Privacy Policy

1. Who we are

Vitalgate is built and run by Francis Miguel Castillo Cruz, an independent developer based in the Dominican Republic ("we," "us"). We are responsible for the personal data described here. Reach us at franciscastillodev@proton.me.

2. What we collect

Account info. When you sign in with GitHub, we receive and store your name, email address, and avatar URL from GitHub. We never see your GitHub password.

GitHub access. Signing in gives Vitalgate an OAuth token limited to your GitHub profile, email, and organization memberships; we use it only to confirm who you are and, when you link a GitHub organization, that you're one of its owners. Access to repositories comes separately from the Vitalgate GitHub App, only on the repositories you choose when installing it, and is used to read the files needed to set up the workflow, add or update that workflow, and comment results on pull requests. You can revoke either at any time from your GitHub settings.

Workspace and team data. Your workspace name and slug, its members and their roles, and pending invitations (the invited email address and role).

Repository settings. For each repository you connect: its name, default branch, whether it's private, the performance budgets you set, and the names (never the values) of any repository secrets you choose to forward to the audit. We don't copy or store your source code.

Performance data. The Lighthouse metrics (such as LCP, CLS, and the performance score) your workflow reports for each pull request, along with the pull request's number, title, author's GitHub username, and branch name, and the alerts generated from them.

Integration data. If you connect Slack or Discord, we store the incoming-webhook URL for the channel you choose, encrypted, plus a label with the team and channel name. We use it only to post the Vitalgate alerts you've enabled to that channel, and we don't read your Slack or Discord messages.

Preferences. Your notification settings and your workspace's alert rules.

Session data. To keep you signed in and let you spot unfamiliar sign-ins, we store your session token, IP address, browser user-agent, and sign-in times. You can see and revoke your sessions from Settings → Security.

Contact form. If you use the contact form, we receive the name, email address, and message you send, by email.

Server logs. Our hosting provider keeps standard request logs (such as IP address, requested URL, and time) to operate and secure the site.

3. Where your code runs

Lighthouse audits run on your own GitHub Actions runner, using the workflow file Vitalgate commits to your repository. Your application is never built, started, or run on our infrastructure. Only the resulting metrics and the pull request details listed above are sent to us, authenticated with a short-lived token GitHub signs for that repository.

4. How we use it, and why we're allowed to

• To provide the Service — sign you in, connect your repositories, check results against your budgets, show your dashboard, and deliver alerts — by email to workspace members who haven't turned them off, and to Slack or Discord if connected — plus the weekly digest if your workspace turns it on. This is necessary to perform our agreement with you (the Terms of Service).
• To keep the Service secure — session records, server logs, and rate limiting on sign-in. This is in our legitimate interest in protecting your account and the Service.
• To answer you when you contact us, based on your request.

We don't use your data for advertising, we don't sell it, and we don't run analytics or ad-tracking scripts on this site.

5. Who processes it for us

We share data only with the services needed to run Vitalgate:

• GitHub — sign-in, and access to the repositories you connect.
• Vercel — hosts the application and keeps its request logs.
• Neon — hosts our Postgres database, where the data above is stored.
• Resend — sends alert, invitation, and weekly digest emails, and delivers contact form messages to us.
• Polar — only if you subscribe to Pro: takes the payment as merchant of record, with your name, email, and billing details. We never see your card number; we keep only the subscription's status and renewal date.
• Slack, Discord, Microsoft Teams, Google Chat — only if you connect them, to receive the alerts posted to your channel.
• Linear / Jira — only if you connect them: when a pull request breaks a required budget, we create an issue with its repository, number, title and results in the team or project you chose.
• Your webhook endpoint — only if you connect one: each alert (repository, pull request number, title and author, and the metrics that broke) is sent to the URL you chose.

We may also disclose data if the law requires it, for example in response to a valid court order.

6. Where your data is stored

Our database is hosted in the United States, and the services above may process data in the United States and other countries. If you're outside the United States, your data is transferred there to provide the Service, relying on those providers' standard data protection terms for international transfers.

7. How long we keep it

We keep your data while your account and workspace are active. Disconnecting a repository immediately deletes its budgets, pull request history, and alerts. Disconnecting an integration deletes it immediately. Revoked or expired sessions are removed from your list.

You can delete your account yourself from Settings → Security. That deletes your personal data right away, along with any workspace where you're the only owner; workspaces you share with other owners stay with them. Payment records kept by Polar are anonymized but retained for tax purposes. You can also email franciscastillodev@proton.me and we'll delete your account within 30 days. Contact form emails are kept only as long as needed to answer you.

8. Security

Traffic to the site is encrypted with HTTPS. Chat and webhook URLs, webhook signing secrets and GitHub sign-in tokens are encrypted at rest. Every request for workspace data is checked against your active workspace, so one workspace can't read another's data. No system is perfectly secure; if a breach affects your personal data, we'll tell you without undue delay.

9. Cookies and local storage

We use only the cookies our sign-in system needs: one to keep you signed in, and short-lived ones that protect the GitHub sign-in flow. Your light/dark theme choice is saved in your browser's local storage. No advertising cookies, no third-party tracking pixels.

10. Your rights

You can ask us to give you a copy of your personal data, correct it, delete it, or stop or limit how we use it, and to receive it in a portable format. These rights come from the Dominican Republic's personal data protection law (Ley No. 172-13) and, if you're in the European Union or the United Kingdom, from the GDPR.

Email franciscastillodev@proton.me to make a request. We'll answer within 30 days. You can also review and revoke your sessions, and delete your account, yourself from Settings → Security. If you're in the EU or UK and aren't happy with our answer, you can complain to your local data protection authority.

11. Children

Vitalgate is a developer tool for teams and isn't meant for anyone under 16. We don't knowingly collect data from children.

12. Changes to this policy

If we materially change what we collect or how we use it, we'll update the effective date above and tell you by email or in the app before the change applies.

13. Contact

Questions about this policy or your data? Email franciscastillodev@proton.me or use the contact form.