Data Processing Terms
How Maxor Global LLC processes personal data on behalf of the businesses that use SlopGrade, and the sub-processors it uses.
Last updated · November 4, 2026
1. Who this is for
These data processing terms apply when a business uses SlopGrade on its own repositories and accounts. They describe how Maxor Global LLC processes personal data on that business's behalf (GDPR Art. 28, UK GDPR, and similar laws). A signed copy, with the 2021 Standard Contractual Clauses (Commission Decision 2021/914) attached, is available on request at privacy@slopgrade.ai; this page states the same commitments.
2. Roles
- For the personal data in your repositories and CI results (for example GitHub logins and names in repository metadata), and in the source files you choose to send to the deep scan or the Deep Scan API, you are the controller and we are your processor.
- For the account, billing and security data of the people who sign in, we are the controller; our Privacy Policy covers that data.
3. What we process, and why
- Purpose: only to run the Service you configured — the CI gate, the deep scan, the Deep Scan API and the dashboards — on your documented instructions (these terms, your workflow settings and your account settings).
- Data: repository names, commit identifiers, the pass/block verdict and findings as file path, line number and weakness class; source files sent to the deep scan, processed in memory and not stored; the emails and GitHub identities of your account's users.
- Data subjects: your developers and the other users of your account.
- Duration: while your account is active. CI results are deleted after 13 months; deleting the account deletes your data at once, except the records our Privacy Policy keeps for accounting and abuse prevention.
4. Our commitments
- We process your data only on your documented instructions, and tell you if we think an instruction breaks the law.
- People who can access production systems are limited to those who need it and are bound by confidentiality.
- Security: TLS in transit; source code sent for analysis is processed in memory and never written to storage, logs or training data; access to production is limited; sign-in uses links, codes or GitHub, so we store no passwords.
- We notify you without undue delay after we become aware of a personal data breach affecting your data, with the information we have.
- We help you answer data subject requests and with data protection impact assessments, as far as our processing allows.
- At the end of the service, we delete your data as described above, or return an export on request first.
- We answer reasonable security questionnaires and make the information needed to show these commitments available on request.
5. Sub-processors
You authorise the sub-processors below. Each is bound by a written contract with data protection terms at least as protective as these. We publish every change on this page with its date before the new sub-processor processes your data.
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Hosting of slopgrade.ai and app.slopgrade.ai, scheduled jobs; request data including IP address | United States + global edge |
| Supabase Inc. | Database, authentication and avatar storage (served at api.slopgrade.ai) | United States |
| Stripe, Inc. | Payments, invoices and usage metering (Deep Scan API file counts); card details are entered in Stripe's form, never on our servers | United States |
| Resend, Inc. | Transactional email: sign-in links and codes, account, team, billing and renewal notices | United States |
| Plausible Insights OÜ | Cookieless audience measurement on slopgrade.ai and app.slopgrade.ai (page views, sign-up and checkout events) — no personal identifier stored | European Union (hosted in Germany) |
| Railway Corp. | Hosts our code-analysis engine (heisen-slop: source files sent by the Firewall deep scan or the Deep Scan API, processed in memory, not stored) and our assistant gateway for the support chat | Railway cloud — region on request |
| xAI | Language model behind the support chat and our internal support assistant (reached through our assistant gateway); receives the chat messages | United States |
| Functional Software, Inc. (Sentry) | Error reports: error message, page path, browser user agent | Sentry cloud |
| GitHub, Inc. | Sign-in with GitHub, the SlopGrade GitHub App, GitHub Actions identity (OIDC), downloads for the public-repo demo | United States |
| Google LLC (Google Fonts) | Font files on app.slopgrade.ai pages and in our emails — Google receives your IP address when the fonts load | United States |
| Internet Archive | Monitor feature only: the domains you choose to monitor are looked up in the Wayback Machine | United States |
6. International transfers
We are in the United States. Transfers of personal data from the EEA, the UK or Switzerland rely on the 2021 Standard Contractual Clauses (module 2 controller-to-processor, module 3 processor-to-processor with our sub-processors) and the UK Addendum where it applies.
7. Contact
Maxor Global LLC · 2915 Ogletown Road, #5188, Newark, DE 19713, USA · privacy@slopgrade.ai