Privacy Policy

1. Who we are

SlopGrade is operated by Maxor Global LLC, a Delaware limited liability company, 2915 Ogletown Road, #5188, Newark, DE 19713, USA. Parent site: maxor-global.com. Maxor Global LLC builds deterministic computing platforms. SlopGrade is a CI security gate: it checks every pull request and blocks cross-tenant data leaks and other vulnerability classes before they reach your main branch. It also offers a deterministic text-quality grader and a code-analysis API.

• Privacy: privacy@slopgrade.ai
• Legal: legal@slopgrade.ai
• General: hello@slopgrade.ai
• Surfaces: slopgrade.ai (marketing), app.slopgrade.ai (app and CI dashboard), app.slopgrade.ai/api (API). https://api.slopgrade.ai is our database and sign-in host.

Maxor Global LLC is the controller for personal data processed through SlopGrade. Maxor Technologies Inc (Quebec) is a related entity for Canadian engineering services; it is not the operator of SlopGrade unless a separate contract says so.

2. What we process

• Account data: email address, sign-in identifiers, and the profile fields you fill in (display name, job title, avatar image). If you sign in with GitHub, your GitHub username and avatar.
• Content you choose to store in the app: graded texts and their history, writer documents, support chat messages, team invitations (the invitee's email address), white-label branding, the domains you monitor, and email-change requests.
• CI data for repositories you connect: the fingerprint the GitHub Action sends and the results of each run (see below).
• Source code, only through the two opt-in paths described below: the Firewall deep scan and the Deep Scan API.
• Billing data for paid plans: Stripe customer and subscription identifiers, plan, status and amounts. Card details are entered in Stripe's form and never reach our servers.
• Technical data: IP address (in rate-limit records and in our hosting providers' logs), browser user agent (in error reports), timestamps and request metadata.
• Sign-up attribution: utm_* parameters, a ref code, the referring site's host (never the full referring URL), your first landing path and the sign-in method you used.
• Cookies and browser storage, listed in the Cookie policy.

3. Legal bases (GDPR Art. 6)

• Contract (Art. 6(1)(b)) — the account, the CI gate, grades, history, the API and the paid plans you request.
• Legitimate interests (Art. 6(1)(f)) — security, abuse and fraud prevention, service reliability, support. You may object.
• Legal obligation (Art. 6(1)(c)) — tax, accounting, and lawful requests.
• Legitimate interests (Art. 6(1)(f)) — audience measurement with Plausible: page views and sign-up and checkout events, counted without cookies and without storing an IP address or any personal identifier. No advertising or cross-site tracking.

4. Signing in

There is no password. You sign in with a link or a one-time code sent to your email address, or with Sign in with GitHub. With GitHub, GitHub shares your GitHub identity (username, avatar, the email address on your GitHub account) with our sign-in service. Sign-in emails are sent by Resend.

5. Text you grade

• Web grader, signed in: we store the grade and the text itself, up to 50,000 characters, so you can reopen it in your history. The history label is the first sentence of the text, up to 72 characters, unless you rename it. A grade is public only if your sharing setting makes it public. It stays until you delete it or close the account.
• API with an API key: the text is graded and not stored, unless your request asks to save it.
• MCP and batch grading: the score is saved to your history when you are signed in or ask to save it; the text is not stored.
• The free public grade (no account, up to 2,000 characters) is not stored.

Grading is deterministic: no language model reads your text to grade it. We do not sell your text and we do not use it to train any model.

6. Source code: Firewall deep scan

By default the GitHub Action analyses your repository on your own CI runner and sends us a structural fingerprint, not your files. The fingerprint holds file paths and line numbers, the kinds of findings, the database table and column names your queries and access policies use, the method of each query, and, for secrets, a randomness score (never the secret). On a paid repository, the closed-source detector packs add short values of at most 200 characters, such as the dependency names in your manifests.

The deep scan is opt-in. Only if a repository sets `deep-scan: "true"` in its workflow, the Action sends the full source of a bounded set of files (at most 80 files, 200,000 characters each and 2M characters in total): files a local detector flagged or that contain a security-sensitive call, the pull request's changed files first. They go over TLS to app.slopgrade.ai and on to heisen-slop, our analysis engine, hosted by Railway. Only paid repositories are analysed: a free repository that turns the option on still uploads those files, which are refused without being analysed and discarded.

• The code is processed in memory for the duration of the request. It is not stored, not logged, and not used to train any model. While the engine process runs, it may keep regular-expression patterns taken from your code in a memory cache (never on disk).
• What we keep for your CI history is the finding: file path, line number, the weakness class (CWE), a one-line explanation and the short expression at the vulnerable call (for example `subprocess.check_output() with shell=True`). In library mode we also keep up to 50 candidate findings with the same fields.
• Removing the option stops any code from being sent.

7. Source code: Deep Scan API (API keys)

The Deep Scan API (app.slopgrade.ai/api/deep-scan) receives the source files you send it with an API key of scope `deepscan`, or from a signed-in session: at most 80 files, 200,000 characters each and 2M characters in total. The files go to the same engine on Railway and are processed the same way: in memory, not stored, not logged, not used to train any model. We return the findings and do not store them.

We keep, per account and per UTC month, the number of files and requests. If you turn on usage billing, the number of files billed past your monthly allowance is sent to Stripe for invoicing.

8. CI results and the public-repo demo

When a connected repository runs the SlopGrade GitHub Action, we store the result of each run so you can see your CI history: commit SHA, the pass or block verdict, counts per class, the tenant column the gate detected, up to 20 cross-tenant leaks (file path, line, table and method) and, on a paid repository, every detector-pack finding (rule, location, short detail, severity). We never store the files themselves.

The SlopGrade GitHub App reads repository metadata, check runs, pull-request state and the SlopGrade workflow file (.github/workflows/slop-gate.yml) to show whether it is up to date; when you ask, it opens a pull request to install or update that file.

The “scan a public repo” demo on slopgrade.ai works on public GitHub repositories only. Our server downloads the repository's default branch from GitHub, unpacks it in memory, writes the code files to a temporary directory for the scan and deletes the directory when the scan ends. The result is kept in memory for up to 10 minutes so a repeated request is fast; nothing from the demo is written to our database. Your IP address is used for the demo's rate limit.

9. Support chat

Support chat messages are stored in our database so the conversation can continue. When the assistant answers, we send your last 12 messages (up to 4,000 characters each), the page you are on, your plan and the label of your last grade through our assistant gateway (hosted by Railway) to a language model from xAI. Replies may be kept in memory for up to an hour. Our support staff also use an internal assistant on the same model; it can receive account details, such as your email address, while they work on your request.

10. Why we process it

To run the CI gate and show its results; analyse code you send; deliver grades and share cards; provide history, export and support; keep the service secure and prevent abuse; bill paid plans; and improve the product with aggregated, non-content metrics.

11. Processors

These providers process data for us under contract, only to provide their service:

We do not sell personal data. Business customers can request a data processing agreement (DPA, with the 2021 Standard Contractual Clauses) at privacy@slopgrade.ai.

12. International transfers

• The operator and most processors are in the United States. If you are in the EEA, the UK or Switzerland, your data is transferred to the US.
• Transfers rely on the Standard Contractual Clauses (2021/914) in our processors' data processing agreements.
• Canada has an EU adequacy decision under PIPEDA for commercial organizations.

13. Your rights

Depending on your location (GDPR, UK GDPR, CCPA/CPRA, PIPEDA, Quebec Law 25) you may request access, correction, deletion, export, restriction, or objection. Email privacy@slopgrade.ai. We aim to respond within 30 days. You may lodge a complaint with a supervisory authority (CNIL, ICO, CAI Quebec, OPC Canada, or your local DPA).

You can delete your account yourself from the account page: we email you a code, valid for one hour. Deletion is immediate once you enter it. Your subscriptions end at once, with a final invoice for usage already consumed and no refund, and your grades, texts, keys, CI history and other account data are deleted. We keep a closure record (account identifier, email address, Stripe customer identifier) for accounting and abuse prevention, anonymous closure feedback if you give it, the GitHub login of an account that used a free trial, so the trial is granted once, and the record of any plan our staff granted to or removed from the account (account identifier, email address, plan before and after, reason, date), which is an audit trail. Stripe keeps its own customer and invoice records.

14. California (CCPA / CPRA)

California residents may know, delete, and opt out of the sale or sharing of personal information. Maxor Global LLC does not sell personal information and does not share it for cross-context behavioral advertising. To exercise rights: privacy@slopgrade.ai. We will not discriminate for exercising these rights.

15. Quebec (Law 25)

Quebec residents are protected by Law 25. The person responsible for personal information for SlopGrade can be reached at privacy@slopgrade.ai. Incident notification to the CAI follows applicable law (including the 72-hour duty where it applies). We do not show a consent banner because we set no advertising or analytics cookie: the one cookie slopgrade.ai sets is NEXT_LOCALE (language), and the app sets only the cookies it needs to sign you in and remember your language. The Cookie policy lists them.

16. Retention

• Account data and the content you store (grades and texts, documents, support messages): until you delete it or close the account.
• CI results: 13 months, then deleted automatically; sooner when you close the account.
• Rate-limit records, which contain IP addresses: about one day.
• Hosting, database and error logs: per our providers' retention settings.
• Billing records: up to 7 years where tax law requires.
• Closure records and staff plan-grant records: kept 7 years for accounting and audit, then deleted automatically. The free-trial ledger (GitHub login): kept 3 years to prevent repeat trials, then deleted automatically.

17. Security

TLS in transit. API keys are stored as hashes, never in clear. Access to production systems is limited to operators who need it. Sign-in has no password to steal: a link, a one-time code or GitHub. No security measure is perfect. Report a vulnerability privately via GitHub (github.com/maxor-tech/slopgrade-firewall/security) or to security@maxor-global.com: we acknowledge within 3 business days and share a remediation plan within 10 business days for a confirmed issue.

18. Children

SlopGrade is not directed at children under 16. You must be able to enter a contract in your jurisdiction to create an account (see Terms — typically 18). Do not create an account if you are under the applicable age of digital consent.

19. EU representative (GDPR Art. 27)

Maxor Global LLC has not yet appointed an EU Article 27 representative. Until one is contracted, EEA data subjects should contact privacy@slopgrade.ai. We will publish the representative here and in the footer when appointed. We do not invent a name to look compliant.

20. Changes

We may update this policy. Material changes are reflected by the “Last updated” date and, when appropriate, an in-product notice.

21. Contact

Maxor Global LLC · 2915 Ogletown Road, #5188, Newark, DE 19713, USA · privacy@slopgrade.ai · maxor-global.com