Who controls your information
NoCodeMinute LLC operates securePilot and is the controller for account, billing, website, and support information. When securePilot scans resources for an organization, that organization controls the connected application data and NoCodeMinute LLC processes it to provide the service.
Privacy questions and requests can be sent to hello@nocodeminute.com.
Information we process
- Account details, verified email status, MFA enrollment state, organization membership, roles, and session records.
- Trial dates and usage, promotion eligibility and redemption history, and—for customers who explicitly subscribe—selected paid plan, Stripe customer and subscription identifiers, invoices, and payment status. securePilot does not store complete card numbers.
- GitHub repository identifiers, installation permissions, current source snapshots, and bounded default-branch commit diffs for repositories you explicitly authorize. Source and removed lines are processed transiently for security checks; detected credential values are not stored.
- Firebase project identifiers, authorized configuration and rules data, and connection status for projects you explicitly authorize.
- Public application URLs, TLS, DNS, response headers, exposed-file results, redacted deployed-JavaScript credential classifications and asset paths, security findings, remediation status, and alert history. Detected credential values are not stored.
- Audit events, IP address, device and browser information, error records, and abuse-prevention signals.
- Messages and files you choose to send for support.
Why we process it
We use this information to provide and secure the service, run authorized checks, deliver alerts, administer subscriptions, respond to support requests, prevent abuse, maintain audit records, and meet legal obligations. Depending on location and context, the legal basis is performance of a contract, legitimate interests in operating and protecting the service, consent, or compliance with law.
Service providers
securePilot uses Firebase for authentication and application data, GitHub for repository authorization, Stripe only for paid subscriptions, Postmark for transactional email, and OpenAI for securePilot-operated finding triage and remediation assistance. Each provider receives only the information needed for its role. Customers may request the current subprocessor list and data processing addendum from hello@nocodeminute.com.
We do not sell personal information or share it for cross-context behavioral advertising.
Retention and deletion
Active account and organization records are retained while the service is provided. Findings and activity history are retained for 12 months, security audit logs for 24 months, and encrypted backups for up to 35 days. Remaining account content is deleted within 30 days after a verified deletion request, except where billing, fraud-prevention, dispute, or legal records must be kept longer.
Your rights
Depending on where you live, you may request access, correction, deletion, restriction, objection, or portability. You may also withdraw consent and complain to your local regulator. We verify requests before acting and normally respond within the period required by applicable law.
Official guidance is available from the European Commission and the California Attorney General.
International transfers and security
Where information moves across borders, securePilot uses applicable contractual safeguards and approved transfer mechanisms. Technical and organizational safeguards are described on the Security page.
Changes
Material changes are dated here and communicated through the service or by email when required.