Skip to main content
SaaSVista

Privacy Policy

Effective March 12, 2026

SaaSVista ("we," "our," or "us") operates the website ai.saasvista.io and provides the SaaSVista Scan service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information.

Information We Collect

Information You Provide

  • Contact information — name, email address, company name, and job title when you book a call, submit a form, or engage with us.
  • Repository access — read-only access to GitHub repositories you authorize during a SaaSVista Scan engagement. We do not modify, store, or retain your source code beyond the engagement period.
  • Communication data — messages you send us via email or scheduling tools.

Information Collected Automatically

  • Usage data — pages visited, time on page, click interactions, referral source, and browser/device type.
  • Cookies and analytics — we use privacy-respecting analytics (PostHog) to understand site usage. No third-party advertising trackers are used.

How We Use Your Information

  • To deliver the SaaSVista Scan and related services
  • To communicate with you about your engagement, scheduling, and deliverables
  • To improve our website and service based on aggregate usage patterns
  • To send relevant updates about AI governance and compliance (only with your consent)

Repository Data & Source Code

During an engagement, we access your GitHub repositories with read-only permissions to scan for AI SDK usage, map compliance risks, and generate your Trust Pack and Response Kit deliverables. Specifically:

  • We never modify, copy, or store your source code on our systems beyond temporary processing during the scan.
  • Scan results (AI detections, risk findings, control mappings) are stored only for the duration of the engagement plus 30 days for quality assurance.
  • Your Trust Pack and Response Kit deliverables are provided to you and deleted from our systems within 30 days of delivery, unless you request otherwise.
  • We do not use your code or scan results to train AI models.

AI Processing

We use Anthropic's Claude API to enrich scan findings with contextual analysis. Code snippets sent to the API are:

  • Limited to small, relevant excerpts (not full files)
  • Not retained by Anthropic for model training (per Anthropic's commercial API terms)
  • Processed only for your engagement deliverables

Data Sharing

We do not sell, rent, or trade your personal information. We may share data with:

  • Service providers — hosting (Vercel), analytics (PostHog), scheduling (Cal.com), and AI processing (Anthropic) — only as necessary to deliver our service.
  • Legal requirements — if required by law, regulation, or valid legal process.

Data Security

We implement reasonable technical and organizational measures to protect your information, including encryption in transit (TLS), access controls, and secure credential management. No method of transmission or storage is 100% secure, but we strive to use commercially acceptable means to protect your data.

Data Retention

  • Contact information — retained while we have an active business relationship or as needed for legitimate business purposes.
  • Engagement deliverables — deleted within 30 days of delivery unless otherwise agreed.
  • Analytics data — aggregated and anonymized; individual session data retained for up to 12 months.

Your Rights

You have the right to:

  • Request access to the personal information we hold about you
  • Request correction or deletion of your data
  • Opt out of marketing communications at any time
  • Request early deletion of engagement deliverables

To exercise any of these rights, contact us at [email protected].

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Effective" date at the top of this page.

Contact

If you have questions about this Privacy Policy, contact us at:

SaaSVista
Email: [email protected]
Website: ai.saasvista.io