Privacy Policy

Who we are#

Narvy is a brand of LIMITLESS KNOWLEDGE, a French simplified joint-stock company with a single shareholder (SASU) with a share capital of 500 euros, registered office at 10 Place de Wicklow, 78180 Montigny-le-Bretonneux, France, RCS Versailles 994 833 143 (SIRET 994 833 143 00013, VAT FR46994833143). LIMITLESS KNOWLEDGE is the data controller under Regulation (EU) 2016/679 (GDPR).

Privacy and your rights: privacy@narvy.io
Data protection contact: dpo@narvy.io
Security disclosure: founders@narvy.io
Other questions: contact@narvy.io
Support: support@narvy.io

We are not required to appoint a Data Protection Officer (Art. 37 GDPR) and have not appointed one. The data protection contact reaches the person responsible for data protection decisions.

Scope#

This policy covers the website, the platform, the command-line scanner when it calls our API, and our CI/CD integrations.

Where material you submit for analysis contains personal data of your own users, you are the controller and we act as your processor (Art. 28 GDPR) under our Data Processing Agreement, which prevails over this page for that processing.

Data we collect#

You provide:

Account: email address, first and last name, optional company name, password (stored hashed).
Two-factor authentication: TOTP secret and recovery codes, stored hashed.
Billing: plan, subscription status, invoice history. Card data is entered with our payment provider and never reaches our servers.
Material submitted for analysis (section 5).
Integration credentials: GitHub, GitLab, Bitbucket and Jira tokens or installations; cloud access keys and SSH details if you use cloud posture or host auditing.
Feedback on findings (false-positive labels, comments) and correspondence with us.

Collected automatically:

Technical logs (IP address, browser, requested page), used for security and abuse investigation.
Error reports, sent to our error-monitoring provider in its EU data region.
Audience measurement (section 11).
Anonymous usage statistics from the command-line scanner, with no code, scan results, file paths or account identifier. Turn them off with NARVY_TELEMETRY=0 or DO_NOT_TRACK=1.

Account, billing and submitted data are required to provide the service. Other data is optional.

We do not sell, rent or share personal data with advertisers or data brokers. We run no advertising pixels, cross-site trackers, session replay or advertising profiling.

Purposes and legal bases#

Purpose	Legal basis
Provide your account and scans	Contract, Art. 6(1)(b)
Billing and subscriptions	Contract, Art. 6(1)(b)
Accounting records (10 years, French Commercial Code Art. L123-22)	Legal obligation, Art. 6(1)(c)
Service emails (scan finished, payment failed, security alert)	Contract, Art. 6(1)(b)
Platform operation and troubleshooting	Legitimate interest, Art. 6(1)(f): a working service
Abuse prevention (usage limits, anti-bot check on registration and on the store readiness check, audit log of sensitive actions)	Legitimate interest, Art. 6(1)(f): service security
Store readiness check without an account	Legitimate interest, Art. 6(1)(f): providing the tool you request and protecting it from abuse
Optional store deadline alert	Consent, Art. 6(1)(a)
Improving false-positive detection from your feedback	Legitimate interest, Art. 6(1)(f): detection quality. You can object.
Command-line scanner usage statistics	Legitimate interest, Art. 6(1)(f): knowing which features are used
Anonymous audience measurement, including anonymous product events sent by our servers	Legitimate interest, Art. 6(1)(f), within the CNIL audience-measurement exemption
Linking audience statistics to a pseudonymous account identifier	Consent, Art. 6(1)(a)
Marketing email, on request	Consent, Art. 6(1)(a)

False-positive feedback. When you label a finding as a false positive, we may use that label with the finding's technical characteristics (rule, severity, file path, code excerpt) to retrain the false-positive model used for all customers. Only labelled findings are used, never to reconstruct your application, and without customer identity. To opt out, write to privacy@narvy.io; no justification is required.

Material you submit for analysis#

Uploads (APK, AAB, IPA, source archives). Stored privately in the EU. Working copies are deleted when the scan ends. The uploaded file and reports are kept per section 6. Findings include file path, line and a short code excerpt; secrets are masked.

Connected repositories. We clone the selected branch, scan it and delete the clone. We keep findings, not code. Automatic fixes are proposed as pull requests you review; we never push to a branch.

Web scans. Requests are sent from our infrastructure to the address you provide. Responses needed to prove a finding are kept as evidence in the report. Only scan systems you are authorised to test.

Mobile dynamic analysis. Your app runs in an instrumented test environment in the EU. Network traffic generated during the test is captured as evidence and kept with the scan. The app is removed when the test ends.

Cloud posture and host auditing. We request read-only access and read configuration metadata only, never the contents of your storage, databases or workloads. Credentials are stored encrypted. Revoking them ends our access immediately.

Store readiness check (no account needed).

The file is not kept. It is deleted when the analysis ends, including on failure. The result is sent only to your browser. We keep neither the file, the result, nor the app name, identifier or version.
For a Google Play link, our server retrieves the public package. Your IP address is not passed on. The package is handled like an uploaded file.
We limit usage per IP address to prevent abuse. These counters expire at most 24 hours after your last request.
An anti-bot check is required. Its provider receives your IP address and browser signals, never the file or the result.
Optional deadline alert, by consent only (Art. 6(1)(a) GDPR): we store your email address, the app identifier, the platform, the requirements watched and the email language, and send them through our transactional email provider. Nothing is sent before you confirm by email. Withdraw consent with the unsubscribe link in every email (one click, no login).

Retention#

Scans (record, report, findings, stored exports and uploaded file), then automatic purge:

Plan	Retention
Community (free)	7 days
Solo	30 days
Starter	90 days
Pro	180 days
Business	365 days
Enterprise	Until you delete it

An uploaded file is never kept longer than its scan. Ask privacy@narvy.io to delete a specific upload sooner.

Plan changes. An upgrade applies the longer retention immediately. A downgrade or cancellation (which returns the account to Community) applies the shorter retention to your whole history 30 days after the change. We email you the deletion date with an export link, and remind you 7 days before. Returning within 30 days to a plan with equal or longer retention cancels the deletion.

Other data:

Data	Retention
Account and profile	As long as the account exists
Web server logs	12 months at most
Login history (IP address, browser, time of each sign-in attempt)	12 months
Store readiness check: file and result	Not kept
Store readiness check: usage counters (IP address)	24 hours at most after your last request
Store readiness check: deadline alert	48 hours if unconfirmed; otherwise until you unsubscribe, and at most 30 days after the last date watched
Error reports	90 days
Audit log of sensitive actions	12 months
Command-line scanner usage statistics	12 months at most
Audience measurement	25 months at most
Database backups	Rolling cycle of 12 months at most
Invoices and accounting records	10 years (French Commercial Code Art. L123-22); cannot be deleted on request

Recipients#

The platform, database, uploaded files, reports and audience measurement run on infrastructure operated by us or our hosting provider in the European Union. The providers that process personal data on our behalf (hosting, artificial intelligence, payment, transactional email, error monitoring, anti-bot check, appointment scheduling), with what each receives and where, are listed on our sub-processors page.

Apart from the hosting provider, none of these receives your binaries or source code; the AI provider receives only finding details and code excerpts.

Some interface assets load from Cloudflare cdnjs, jsDelivr and Google Fonts. Your browser contacts them directly; they see your IP address and browser, nothing else.

We disclose data to public authorities only under a valid, binding order under French or EU law and, unless forbidden, tell you first.

Security#

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including encrypted connections (TLS), hashed passwords, two-factor authentication on every plan, restricted and logged administrative access, isolation of data per account and organisation, and encrypted storage of cloud and SSH credentials.

Report vulnerabilities to founders@narvy.io. We will not pursue good-faith research that respects other customers' data.

Artificial intelligence#

Our AI features (scan summaries, explanations, false-positive triage, automated fixes) use an AI provider established in the EU, acting as our processor. It receives finding details and, where needed, a minimised code excerpt, never your account data. We do not use your data to train general-purpose AI models. The only model trained on what you give us is our own false-positive classifier (section 4).

These features make no decision with legal or similarly significant effect on a person; Art. 22 GDPR does not apply.

Your rights#

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection to processing based on legitimate interest (Art. 21), and withdrawal of consent at any time without affecting prior processing (Art. 7(3)).

Right	How
Access, portability	Settings, data export (JSON), immediate
Rectification	Account settings
Erasure	Settings, delete account
Restriction, objection	privacy@narvy.io
Withdraw consent	Cookie preferences in the footer, or the unsubscribe link in any email

Account deletion signs you out immediately and executes automatically within 3 days. It removes your account, scans, reports, findings, exports, uploaded files, integrations and organisation memberships. Invoices (kept 10 years by law) and pseudonymised security audit entries remain. Copies in backups disappear as backups are overwritten, within 12 months.

We answer other requests within one month, extendable by two months for complex requests, with notice.

Cookies and audience measurement#

Name	Type	Purpose	Lifetime
`session`	Cookie, strictly necessary	Keeps you signed in, anti-CSRF token	Until sign-out or browser close
`remember_token`	Cookie, strictly necessary	Set only if you tick "remember me"	14 days
`lang`	Cookie, functional	Language preference	1 year
`ts_cookie_consent_v1`	Local storage	Stores your consent choice	Asked again after 13 months
Audience measurement opt-out flag	Local storage	Set only if you refuse audience measurement	Until you change your choice or clear storage
Pseudonymous identifier sent	Session storage	Set only if you accepted audience measurement and are signed in	Until the tab is closed

Strictly necessary items do not require consent (Art. 82, French Data Protection Act).

Audience measurement uses a tool hosted on our own servers and runs without prior consent under the CNIL exemption, because it:

sets no cookie and does not track you across sites;
produces anonymous statistics only (pages viewed, interactions, errors, loading speed, approximate country, browser, device and language), with no account identifier and nothing read from your account;
counts visits with a fingerprint of your IP address and browser that is renewed every month; the IP address itself is not stored;
keeps data for 25 months at most;
is not shared with third parties.

Product events sent by our servers (for example a completed scan or a subscription change) carry your plan but no identifier, and are not sent for your account if you refuse audience measurement.

With your consent only, these statistics are linked to a pseudonymous identifier of your account (never your email or name), with your plan, team size band and sign-up week.

You can refuse or change your choice at any time through cookie preferences in the footer. Refusing changes nothing in the service.

Embedded third-party pages (payment, anti-bot check, booking) may set their own storage under their own policies, only on the pages where they appear.

Transfers outside the EU#

Your uploads, scans, reports and account are stored and processed in the EU. Limited personal data reaches the payment, transactional email, anti-bot, error-monitoring and scheduling providers listed on our sub-processors page, which are US companies or may transfer data to the US. These transfers rely on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, where the provider is certified, the EU-US Data Privacy Framework adequacy decision of 10 July 2023 (Art. 45). No US provider receives your code, binaries or findings.

Children#

Narvy is a professional tool. We do not knowingly create accounts for anyone under 15 (Art. 45, French Data Protection Act). Report such an account to privacy@narvy.io and we will remove it.

Changes#

For material changes (new sub-processor, new purpose, shorter retention), we email account holders and post a notice in the product before they take effect. Minor edits do not change how we process data.

Complaints#

You may complain to a supervisory authority at any time (Art. 77 GDPR). Ours is the CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr. You may also contact the authority of your EU country of residence.