Record of Processing

Our GDPR Article 30 record. The controller is isotope13 LLC, 109 Amber Ct, Carrboro, NC 27510, USA. Privacy contact: Thomas Stromberg, privacy(@)isotope13.io

Activity	Whose data	Data	Purpose and basis	Recipients	Kept
Accounts	Customers' team members	OAuth account ID; GitHub username or Google email	Sign-in and team management; contract	Cloudflare, GitHub, Google	Until 30 days after you leave
API requests	API callers	IP address; packages, URLs, and hashes asked about	Run and secure the service; contract, legitimate interest	Cloudflare, Hetzner, InterServer, IONOS	7 days
Usage	Customers	Request counts per org	Quotas and billing; contract	Cloudflare	90 days
Billing	Paying customers	Name, email, address, card—held by Stripe	Payment; contract, legal obligation	Stripe	As tax law requires
Uploads	Anyone named in an uploaded file	Whatever the file contains	Public malware research; legitimate interest	Public; Hetzner, InterServer, IONOS	Indefinitely
Correspondence	Anyone who writes to us	Email address and message	Answer you; legitimate interest	Our email provider, GitHub for public issues	As long as needed

All processing is in the US, under the EU–US Data Privacy Framework. Security measures are in our Corporate Policies.