Privacy Policy

At Spartan Check, the confidentiality and security of your source code and personal data are our absolute priorities. This privacy policy describes how we collect, use, protect, and share your information when using our showcase website (spartan-check.com) and our SaaS application (app.spartan-check.com).

1. Data Controller

The data controller is:

  • Mr. Morgan Hurel
  • Address: 789 Chemin des Noisetiers, 81350 Valderies, France
  • Contact: morgan.hurel@hurelsoftware.com

2. Collected Data and Purposes

We only collect data strictly necessary for the proper functioning of our static analysis and compliance services:

Data Type Origin / Collection Purpose of Processing
Account Data Registration (Firebase Auth) Account creation, secure authentication, and dashboard access.
Source Code Upload of .zip files or Copy-Paste of snippets Compliance and security analysis (via two static analysis tools).
Audit Reports Generated by our detection engines Display of vulnerabilities, statistics, and remediation suggestions.
Billing & Transaction Data Checkout & Billing Portal (Paddle) Payment processing, subscription billing, VAT/sales tax compliance, and invoice generation. Spartan Check never stores or has access to customer credit card numbers.
Contact Data Beta / Demo request form Commercial contact and user support.

3. Our Cognitive Security & AI Promise (No Retraining)

To meet the requirements of industrial and defense environments:

Zero retraining: Your source code files and snippets are never used to train, fine-tune, or improve public or third-party artificial intelligence models.

Ephemeral analysis: The submitted source code is processed in isolated containers (Google Cloud Run), then immediately purged after sending the audit report to your secure Firestore database.

Topological Isolation: Our marketing showcase website (Hostinger) is physically and logically sealed from our SaaS analysis platform (Vercel and Google Cloud), guaranteeing a zero attack surface on your code data.

4. Hosting, Subcontractors, and Data Sub-Processors

Your data is stored sovereignly on highly secure infrastructures and processed by strictly audited sub-processors:

Application Infrastructure and Database: Google Cloud Platform / Firebase (Europe / France region), guaranteeing End-to-End encryption of data in transit (TLS 1.3) and at rest (AES-256).

Artificial Intelligence Sub-Processor: Google Cloud Vertex AI (European cloud regions), utilized strictly for generating remediation explanations and contextual code corrections on isolated, pre-filtered defect snippets, with strict zero-retention and zero-retraining guarantees.

Commercial Showcase Hosting: Hostinger (Servers located in Europe).

Payment Processing & Merchant of Record (Authorized Data Sub-Processor): Paddle Payments Ireland Ltd (EU) / Paddle.com Market Ltd (UK).

  • Purpose: Merchant of Record, payment processing, global VAT/sales tax compliance, automated invoicing, and fraud detection.
  • Data processed: Customer billing name, email address, billing country/address, VAT identification number, and unique transaction ID.
  • Data protection note: Spartan Check explicitly clarifies that it never stores or has access to customer credit card numbers, security codes (CVV), or raw payment instrument details, as PCI-DSS Level 1 compliance is handled entirely and exclusively by Paddle. For further details, consult Paddle’s Privacy Policy.

5. Zero-Tracker & Cookie Policy

Spartan Check is built on a privacy-by-design architecture:

  • Zero Advertising or Tracking Cookies: Neither our showcase website (spartan-check.com) nor our SaaS platform (app.spartan-check.com) uses third-party marketing, profiling, or behavioral analytics cookies (e.g., no Google Analytics, Meta Pixel, or third-party trackers).
  • Strictly Necessary Session Storage: We solely utilize essential authentication tokens stored via Firebase Auth in browser local storage. These tokens are strictly necessary to maintain secure user login sessions and dashboard access.
  • Exemption from Consent Banners: In accordance with European ePrivacy regulations and CNIL guidelines, strictly necessary technical session tokens required for service provision do not require an intrusive cookie consent banner.

6. Your Rights (GDPR Compliance) & Enterprise DPA

In accordance with the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

  • Right of access and rectification to your account information.
  • Right to erasure ("right to be forgotten"): Permanent deletion of your projects, account, and audit reports.
  • Right to portability: Export of your data and analysis reports in JSON format.
  • Enterprise Data Processing Agreement (DPA): Corporate customers requiring an Article 28 GDPR Data Processing Agreement incorporating Standard Contractual Clauses (SCCs) may execute one upon request.

To exercise any of these rights or request a customized DPA, you can contact us directly at: contact@hurelsoftware.com.

7. Policy Modifications

We may modify this policy to reflect changes to our services or regulations. In the event of a major change, you will be notified by email or via a notification on the application.

Last updated: September 2026