Quick summary: We collect the minimum data needed to run the Service. We don't sell personal data. Billing is handled by Paddle, who is the merchant of record; payment-card details never touch our servers. Contact us at privacy@chain305.com to exercise your rights.

1. Who we are

Chainsaw is a transparent supply chain firewall operated as a sole proprietorship, registered in a United Arab Emirates free zone, with operations in the UAE and the United States ("Chainsaw", "we", "us"). We are the data controller for the personal data processed through the Service, except where our customers are controllers of the data they upload (in which case we act as a processor on their behalf, governed by a separate Data Processing Addendum on request).

For questions about this policy or to exercise your privacy rights, contact privacy@chain305.com.

2. Data we collect

2.1 Account data

Name, work email address, password hash (argon2id — we never store plaintext passwords);
Organisation name and slug;
The role you pick at signup (AppSec / DevSecOps / Enterprise IT) — optional, used for UX tailoring only;
Your title within the organisation;
TOTP secret (encrypted at rest), if you enable two-factor authentication.

2.2 Usage and telemetry

Login events, session timestamps, IP address and user-agent for audit logs;
Requests you make through the proxy (package name, version, source registry, verdict) — used to enforce policy and produce dashboards and SBOMs;
Storage and bandwidth usage counters (hourly rollups) — used to enforce plan limits and to bill overage on the Pro plan;
Product analytics via PostHog on the marketing site and dashboard — page views, feature interactions, and error events. We configure PostHog to anonymise IP addresses.
Web analytics via Google Analytics 4 on our public marketing and documentation sites (chain305.com and docs.chain305.com) only — page views and interaction events, used to understand how people find and use the sites. Google Analytics runs under Google Consent Mode and is denied by default until you accept analytics in our consent banner; advertising and ad-personalisation signals are switched off. It is not used in the authenticated product.

2.3 Content you provide

Policy configurations you upload or create;
Repository and webhook endpoints you register;
SSO and SCIM configuration (Pro and Enterprise plans) — we store the identity-provider metadata needed to authenticate and provision users.

2.4 Billing data

Paid plans are processed by Paddle, who is the merchant of record. Payment-card details and full billing addresses are collected and stored by Paddle, not by us. We receive a limited billing record from Paddle — plan, price, country for tax purposes, last four digits of the card, and Paddle's subscription identifier — to reconcile subscriptions with your account. Paddle's privacy notice is at paddle.com/legal/privacy.

2.5 Support and communications

When you contact support@chain305.com we keep the conversation and any attachments for as long as needed to resolve the request and for one year after for quality review. Transactional email is delivered by Postmark; bot protection is provided by Cloudflare Turnstile.

2.6 CLI install-guard telemetry

The free, open-source install guard (chainsaw guard) runs locally on your machine and checks installs at install time. Telemetry is consent-based: the first time you use the guard interactively, it asks once whether to share anonymous usage and blocked-package data to improve detection. The prompt defaults to yes (decline with n), and it shows you exactly what would be shared before you answer. Nothing is sent before you answer. When it cannot ask — in CI or any non-interactive (non-TTY) context — it stays off and collects nothing until you explicitly turn it on with chainsaw telemetry on. Change your choice anytime with chainsaw telemetry on|off.

Once you have consented, the guard sends two kinds of telemetry:

Anonymous usage events (install.guard.scan): a count that the guard ran a check, with no package identity attached. Tied to an anonymous device identifier, not to a person.
Blocked-package data (install.guard.block): when the guard refuses an install, it reports the package name, version, and the reason it was blocked (for example, a typosquat match or a malicious-packages hit). This is identifying data about the package, used to improve the malicious-packages feed — and it is what you opted into sharing.

These events let us see which threats fire in the wild and tune detection. The guard runs locally regardless — telemetry is about improving the feed, not about running the check.

2.7 Controlling guard telemetry

You control telemetry at any time:

chainsaw telemetry on / chainsaw telemetry off — turns guard telemetry on or off. The first-run prompt defaults to yes; in CI or any non-interactive context it stays off until you run chainsaw telemetry on.
CHAINSAW_TELEMETRY_DISABLED=1 — forces all guard telemetry off (both usage events and blocked-package data), regardless of any prior consent. Useful in CI or a shared environment policy.
CHAINSAW_REFUSAL_SHARING_DISABLED=1 — disables package-name sharing only. Anonymous usage events still send (if you have consented); the package, version, and reason from a block do not.
CHAINSAW_OFFLINE=1 — runs the guard fully offline. No telemetry leaves your machine, and the guard uses only its embedded seeds.
CHAINSAW_NO_NUDGE=1 — silences the in-CLI prompts that suggest signing in or upgrading. It does not change what telemetry is sent.

2.8 Signing in de-anonymizes the device

The guard works with no account. If you sign in, the anonymous device identifier is linked to your account, so guard activity from that device is no longer anonymous to us. chainsaw guard update pulls the public OpenSSF malicious-packages feed directly from OpenSSF and does not require a Chainsaw account. The telemetry consent and controls above apply whether or not you are signed in.

3. Why we process data (legal bases)

To provide the Service (performance of a contract): account creation, authentication, enforcement of policy, billing reconciliation, support.
Legitimate interests: fraud prevention, security logging and audit, service analytics to improve Chainsaw, aggregate usage metrics.
Legal obligation: responding to lawful requests, tax and accounting records, breach notifications.
Consent: marketing emails (opt-in, with an unsubscribe link in every message), optional analytics that aren't strictly necessary.

4. Data we do not collect

We do not inspect the content of the packages you install — only the metadata (name, version, registry, hash) that the proxy needs to evaluate policy.
We do not store the bodies of installed artefacts beyond the cache window configured by your plan, and we do not share them with anyone else.
We do not use your audit logs, SBOMs, or policy configurations to train machine-learning models.
We do not use invasive trackers — no session recording outside of explicit debugging sessions, no fingerprinting beyond what PostHog and Google Analytics use for ordinary analytics, and both are denied by default until you consent.

5. How we share data

We share data only with the sub-processors needed to run the Service:

Paddle — billing and merchant of record (global).
Postmark — transactional email delivery (US).
PostHog — product analytics (EU hosting where available).
Google (Google Analytics) — web analytics on the public marketing and documentation sites only, consent-gated; not used in the authenticated product (US/global).
Cloudflare — CDN, Turnstile bot protection, DNS (global).
Upstream package registries (npm, PyPI, Docker Hub, Maven Central, etc.) — the proxy forwards requests you initiate.
Your configured integrations — SIEM or ticketing webhooks you set up receive the events you ask them to. We do not send them anything you didn't configure.

We do not sell personal data. We don't share it for advertising. We may disclose data when legally required (subpoena, court order), in which case we will, where lawful, notify the affected user.

6. International transfers

Chainsaw is operated from the United Arab Emirates (free-zone registration) and the United States. Some sub-processors we rely on are based in the EU, UK, Singapore, and other jurisdictions. Transferring personal data across borders is an inherent part of running a globally available Service.

For transfers from the European Economic Area, the United Kingdom, or Switzerland to countries that are not covered by an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (2021/914/EU) and the UK International Data Transfer Addendum where applicable. For transfers involving the UAE, we comply with the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and its implementing regulations where they apply to our processing. We publish a current sub-processor list on request — email privacy@chain305.com.

7. Retention

Account data: for as long as you have an account, plus 90 days after closure.
Audit logs and usage rollups: 13 months, so you can run year-over-year comparisons.
Billing records: 7 years where legally required for tax purposes.
Support correspondence: 1 year after resolution.
Backups: rolling 30-day encrypted backups.

8. Your rights

8.1 Rights available in every jurisdiction we serve

You can ask us to:

Access the personal data we hold about you;
Correct data that is inaccurate or out of date;
Delete your data (subject to the retention windows in Section 7);
Export your data in a portable, machine-readable format;
Restrict or object to specific processing;
Withdraw consent for any processing based on consent, without affecting the lawfulness of prior processing.

To exercise these rights, email privacy@chain305.com from the address on your account, or use the export / deletion controls in your in-app settings. We respond within 30 days (extendable by up to 60 days for complex requests, with notice).

8.2 EU / UK / Switzerland (GDPR)

Where the GDPR applies, you additionally have the right to complain to your local supervisory authority, and the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects (we do not make such decisions).

8.3 California residents (CCPA / CPRA)

If you're a California resident, you have the additional rights to (a) know the specific pieces of personal information we have collected, (b) delete that information, (c) correct inaccurate information, (d) limit the use and disclosure of sensitive personal information, and (e) opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CCPA / CPRA. We will not discriminate against you for exercising any of these rights. You may designate an authorised agent to make requests on your behalf; we will verify the agent's authorisation before responding.

8.4 UAE residents (Federal PDPL)

Under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), you additionally have the right to request clarification about the processing, to object to automated decision-making that affects your rights, and to bring a complaint to the UAE Data Office. Free-zone residents may have additional rights under the DIFC Data Protection Law (DIFC Law No. 5 of 2020) or the ADGM Data Protection Regulations 2021; those laws apply to our processing to the extent required by the free zone of our registration.

8.5 Other jurisdictions

If you reside elsewhere (e.g., Brazil under LGPD, Canada under PIPEDA, Australia under the Privacy Act), comparable rights typically apply. Email privacy@chain305.com and we will respond under the most protective applicable framework.

9. Security

We implement technical and organisational safeguards appropriate to the risk, including:

9.1 Encryption

TLS 1.2 or higher for all data in transit, with HSTS and modern cipher suites;
Industry-standard at-rest encryption for database volumes and backups;
Argon2id for password hashing with per-user salts;
TOTP secrets encrypted at rest with a key held separately from the data store.

9.2 Access control

Role-based access controls (RBAC) on every customer-facing permission;
Multi-factor authentication required for internal administrative access;
Isolated processing per tenant — no cross-tenant data sharing, enforced at the database layer;
Principle of least privilege for staff: access is scoped to what each role actually needs, reviewed periodically;
All internal admin actions are audit-logged and retained.

9.3 Operational security

Continuous monitoring of the production environment with alerting on anomalous patterns;
Documented incident-response procedure with defined roles, severity levels, and communication templates;
Regular third-party dependency scanning — we use Chainsaw on our own supply chain;
Encrypted, geographically redundant backups; restore procedures tested on a recurring basis;
Staff security training on phishing, credential hygiene, and data handling.

9.4 Incident notification

If we become aware of a personal-data breach affecting your account, we will notify you without undue delay and, where required by law (including GDPR Article 34), within 72 hours of becoming aware. The notification will describe the nature of the breach, the data concerned, likely consequences, and the measures we've taken to address it.

9.5 Reporting vulnerabilities

Report suspected vulnerabilities to security@chain305.com. We acknowledge within three business days and coordinate a responsible-disclosure timeline. We don't pursue legal action against good-faith researchers who follow our disclosure process.

10. Cookies

We use a small number of cookies strictly necessary to run the Service (session authentication, CSRF protection, Turnstile), plus PostHog and Google Analytics analytics cookies that are set only after you accept analytics in our consent banner. We don't use third-party advertising cookies, and advertising signals stay disabled by default. You can change your choice any time via "Privacy choices" in the footer, and you can disable cookies in your browser — but strictly-necessary cookies are required for login.

11. Children

Chainsaw is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact privacy@chain305.com and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will post the updated version here with a new "Last updated" date and, for subscribers, email a summary at least 14 days before the change takes effect.

13. Contact

Privacy inquiries: privacy@chain305.com
Security: security@chain305.com
General: support@chain305.com