Alexandre Ribes is the controller within the meaning of article 4.7 GDPR. Those processing operations are described below.

For the monitoring data your application sends us, Alexandre Ribes is a processor within the meaning of article 4.8. You, the client, remain the controller: you decide what your application sends, which retention period applies through your plan, and whether encryption is on. We process that data only on your instructions.

Those instructions and our commitments are set out in our article 28.3 data processing agreement, available at https://quietguard.dev/en/data-processing. If your application processes data on behalf of your own clients, we act as a sub-processor and it is for you to have obtained the authorisation required by article 28.2.

02 Processing for which we are the controller

• Account and dashboard access: name, email address, hashed password, language, team membership. Basis: performance of the contract. Kept for the life of the account. Deletion is immediate, with no grace period: you delete your account from your profile and it is gone at once. Closing a team is a different act: it deletes the team's data on the closure date and leaves its members' personal accounts untouched, each of them deleted by its own owner.
• Access security and abuse prevention: IP address, user agent, session timestamps, last use of API keys. Basis: legitimate interest in protecting our clients' accounts and detecting fraudulent access. Kept twelve months at most. A session expires after two hours of inactivity and its record is removed shortly after; the last-use date of an API key is cleared after twelve months by the nightly clean-up, while the key itself stays valid until you revoke it.
• Proof that the terms were accepted: the version accepted, the date, the IP address and the member who accepted, recorded when the team is created, together with the capacity declared (business, with its company identifier, or private individual) and, for a private individual, the date on which they asked for the service to start during the withdrawal period. Basis: legitimate interest in being able to prove the contract between us. Kept for the life of the contract, and not for the twelve months above: these do not watch an access, they evidence a commitment, and they go when the team does.
• Alerts, transactional email and the weekly report: name, email address, incident metadata. Basis: performance of the contract. Kept for the time it takes to deliver.
• Dashboard notifications: the title, summary and link of each alert dropped into the panel bell, for every member it reaches. Basis: performance of the contract. Kept ninety days, then removed by the nightly clean-up. Deleting your account removes yours straight away.
• Billing and subscription: name, email address, payment provider customer id, card type and last four digits, invoice history. Bases: performance of the contract and legal obligation. Kept ten years from the close of the financial year, article L123-22 of the French Commercial Code.
• Withdrawals by consumer clients: the team name, the date the withdrawal was received, the amounts paid, kept and refunded, the date of the refund. Bases: legal obligation (articles L221-18 et seq. of the French Consumer Code) and legitimate interest in proving that the refund was made. Kept ten years from the close of the financial year, like an accounting record (article L123-22 of the French Commercial Code), including after the team is closed.
• Answering your messages: name, email address, content. Basis: legitimate interest in answering an approach you initiated. The contact form stores nothing in the service: your message is emailed to us and lives in our inbox, not in a database. Kept three years after the last contact, in that inbox.
• Team invitations: the invited person's email address, supplied by the member inviting them. Basis: legitimate interest in letting a team be formed. The invitation is deleted the moment it is accepted, and otherwise by the first nightly clean-up after its seven days of validity.
• AI assistant authorizations: when you connect an assistant to the MCP server, we record the identifier of the authorized application, the scope granted, and the token's creation and expiry dates, attached to your account. Basis: performance of the contract. The token is deleted as soon as it expires, or you revoke it, by the nightly clean-up, and immediately if you delete your account.

03 Audience measurement on the public site

We measure visits to the public pages of this site, meaning the home page, the documentation and the legal pages, with Quiet Metrics, an audience measurement service we also publish, hosted in France by OVH. The measurement runs from our server: no script is loaded in your browser. The dashboard, the status pages and the invitation links are not measured.

For each page view, our server sends Quiet Metrics the address of the page, stripped of its parameters except the campaign ones (utm_source, utm_medium, utm_campaign and ref), only the domain of the site you came from, your IP address, your user agent and your browser language.

Your IP address and user agent are never stored. For the time of collection they serve to derive your country and region, your browser, operating system and device type, and to compute a pseudonymous fingerprint: a hash with a salt renewed every day and destroyed thirty hours later at most. The fingerprint therefore changes every day; it cannot recognise you from one day to the next or from one site to another, and we match it with no other data, in particular not with your account.

Purpose: knowing how our pages are visited in order to improve the site and its documentation, as aggregated statistics only. Legal basis: legitimate interest in measuring the audience of our own site. Retention: twenty-five months at most. Recipient: us alone; Quiet Metrics is not a third party but a service we run ourselves.

You can object at any time, with no account and no request: open any page of the site with ?qm_ignore=1 added to its address, for example https://quietguard.dev/en?qm_ignore=1. Measurement stops for that browser, and ?qm_ignore=0 restores it. The two cookies involved are described on the cookie page, https://quietguard.dev/en/cookies. You also have the rights described below.

04 We never hold your card details

The card number is entered directly with our payment provider and never passes through our servers. We know only the type and the last four digits.

05 Data your application sends us

The client package sends exceptions, application logs, the dependency inventory and scheduled task signals. Those payloads may contain personal data of your own users.

We keep them for the retention period of your plan: seven days on Free, thirty on Solo, sixty on Indie, ninety on Studio. Deletion at the end of that period is automatic.

When a paid subscription ends, the retention of the plan you left still applies for thirty days, giving you time to export the data, before that of the free plan replaces it.

• By default the Laravel client package attaches to an exception the full request URL including its query string, the request body except password fields, and the identifier of the signed-in user. You can narrow this in its configuration.
• Activity synchronised from GitHub, when you connect a repository, includes the name and login of the people who contributed. If you turn on issue tracking, it also includes the title and body of the repository's issues, and their comments when you ask for them: free text written by third parties, whose content is not ours to decide.
• Backups you place in the vault are encrypted on your server before upload. We receive opaque blocks only, and deleting them is yours to do.
• If you connect an AI assistant to the MCP server, the data you ask it for is sent to that assistant on your instruction and leaves our service at that point. Its publisher is your supplier, not ours: we are not its processor, it does not appear in our list of recipients, and its own policy says what it does with the data. Encrypted content is sent to it only if a member of your team unlocks it for their assistants, from the Encryption page, for fifteen minutes to four hours, and only if a team owner has allowed it: for that time we hold your team key, and the message and trace of issues go to the assistant's publisher; the occurrence context never does. You withdraw that access whenever you like from the Connected applications page.

06 Two layers of masking, and what they still do not do

The client package masks before anything is sent, on your own server, so the values concerned never reach ours. It does so in two ways.

By field name: values whose key matches a configurable list (password, token, secret, cookie, authorization header, API key). By the shape of the value: email addresses, IBANs, card numbers, French social security numbers and French phone numbers, recognised wherever they sit, including in the free text of an error message or in a URL segment. The shapes that carry a check digit are verified rather than merely matched, so a sixteen digit order reference is not taken for a card number.

That is still not anonymisation. These patterns recognise known shapes; they do not recognise a name, a postal address, or an identifier particular to your business. As the controller, it is for you to configure both lists, to add your own patterns, to limit what your application logs and, if your payloads may carry personal data, to turn encryption on.

07 End to end encryption: what it does and what it does not

On paid plans you can encrypt the captured content. It is off by default and is turned on by the team owner. A key pair is generated; the private key is kept by us, encrypted under a key derived from your passphrase, which is never sent to us. If you lose it, nobody can restore the data, us included.

Encryption covers the exception message, its stack trace and its context, and the message and context of your logs. The metadata needed for grouping and search stays readable by us: exception class, file path, line, environment, release, channel, level and timestamps.

One limit we would rather state: if you use the server-side unlock instead of the browser unlock, your private key is rebuilt on our servers and stays there for the duration of your session. The browser unlock is the stronger guarantee, the key then never leaves your tab. The unlock for assistants has the same characteristic, for the duration you choose.

08 Recipients

We do not sell, rent or trade your data. It is disclosed only to the providers needed to run the service, named below.

• OVH SAS, 2 rue Kellermann, 59100 Roubaix. Hosting of the application, the database and the backups. France.
• Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2. Processing of payments, subscriptions and invoices. Ireland. Intra-group transfers to the United States, covered by the standard contractual clauses of 4 June 2021.
• Cloudflare, Inc., 101 Townsend St., San Francisco, California 94107. Anti-robot verification on the contact form and on registration. Receives the visitor's IP address, TLS fingerprint and user agent, on those two pages only. United States. Intra-group transfers to the United States, covered by the standard contractual clauses of 4 June 2021.
• Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Genève. Delivery of transactional email: alerts, invitations, reports and invoices. Switzerland. Transfer to Switzerland, covered by the European Commission's adequacy decision.

09 Changing a sub-processor

Where we act as your processor, we will tell you of any addition or replacement of a sub-processor at least thirty days before it takes effect, at your team owner's address. You have thirty days to object on data protection grounds under article 28.2. If your objection stands, you may terminate at no cost.

10 Transfers outside the European Union

The application, the database and the backups are hosted in France. Your monitoring data, meaning the exceptions, logs and backups your application sends us, does not leave the European Union.

The emails we send you, alerts, invitations, reports and invoices, are delivered by a provider established in Switzerland. They carry a name, an email address and incident metadata. Switzerland is the subject of an adequacy decision by the European Commission, so this transfer rests on that rather than on standard contractual clauses.

One transfer exists, for payment. Our provider contracts with us from Ireland, but some processing is carried out by its United States parent. That transfer is covered by the standard contractual clauses adopted by the European Commission on 4 June 2021, together where applicable with the provider's certification under the EU, United States data protection framework. You may obtain a copy of those safeguards by writing to privacy@quietsystems.dev.

When you pay, you are redirected to a page hosted by that provider. What you enter there is collected directly by them.

11 Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. Write to privacy@quietsystems.dev. We answer within one month of receipt, extendable by two months where the request is complex, under article 12.3 GDPR.

None of our processing rests on your consent, so there is no consent to withdraw. Providing account data is necessary to perform the contract: without it the service cannot be supplied.

If you are an end user of an application monitored by one of our clients, address your request to that client: they are the controller. We assist them in answering it.

If you disagree with how we handle this, you may lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or at cnil.fr.

12 Data protection officer

Given the nature and scale of our processing, appointing an officer is not mandatory under article 37 GDPR and we have not appointed one. Your requests are handled at privacy@quietsystems.dev.

13 Automated decision-making

We take no decision based solely on automated processing producing legal effects concerning you within the meaning of article 22. The service's automatic mechanisms, quota enforcement, alert rate limiting and deletion at the end of the retention period, are ways of performing the contract and involve no evaluation of you as a person.

14 Security

Encryption in transit, API keys stored hashed, per-team data isolation, configurable client-side masking, optional end to end encryption of content and backups.

In the event of a breach affecting your monitoring data, we will inform you without undue delay so that you can meet your own obligations under articles 33 and 34 as the controller.

15 Changes to this policy

Any substantial change is announced to team owners before it takes effect. The date at the top of this page governs.