Privacy Policy

1. Who we are

This Privacy Policy explains how Codeskop Ltd, a company registered in Kenya ("Codeskop", "we"), collects, uses, shares and protects personal data in connection with our website, dashboard, SDKs and APIs (the "Service").

We follow the Data Protection Act, 2019 of Kenya and, where they apply, the EU and UK General Data Protection Regulation (GDPR) and similar laws.

2. Our two roles

Controller, for our customers' data. For information about the people who visit our website or use the dashboard (account, billing, support and usage data), we decide how it's used and are the controller.

Processor, for app telemetry. Our customers install the Codeskop SDKs in their own apps. For the crash, error, network and analytics data those apps send ("Customer Data"), the customer is the controller and we process it only on their instructions to provide the Service. If you use an app that uses Codeskop and have a question about your data, please contact that app's publisher; we will help them respond.

3. What we collect

Account data: your name, email address, password (stored only as a salted hash), organization name, role, two-factor settings, and preferences such as notification choices.

Billing data: your plan, billing history, and the billing name, address and tax ID you give at checkout. Payments are processed by Paddle; we never see or store your full card number.

Support and communications: the messages you send us through support requests, email or the contact form, and your status-page and notification subscriptions.

Security and usage data: sign-in times, IP addresses and browser details for sessions and sensitive actions (kept in your organization's audit log), and information about how the dashboard is used, so we can keep accounts secure and improve the product.

Customer Data from the SDKs: crashes, errors and stack traces; network request metadata (method, host, path, status, timing and sizes, never bodies, query strings or credential headers); device and app context such as OS, device model, locale and app version; an anonymous install ID, and a user ID and traits only if the customer's app sets them. Exception messages and email- or phone-like values are redacted on the device. The full list is in Privacy & Security.

Integration data: when a customer connects a source code host, issue tracker, chat tool or AI provider, we store the encrypted credentials and the data needed to run that integration, such as repository and ticket references.

4. How and why we use it

To provide the Service under our contract with you: creating and securing accounts, ingesting and showing telemetry, grouping issues, sending alerts, running the integrations you connect, billing, and support.

For our legitimate interests: keeping the Service secure and preventing abuse, fixing bugs, understanding which features are used so we can improve them, and telling you about important changes to the Service.

To meet legal obligations, such as keeping tax and accounting records, and responding to lawful requests.

With your consent, where we need it, for example optional product news. You can withdraw consent at any time.

We do not sell personal data, we do not use Customer Data for advertising, and we do not use Customer Data to train AI models.

5. Cookies

The dashboard uses only essential cookies: a session cookie to keep you signed in and a security cookie that protects forms against cross-site request forgery. Our website does not use advertising or cross-site tracking cookies. A small amount of local browser storage is used to remember choices such as dismissed banners and, for the current visit only, how you arrived (for example a campaign link or referring site), which is saved with your account if you sign up so we know which pages lead to sign-ups.

6. Who we share it with

We share personal data only with service providers that help us run the Service (sub-processors), under contracts that require them to protect it and use it only on our instructions:

Contabo (servers and databases for the Service), Cloudflare (network, DNS, security and email routing), Vercel (hosting of this website), Paddle (payments, invoicing and tax, acting as Merchant of Record and an independent controller for payment data), and our transactional email provider (account and alert emails).

Third parties you connect, such as GitHub, GitLab, Bitbucket, Jira, Linear, Asana, ClickUp, an alert channel (Slack, Microsoft Teams, Discord, Telegram, WhatsApp, PagerDuty or a webhook) or an AI provider, receive the data needed for the action you ask for (for example issue details sent to create a ticket or to ask AI Assist about a crash). They process it under their own terms and privacy policies, using the account you connected.

We may also disclose data if required by law or to protect the rights, safety and security of our users, the public or Codeskop, and to a successor if Codeskop is involved in a merger or acquisition, with notice to you.

7. International transfers

We are based in Kenya, and our service providers may process data in other countries, including in the European Union and the United States. Where data leaves the country it was collected in, we rely on appropriate safeguards required by law, such as standard contractual clauses, and on providers' own security commitments.

8. How long we keep it

Customer Data: for the retention period of the organization's plan (listed on the pricing page), after which it is deleted automatically. Test-environment data is kept for a shorter period (30 days by default).

Account and organization data: while the account is active. When an organization or account is deleted, we delete its data within 30 days, apart from backups, which are overwritten on a rolling basis.

Billing and tax records: for as long as tax and accounting law requires, usually up to 7 years.

9. Your rights

Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal data, object to or restrict how we use it, and withdraw consent. Email hello@codeskop.com and we'll respond within 30 days. We may need to confirm your identity first.

You also have the right to complain to a data protection authority, such as the Office of the Data Protection Commissioner in Kenya or the authority where you live. We'd appreciate the chance to help first.

If your request is about data an app sent to Codeskop, we'll pass it to that app's publisher, who controls the data.

10. Security

We protect data with encryption in transit (HTTPS), hashed passwords and API keys, encrypted storage of integration credentials, HttpOnly session cookies, optional two-factor authentication, role-based access, audit logs and restricted, logged access to production systems. No system is perfectly secure; if a breach affects your personal data, we'll notify you and the relevant authorities as the law requires.

11. Children

The Service is for businesses and is not directed at children. We don't knowingly collect personal data from children through our website or dashboard. Customers must not use the SDKs to send us data about children in breach of the law that applies to them.

12. Changes and contact

We'll update this policy when our practices change and show the date at the top. If changes are significant, we'll tell you by email or in the dashboard before they take effect.

Questions or requests: hello@codeskop.com, or use our contact page. Codeskop Ltd, Kenya.