Privacy Policy

1. Personal Information We Handle

For the purposes of this policy, “personal information” (or “PII”) means any data that identifies or can be used to identify an individual, directly or indirectly. This includes but is not limited to: names, email addresses, payment processor identifiers (e.g. Stripe customer IDs), device identifiers, and browser analytics data that can be combined to form a fingerprint.

2. Information We Collect

3. How We Use Your Information

• Service operation — serving pages, maintaining uptime, and diagnosing errors
• Authentication and access — securely identifying you and maintaining your session
• Support — responding to inquiries and resolving issues you report
• Billing — managing subscriptions and processing payments via Stripe
• Analytics — understanding aggregate traffic patterns to improve our products
• AI features — generating opt-in insights and automated moderation using ZDR models
• Content moderation — detecting and preventing abuse on platforms with user-generated content
• Security — detecting and preventing abuse, unauthorized access, and attacks
• Legal compliance — meeting our obligations under applicable law

We do not use your data for advertising, sell it to third parties, or share it for any purpose beyond what is described in this policy.

CHKDSK Labs LLC. does not provide any data or information to law enforcement agencies, governmnet entities, or any other third parties, except as required by law.

4. Cookies and Tracking

Our web-based products use only essential cookies (session management, authentication) and opt-in analytics cookies where applicable. We do not use advertising cookies or cross-site tracking. Full details and preference controls are available on our Cookie Policy page.

5. AI Data Processing Policy

All CHKDSK Labs products that use AI inference route requests exclusively through the Vercel AI Gateway and use only models that support Zero Data Retention (ZDR). Under ZDR:

• Your data is not stored, logged, or used for model training by AI model providers
• Data exists in the provider's infrastructure only for the duration of the inference request and is discarded immediately after the response is generated
• All communication with the AI Gateway is encrypted via TLS

Products that use AI features publish supplemental documentation describing exactly what data is sent to AI models — see Section 11.

6. How We Protect Your Information

• Encryption in transit — all data is transmitted over TLS/HTTPS with HSTS preload enabled
• Encryption at rest — sensitive credentials (OAuth tokens, webhook URLs, API keys) are encrypted using AES-256-GCM where applicable
• Minimal data collection — we collect only what is necessary for the stated purpose and discard it as soon as it is no longer needed
• Access controls — internal access to personal data is restricted to personnel who require it to perform their responsibilities. Database-level row-level security (RLS) is enforced where applicable.
• Input validation — all API inputs are validated to prevent injection attacks
• Webhook verification — inbound webhooks from GitHub, Stripe, and other providers are verified via HMAC signatures before processing

7. Data Sharing and Third Parties

We share data with third-party providers only as necessary to operate our products. We do not sell, rent, or trade your personal information. For detailed information about each provider, see our Third-Party Services page.

Not all services are used by every product. See the Third-Party Services page for per-product breakdowns.

8. Data Retention

Product-specific retention schedules may apply. See supplemental policies in Section 11.

9. Your Rights

You have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Deletion — request that we delete your personal data; we will comply unless retention is required by law
• Correction — request correction of inaccurate data
• Portability — receive your data in a machine-readable format where technically feasible
• Withdraw consent — revoke cookie or analytics consent at any time

10. Children's Privacy

Our products are not directed to children under 13 years of age (some products require users to be 18 or older). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

11. Product-Specific Privacy Policies

Some CHKDSK Labs products collect additional personal data beyond what is described in this company-wide policy. Each such product publishes a supplemental privacy policy that should be read alongside this one. This policy sets the baseline; product policies add detail specific to that product's data practices.

Open-source projects (HissCheck, L-BOM, GUI-BOM) are distributed under the MIT license and do not collect any personal data or connect to CHKDSK Labs servers.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. The “Last updated” date at the top of this page reflects the most recent revision. For material changes we will post a notice on the site. Continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact

To exercise your rights, ask a question, or report a privacy concern: