Mainfast
GitHubInstall

Privacy policy

Siva Koza d.o.o. ("we") makes Mainfast and is the controller of the personal data described here, unless a section says otherwise. You can reach us at mainfast@sivakoza.ai. We have not appointed a data protection officer.

Effective 7 November 2026.

The checks as GitHub Actions

As GitHub Actions, the checks run in your own workflows, with your own tokens. Your code, findings and repository details are not sent to us.

  • They call the GitHub API with the token you give them.
  • What they write stays in your repository: check runs, job summaries, PR comments, labels and issues, as each product page lists.
  • If you pass a licence key, the key and our Polar organisation ID go to Polar once per run to check it. Nothing else is sent.

The hosted GitHub App

If you install the App, the checks run on our servers instead. The App reads your code, pull requests and settings through GitHub's API to run them, and it does not store your code.

We process the data below on behalf of the organisation that installed the App, under the data processing section of our terms. That organisation is the controller, so people in it should direct requests to it first. We are the controller of the sign-in data, which we use to keep the dashboard secure.

  • Installation and repository names, and for each finding its type, severity, one file path, the pull request number and the commit.
  • A hash of each active contributor's login, not the login, to count contributors for the plan.
  • When you sign in to the dashboard: your GitHub login and an encrypted GitHub token for up to eight hours, and a sign-in cookie that is strictly necessary for this.
  • If an owner of the organisation sets up alerts: a Slack webhook URL and an email address, both encrypted, and a hash of each finding already alerted on. Alerts contain the repository, check, finding type, one file path and a link, never code. They go to the Slack workspace behind that webhook, and by email through Cloudflare.
  • If the organisation buys Pro: the link between its installation and its Polar subscription, with the subscription and customer IDs, status and seat count. Polar receives the installation ID, GitHub account ID and account name at checkout.

Buying Pro

Polar Software, Inc. runs checkout as merchant of record and is the controller of your email address and payment details under its own privacy policy. It issues your key. We can see your order and subscription in Polar, and we use those details to provide the service and answer you. We never see your full card number. We may send release and security notices about what you use, and you can opt out at any time by writing to us.

This website

This website sets no cookies and runs no analytics or advertising. Cloudflare, which hosts it, sees the network address of each request, uses it for short-lived rate limits and keeps request logs for a few days so faults can be traced.

If you write to us

If you email us or open a GitHub issue, we use what you send to answer you. GitHub issues are public and governed by GitHub's terms.

Legal bases

  • Contract (GDPR Article 6(1)(b)): providing a subscription or the hosted App, and answering about them.
  • Legitimate interests (Article 6(1)(f)): keeping the website and dashboard secure and working, answering questions, and sending release and security notices. You can object to this at any time.
  • Legal obligation (Article 6(1)(c)): keeping the records the law requires.

How long we keep data

  • Findings: up to 90 days, apart from the latest result of each check. Contributor hashes: just over the 30-day counting window. Alert hashes: 30 days after the finding was last seen. Uninstalling the App deletes these, the installation's repository data, alert settings and the link to Polar. It does not delete what Polar holds, or cancel a subscription.
  • One record stays after you uninstall: the GitHub account ID and the date it first installed the App, so that reinstalling does not restart the 14 days. It holds nothing else.
  • Dashboard sign-in data: up to eight hours.
  • Emails: as long as the conversation needs, and longer only if the law or a dispute requires it.
  • Orders and subscriptions: for the life of the subscription and for as long as accounting and tax law require.
  • Website request logs: a few days.

Who receives data

Giving us data is not a legal requirement, but we cannot sell you Pro or run the App without the data each one needs. We make no decisions about you by automated means that have legal or similarly significant effects.

  • Polar Software, Inc.: checkout, tax, invoices and licence keys.
  • Stripe, Inc., through Polar: card payments.
  • Cloudflare, Inc.: hosting this website and the hosted App, their request logs, and the App data listed above.
  • GitHub, Inc.: hosting the source code and issues, and the API the App uses.
  • Slack, only if an organisation sets up a Slack webhook: the alerts described above.

Transfers outside the EU

These providers are based in the United States and may process data there or elsewhere outside the EU. Where no adequacy decision covers a transfer, it relies on safeguards such as the European Commission's standard contractual clauses. Write to us for a copy of the safeguards that apply.

Your rights

If you are in the EU or UK, you can ask for access, correction, deletion, restriction or a portable copy of your data, and you can object to processing. You can also complain to your data protection authority. In Croatia that is AZOP (azop.hr).

Selling and tracking

We do not sell personal data, and we do not track you across other sites.

Changes

If this policy changes, we publish the new version here with its date.