Get started

Octopoda Privacy Policy

Questions? Email support@auxilian.co. See also the Terms of Service.

Effective as of: November 5, 2026

California notice at collection and state privacy rights notice: see the State privacy rights notice section below for important information about your rights under applicable state privacy laws.

Auxilian Technologies, Inc. ("Auxilian," "we," "us" or "our") provides Octopoda, a security scanner for software developers. This Privacy Policy describes how Auxilian processes personal information that we collect through the Octopoda website at octopoda.dev, the web app at app.octopoda.dev, the octopoda command-line tool and its MCP server, the Octopoda GitHub App, and our related APIs and communications (collectively, the "Service").

Notice to European users: Octopoda is not offered in the European Economic Area, the United Kingdom or Switzerland (together, "Europe"). If you use it from Europe anyway, the Notice to European users section below describes how we handle your personal information and the rights we honor.

Index

Personal information we collect

Information you provide to us

  • Account data. When you sign in with GitHub, we receive and store your GitHub user ID, username, name, email address and profile picture URL. We also store the name of any team you create, its members and their roles.
  • Communications data, such as the content of emails you send to us.
  • Transactional data, such as your plan, subscription status, top-up purchases and balance, and the history of what each scan was charged. Payment card details are collected and stored by our payment processor, Stripe, not by us. When you start a free trial we keep Stripe's fingerprint of the card you used (an identifier that does not reveal the card number) so we can offer one free trial per person.
  • Content you give us to scan ("Customer Content"): code that you upload with the command-line tool or allow the Octopoda GitHub App to read, any instructions you add to a scan, and the findings, code excerpts, reproduction steps and suggested fixes that scans produce from it. Customer Content may itself contain personal information, for example in test data or comments. See Customer Content below for how we handle it.
  • Data about others. When you invite someone to a team, we collect the email address you give us so we can send the invitation. Only invite people who expect it.
  • Preferences, such as which emails you want to receive.

Information from third parties

  • GitHub. Besides your account data, when you install the Octopoda GitHub App we receive information about the installation and the repositories you choose, and, for pull request checks, information about pull requests and commits, such as titles, branch names, commit identifiers and the GitHub usernames of their authors.
  • Stripe. We receive information about your subscription and payments from Stripe, such as subscription and payment status, invoice amounts, and the card fingerprint mentioned above.

Automatic data collection

  • Device and connection data, such as your IP address, browser user agent, and for the command-line tool the device name you chose, the tool's version and the IP address it last connected from.
  • Activity data, such as when you last used the Service, the scans you start and the changes you make to findings and settings.
  • Error reports. When something goes wrong, our error-reporting provider receives a technical report of the error. We configure it not to collect IP addresses or other default personal information, and not to include code or findings.

We do not use analytics, advertising or session-recording tools in the web app, and we do not track you across other websites.

Cookies and other technologies

The web app uses one cookie, which keeps you signed in. It is strictly necessary for the Service to work, expires after 30 days or when you sign out, and is not used for any other purpose. We do not use analytics, advertising or social media cookies, pixels or similar tracking technologies, and our emails do not contain tracking pixels. Our website at octopoda.dev sets no cookies and uses no analytics.

AI technologies. Scans use AI models provided by OpenAI to analyze Customer Content. OpenAI processes that content on our behalf under its API terms, which do not permit it to train its models on that content. OpenAI may keep it for a limited period to monitor for abuse.

How we use your personal information

We use your personal information for the following purposes, or as otherwise described at the time of collection:

  • Service delivery and operations: to provide the Service, including signing you in, running scans, showing results to you and your team, posting checks and comments on the pull requests you ask us to check, managing your plan and balance, sending the service emails you choose (such as scan results, low-balance notices and failed-payment notices), and responding to your requests and support questions.
  • Security and fraud prevention: to keep the Service and its scan environments secure, to prevent abuse, and to enforce one free trial per person.
  • Service improvement: to understand how the Service is used and how it performs, for example the number, duration and cost of scans, so we can fix problems and improve it.
  • Compliance and protection: to comply with applicable laws, lawful requests and legal process; to protect our, your or others' rights, privacy, safety or property, including by making and defending legal claims; to audit our processes; and to enforce our Terms of Service.
  • Aggregated and de-identified data: we may create aggregated or de-identified data, such as overall scan statistics, and use it for our lawful business purposes. We will not attempt to re-identify it. We do not use Customer Content, or personal information, to train AI models.

We do not send marketing emails today. If we start, we will let you opt out of them in every message and in Settings, and we will ask for your consent where the law requires it. We do not sell personal information or use it for targeted advertising.

Customer Content

We process Customer Content only to provide the Service to you: to copy it into an isolated environment that exists for a single scan, build and run it there, analyze it with AI models, and store the results for you and your team. Uploaded code archives are deleted automatically within 7 days, and each scan environment is destroyed when the scan ends. Where Customer Content contains personal information, we process that information on behalf of the account that provided it, which is responsible for having the right to share it with us.

Retention

Information How long we keep it
Uploaded code archives Deleted automatically within 7 days of upload.
Scan environments Destroyed when each scan ends; nothing in them is kept.
Findings, code excerpts and scan history While your account exists. You can delete all scan data at any time in Settings → Account.
Account, team and billing data While your account exists. We keep invoices and payment records for as long as tax and accounting laws require.
Web sign-in sessions 30 days, or until you sign out.
Command-line sessions Until you sign the device out in Settings, or delete your account.
Team invitations Until accepted, revoked or expired.
Request logs Up to 7 days.
Error reports Up to 90 days.
Backups of our database Up to 30 days.
Free-trial records To allow one free trial per person, we keep the GitHub user ID and card fingerprint of an account that had a trial after the account is deleted, with nothing else.

When you delete your account, we cancel your subscription and delete your account and its data from our active systems. Copies in backups expire within 30 days. Checks and comments we posted on GitHub pull requests are stored by GitHub; you can delete them there.

When we no longer need personal information, we delete it, anonymize it or, where that is not possible (for example, in backups), isolate it from further processing until it can be deleted.

How we share your personal information

We share personal information with the following parties, or as otherwise described in this Privacy Policy or at the time of collection:

  • Service providers that process it on our behalf:

    Provider What it does for us
    Cloudflare, Inc. Hosting, database, file storage, isolated scan environments, email delivery
    OpenAI, L.L.C. AI analysis of Customer Content during scans
    Stripe, Inc. Payments and subscription billing
    Functional Software, Inc. (Sentry) Error reports

  • GitHub, when you use the Octopoda GitHub App: we post checks and a summary comment on the pull requests you have asked us to check. Anyone with access to the repository on GitHub can see them. GitHub's own privacy statement applies to your GitHub account.

  • Payment processors. Payment card information you use for a purchase is collected and processed directly by Stripe, which uses it in accordance with its privacy policy at https://stripe.com/privacy.

  • Your team. Members of a team can see its repositories, scans, findings, members, and plan and balance.

  • Third parties designated by you, where you have instructed us to share information, for example when you copy a fix prompt into an AI coding tool.

  • Professional advisors, such as lawyers, auditors, bankers and insurers, in the course of the professional services that they render to us.

  • Authorities and others: law enforcement, government authorities and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above.

  • Business transferees: we may disclose personal information in the context of actual or prospective business transactions (for example, investments in Auxilian, financing of Auxilian, or the sale, transfer or merger of all or part of our business, assets or shares), including to an acquirer, successor or assignee, or in the event of an insolvency, bankruptcy or receivership.

Your choices

  • Access or update your information. You can see your account, team, scan and billing information in the web app. Your name, email and profile picture come from GitHub; update them there and they update here the next time you sign in.
  • Delete your content or close your account. You can delete all scan data, or delete your account, at any time in Settings → Account.
  • Emails. You can choose which service emails you receive in Settings → Notifications. Some messages about your account and billing cannot be turned off while you have an account.
  • Command-line devices. You can see and sign out each device in Settings → CLI sessions.
  • GitHub access. You can change which repositories the Octopoda GitHub App can read, or uninstall it, in your GitHub settings. That choice does not delete information we have already received; delete it in Settings → Account.
  • Cookies. The only cookie we use is required to keep you signed in. If you block it, you will not be able to sign in to the web app.
  • Do Not Track and Global Privacy Control. We do not sell or share personal information for targeted advertising, so there is nothing for these signals to opt you out of. We honor Global Privacy Control signals as opt-out requests where the law requires it.
  • Declining to provide information. We need certain information, such as your GitHub account, to provide the Service. If you do not provide it, we may not be able to provide the Service.

Other sites and services

The Service links to and works with services operated by third parties, such as GitHub, Stripe and AI coding tools. We do not control them and are not responsible for their practices. Read their privacy policies.

Security

We employ technical, organizational and physical safeguards designed to protect the personal information we collect. Scans run in isolated environments that have no access to our other systems and only restricted network access. Sign-in tokens are stored only as hashes, and access to production systems is limited to staff who need it. However, security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your personal information.

International data transfer

We are headquartered in the United States, and our service providers process information in the United States and other countries. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province or country. Users in Europe should read the information below about transfers of personal information outside Europe.

Children

The Service is not intended for use by anyone under 18 years of age. If you are a parent or guardian of a child from whom you believe we have collected personal information in a manner prohibited by law, contact us. If we learn that we have collected personal information through the Service from a child without the consent of the child's parent or guardian as required by law, we will comply with applicable legal requirements to delete the information.

Changes to this Privacy Policy

We may modify this Privacy Policy. If we make material changes, we will notify you by updating the date of this Privacy Policy, posting it on the Service, and emailing account owners before the changes take effect. Any modifications will be effective when we post the modified version, or as otherwise indicated at the time of posting.

How to contact us

If you have questions about our practices, or if you would like to exercise any privacy right that may be available to you, contact us:

  • Email: support@auxilian.co
  • Mail: Auxilian Technologies, Inc., 251 Little Falls Drive, Wilmington, DE 19808

State privacy rights notice

Except as otherwise provided, this section applies to residents of U.S. states to the extent they have privacy laws applicable to us that grant their residents the rights described below (collectively, the "State Privacy Laws").

This section describes how we collect, use and share Personal Information of residents of these states and the rights these users may have with respect to their Personal Information. Not all rights listed below are afforded to all users, and if you are not a resident of one of these states, you may not be able to exercise these rights. We may not be able to process your request if you do not provide us with sufficient detail to allow us to confirm your identity or understand and respond to it. We verify requests by asking you to make them while signed in to the web app, or from the email address on your account.

For purposes of this section, "Personal Information" has the meaning given to "personal data," "personal information" or similar terms, and "Sensitive Personal Information" has the meaning given to "sensitive personal information," "sensitive data" or similar terms in the State Privacy Laws, except that in neither case does such term include information exempted from the scope of the State Privacy Laws.

Your privacy rights

The State Privacy Laws may provide residents with some or all of the rights listed below. These rights are not absolute, and some State Privacy Laws do not provide them, so we may decline your request in certain cases as permitted by law.

  • Information. You can request the following information about how we have collected and used your Personal Information: the categories of Personal Information that we have collected; the categories of sources from which we collected it; the business or commercial purpose for collecting it; the categories of third parties with which we share it; and the categories of Personal Information that we disclosed for a business purpose and the categories of third parties to whom we disclosed it.
  • Access. You can request a copy of the Personal Information that we have collected about you.
  • Appeal. You can appeal our denial of any request validly submitted.
  • Correction. You can ask us to correct inaccurate Personal Information that we have collected about you.
  • Deletion. You can ask us to delete the Personal Information that we have collected from you.
  • Opt-out of targeted advertising. We do not process your Personal Information for targeted advertising purposes.
  • Opt-out of profiling and automated decision-making. We do not use your Personal Information to engage in profiling or to perform automated decision-making that results in significant financial impacts, significant impacts on housing, education, employment, health care or criminal justice, or similarly significant impacts.
  • Opt-out of sales. We do not sell your Personal Information within the meaning of the State Privacy Laws.
  • Consumers under 16. We do not have actual knowledge that we collect, sell or share the Personal Information of consumers under 16 years of age.
  • Sensitive Personal Information. We do not intentionally collect or process Sensitive Personal Information. Do not include it in Customer Content.
  • Nondiscrimination. You are entitled to exercise the rights described above free from discrimination as prohibited by the State Privacy Laws.

Exercising your rights. Email support@auxilian.co with the subject "Privacy request," or delete your data yourself in Settings → Account. We honor Global Privacy Control signals as described in Your choices.

Verification of identity; authorized agents. We may need to verify your identity in order to process your request, and we reserve the right to confirm your residency. Under some State Privacy Laws, you may enable an authorized agent to make a request on your behalf. We may need to verify your authorized agent's identity and authority to act on your behalf, for example with a valid power of attorney or your written and signed permission, and we may ask you to confirm the request directly with us.

Information practices

The following describes our practices currently and during the past 12 months.

  • Sources and purposes. We collect all categories of Personal Information from the sources, and use them for the business purposes, described above in this Privacy Policy.
  • Retention. We keep Personal Information for the periods described in Retention.
  • Deidentification. We do not attempt to reidentify deidentified information derived from Personal Information, except to test whether our deidentification processes comply with applicable law.

Personal Information that we collect, use and disclose. The chart below summarizes the Personal Information we collect, by reference both to the categories defined in Personal information we collect and to the categories specified in the CCPA (Cal. Civ. Code §1798.140). Information you voluntarily provide to us, such as in emails or Customer Content, may contain other categories of Personal Information not described below.

Personal Information we collect CCPA statutory category Purposes Categories of third parties to whom we "disclose" it for a business purpose Categories of third parties to whom we "sell" or "share" it
Account data Identifiers; professional or employment-related information (team membership) Service delivery and operations; security and fraud prevention; compliance and protection Service providers; your team; GitHub None
Communications data Identifiers; commercial information Service delivery and operations; compliance and protection Service providers; professional advisors None
Transactional data Commercial information; identifiers (card fingerprint) Service delivery and operations; security and fraud prevention (one trial per person); compliance and protection Payment processor; service providers; professional advisors None
Customer Content Any category it happens to contain Service delivery and operations Service providers (including our AI provider); your team; GitHub (for pull request checks you enable) None
Device and connection data Identifiers; internet or other electronic network activity information Security and fraud prevention; service improvement Service providers None
Activity data and error reports Internet or other electronic network activity information Service delivery and operations; service improvement; security Service providers None

Shine the Light law. Under California's Shine the Light law (California Civil Code Section 1798.83), California residents may ask companies with whom they have formed a business relationship primarily for personal, family or household purposes to provide the names of third parties to which they have disclosed certain personal information during the preceding calendar year for their own direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes. You may send questions to support@auxilian.co with the subject "Shine the Light Request."

Nevada residents. Nevada residents have the right to opt out of the sale of certain personal information for monetary consideration. We do not engage in such sales. If you are a Nevada resident and would like to make a request to opt out of any potential future sales, email support@auxilian.co.

Notice to European users

General

Where this notice applies. The information provided in this Notice to European users applies only to individuals in Europe.

Personal information. References to "personal information" in this Privacy Policy include "personal data" as defined in the GDPR, that is, information about individuals from which they are either directly identified or can be identified.

Controller. Auxilian is the controller of the personal information covered by this Privacy Policy for purposes of the EU General Data Protection Regulation and the UK GDPR (together, the "GDPR"), except for personal information contained in Customer Content, which we process on behalf of the account that provided it. See How to contact us for our contact details.

GDPR representatives. Because the Service is not offered in Europe, we have not appointed a representative under Article 27 of the EU GDPR or the UK GDPR.

The GDPR requires us to have a "legal basis" for each purpose for which we use your personal information. Our legal bases are:

  • Contractual Necessity: where we need to perform a contract we are about to enter into or have entered into with you.
  • Legitimate Interests: where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests.
  • Compliance with Law: where we need to comply with a legal or regulatory obligation.
  • Consent: where we have your specific consent to carry out the processing for the purpose in question.
Purpose Categories of personal information involved Legal basis
Service delivery and operations Account data; communications data; transactional data; Customer Content; data about others (team invitations); preferences; device and connection data; activity data Contractual Necessity. For team invitations, Legitimate Interests: we and the inviting team have a legitimate interest in letting teams invite the people they work with.
Security and fraud prevention Account data; transactional data (card fingerprint); device and connection data; activity data; error reports Legitimate Interests: we have a legitimate interest in keeping the Service, its scan environments and our other systems secure, in preventing abuse, and in offering one free trial per person. Compliance with Law, where applicable.
Service improvement Activity data; error reports Legitimate Interests: we have a legitimate interest in understanding how the Service is used and in fixing and improving it.
Compliance and protection Any and all data types relevant in the circumstances Compliance with Law. Legitimate Interests: where Compliance with Law is not applicable, we and any relevant third parties have a legitimate interest in participating in, supporting and following legal process and requests, including through co-operation with authorities, and in protecting and enforcing our and their rights, property and safety.
Business transactions Any and all data types relevant in the circumstances Legitimate Interests: we and any relevant third parties have a legitimate interest in providing information to parties involved in an actual or prospective corporate event. We minimize the amount and sensitivity of any personal information shared in that context where possible.
Aggregated and de-identified data Any and all data types relevant in the circumstances Legitimate Interests: we have a legitimate interest in understanding how the Service performs.
Further uses Any and all data types relevant in the circumstances The original legal basis, if the further use is compatible with the initial purpose for which the personal information was collected. Consent, if it is not.

Retention

We keep personal information for the periods described in Retention. When we no longer require it, we delete or anonymize it or, if this is not possible (for example, because it is stored in backups), we securely store it and isolate it from any further processing until deletion is possible. If we anonymize personal information so that it can no longer be associated with you, we may use it indefinitely without further notice to you.

Other information

No sensitive personal information. Do not provide us with any sensitive personal information (for example, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or trade union membership), including in Customer Content.

No automated decision-making and profiling. We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Declining a second free trial for a GitHub account or card that has already had one is an automated check; if you think it was wrong, contact us and a person will review it.

Your rights

If you are located in Europe, you may ask us to take the following actions in relation to the personal information that we hold about you:

  • Access. Provide you with information about our processing of your personal information and give you access to it.
  • Correct. Update or correct inaccuracies in your personal information.
  • Delete. Delete your personal information where there is no good reason for us to continue processing it, including where you have exercised your right to object.
  • Transfer. Transfer a machine-readable copy of your personal information to you or a third party of your choice.
  • Restrict. Restrict the processing of your personal information, for example while you ask us to establish its accuracy or the reason for processing it.
  • Object. Object to our processing of your personal information where we rely on Legitimate Interests.
  • Withdraw consent. Where we rely on your consent, withdraw it at any time.

Exercising these rights. Email support@auxilian.co or write to our postal address above. We may ask for specific information to confirm your identity. Whether we are required to fulfill a request depends on a number of factors, such as why and how we process your personal information. If we reject a request in whole or in part, we will tell you why, subject to any legal restrictions. For personal information contained in Customer Content, contact the account that provided it; we will help that account respond.

Your right to lodge a complaint with your supervisory authority. If you are not satisfied with our response or with how we process your personal information, you can complain to the data protection regulator where you habitually live. Users in the EEA can find their regulator at https://www.edpb.europa.eu/about-edpb/our-members_en. Users in the UK can contact the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, tel. +44 303 123 1113, https://ico.org.uk.

Data processing outside Europe

We are a U.S.-based company, and our service providers are also based in the U.S. If you use the Service, your personal information will be accessed and processed in the U.S. and may be processed in other countries outside Europe.

Where we transfer personal information outside Europe, we make sure one of the following mechanisms applies:

  • Transfers to territories with an adequacy decision. We may transfer personal information to countries or territories whose laws the European Commission or UK Government has found to provide an adequate level of protection, including to U.S. recipients certified under the EU-U.S. Data Privacy Framework and its UK extension.
  • Transfers to territories without an adequacy decision. Otherwise we rely on appropriate safeguards designed to give personal information effectively the same protection it has in Europe, such as the standard contractual clauses approved by the European Commission and the UK International Data Transfer Addendum, or, in limited circumstances, on an exception permitted by law.

Contact us at support@auxilian.co for more information on the specific mechanism we use, or for a copy of the relevant safeguards.

This document is adapted from a template prepared and made publicly available by General Legal, PC ("General Legal"). The template is provided for general reference purposes only and does not constitute legal advice. General Legal has not reviewed, and takes no position on, any modifications made to this document.