Privacy notice
| Version | 1.14 |
|---|---|
| Effective date | 2026-11-12 |
Project Feldspar is a business unit of L3Digital LLC, a US company trading under the assumed name "Project Feldspar" (Indiana assumed business name filing no. 11487601). L3Digital LLC decides how your information is used (the "controller").
- Address: L3Digital LLC, 1143 E. Ireland Rd. #1173, South Bend, IN 46614, United States.
- Privacy contact:
[email protected].
Project Feldspar is run by Feldspar, an autonomous AI agent. Feldspar reads the email we receive, writes and sends our email, and does the audit work. No person reviews a message before it is sent.
What we hold, why, and for how long
| You are… | What we hold | Why (and the legal basis under UK/EU law) | How long we keep it |
|---|---|---|---|
| Someone we emailed with a business offer | Your name, job title, work email address and company; the message we sent; whether you replied. We take the address from the business contact address your company publishes on its own website, or from an email you sent us. We do not buy lists or collect addresses from code repositories. | To offer our services to businesses (legitimate interests: telling businesses about a service that may be useful to them) | 5 years from the email, then deleted. If you opt out we keep only your address or domain, the date and the reason, permanently, so we never write to you again |
Someone who emails us (any @project-feldspar.com or @projectfeldspar.com address, or [email protected]) or leaves a message on our telephone voicemail | Your email and anything you put in it. For a voicemail: the recording, the number you called from and the time of the call | To reply and deal with your request (legitimate interests; contract, if it is about an order) | 3 years from the last message, or as part of the order records if it is about an order. Voicemail recordings: deleted within 90 days of the call; our email reply and anything you write back are kept as above |
| A buyer of an audit through an order button ($49, $149, $349 or $699) | Your name, email, the repository you asked us to review, and whether you paid. If you came to our site through a link in one of our posts that carries a campaign tag, or you ordered from a button on one of our guide pages, the order also records that channel or guide page (for example, "st1-devto" for a post on DEV, or "og-pentest-or-code-review" for a guide page). It records nothing else about your visit. Link (Sold through Link, LLC, a Stripe company) takes the payment as merchant of record. Your card details go to Link and Stripe, never to us. Link's own privacy notice covers what Link holds. | To do the work and keep business records (contract; legitimate interests in keeping the records US tax law requires). The channel or guide page: to count, in total, how many orders each of our channels and guide pages brings in (legitimate interests: knowing which of our marketing works) | Order records, including the channel: 7 years |
| A buyer of invoiced work | Your name, email, company, address, VAT or tax ID as you give them, the invoice, and the payment status. Stripe processes the payment. | Same as above | Order records: 7 years |
| Any audit customer (including a customer who orders a code change from us) | A copy of your repository, which we use only to do the work you ordered (a review, or checking and changing the code for a problem you name); the report, code changes and notes we send you | To do the work you ordered (contract) | Repository copy (the copy we clone or download through the access you give us): deleted within 30 days of delivery, or sooner if you ask. Code you attach to an email is kept with that email, as for "Someone who emails us"; please send a link instead. The report and any code changes and notes we send you are kept with the order records for 7 years, unless you ask us to delete them sooner |
| A visitor to our website | Standard web server logs: your IP address, the time, the page and your browser type (kept 14 days, then deleted automatically). Google Analytics data: the pages you view, the time, your approximate location (country and city), your browser and device type, and the analytics cookie identifiers described under "Analytics on our website" below. If your browser is set to a European time zone, Google Analytics does not load; visitors whom Google places in the European Economic Area, the United Kingdom or Switzerland get no cookie and no identifier that lasts beyond the page (see below). | To see how the site is used and improve it (legitimate interests) | Web server logs: 14 days. Google Analytics data: deleted automatically at most 14 months after your last visit; its cookies: up to 2 years after your last visit. Aggregate statistics that identify no one (such as page counts) are kept as business records |
| A user of the free scanner (/scan/, the MCP server at /mcp, the GitHub Action) | Standard web server logs: your IP address, the time, your browser or client type, and the repository URL you asked us to scan. The scanner works on public repositories only. Scan results are returned to you and are not stored after the response is sent; the temporary copy of the repository is deleted as soon as the scan finishes. | To run the service, keep it secure and stop abuse (legitimate interests) | 14 days, then the logs (the web server's and the scanner's own) are deleted automatically. A log line may be copied into the agent's internal operating notes when it is investigating abuse or a fault; those notes are kept as business records |
| A maintainer of, or contributor to, a public project whose code we review or to which we report a security issue | Your name or username and any contact details as published in the project or on its security page; our security report and the correspondence about it; if we publish a sample review of the project, the project and repository name, which may include your username. We take contact details only from the project's published security route. | To report security problems privately so they can be fixed, and to publish sample reviews of public code (legitimate interests) | Correspondence: 3 years from the last message. A published sample review: while it is published. You can object at any time (see "Your choices and rights"), and if you are an individual we will take your name off the page or remove it |
We have no user accounts, and our email has no open or click tracking.
Analytics on our website
We use one analytics service, Google Analytics. Google is the only other company that collects anything from your visit. If your browser is set to a European time zone, our pages do not load Google Tag Manager or Google Analytics, and nothing about your visit is sent to Google, except the one empty Google Tag Manager frame described below if JavaScript is turned off in your browser. If you arrive through a link from one of our posts that carries a campaign tag, a short script on our pages adds the same tag to our other links and order buttons, so that an order can be credited to the post that brought you. It stores nothing on your device, sends nothing itself, and does not run if your browser is set to a European time zone.
Our website uses Google Analytics, a service of Google LLC (US), to count visits and see which pages are used. The Google tag on each page sends Google the page you view, the page that sent you to it, what you do on it (such as scrolling, following a link off the site, downloading a file, or starting or sending a form, but not what you type), the time, your browser and device type, and your IP address, which Google uses to work out your approximate location. Outside the European Economic Area, the United Kingdom and Switzerland, it also sets Google's analytics cookies on your browser (_ga and _ga_*, kept for up to 2 years after your last visit) so that repeat visits can be told apart. If the tag does load and Google places you in the European Economic Area, the United Kingdom or Switzerland, analytics storage is off: the tag sets no cookie and sends Google only a cookieless count of the page view with no identifier that persists between visits. We use Google Analytics only to measure how the site is used. Its advertising features, Google Signals and ad personalization are turned off, and we do not use it to advertise to you. Our pages also load Google Tag Manager, a Google service that loads the tags we configure for the site. It sets no cookie and stores nothing on your device itself, the only tags it loads are the ones described in this notice, and it follows the same European time-zone rule. If JavaScript is turned off in your browser, our pages cannot check its time zone; your browser then fetches one empty Google Tag Manager frame from Google, which runs no tag and sets no cookie. Google says Tag Manager does not keep visitors' IP addresses. Google acts on our instructions under its data processing terms. How Google uses information from sites that use its services: www.google.com/policies/privacy/partners/. You can block Google Analytics with Google's opt-out add-on for desktop Chrome, Firefox, Safari and Edge (tools.google.com/dlpage/gaoptout), or in any browser by blocking cookies and scripts for this site. We do not respond to "Do Not Track" browser signals.
We are not paid for personal information and do not rent it, and we do not use it to advertise to you.
Who else handles it
We share personal information only with the providers that run the business for us. Except where noted, they act on our instructions:
- Stripe and Link (US) handle payments and invoices.
- Telnyx and AgentMail (US) handle email, and Telnyx also runs our telephone voicemail.
- Hetzner (Finland) hosts our servers.
- Google (US) provides the website analytics described above.
- AI model providers: Anthropic, xAI, OpenAI and OpenRouter (US). Feldspar and its review passes run on their models, so email content and audited code pass through them to do the work. Through OpenRouter we use only model hosts that keep no copy of what they process.
- OrcaRouter (CONTINUUM AI PTE. LTD., Singapore), a gateway to AI models built for security work. Audited code and our notes about it pass through it to the model host that does the work. It acts on our instructions under a data processing agreement, keeps no copy of what passes through it, and sends it only to model hosts that keep none.
- GitHub and GitLab (US), where we read the repositories you ask us to scan or review.
We also disclose information where the law requires it.
We are a US business. Our servers are in Finland. OrcaRouter, and the network services and model hosts it uses, may process what passes through it in Singapore, the United States, Japan or other countries; OrcaRouter picks the model host for each request and does not tell us which host or country it used. The other providers listed above are US companies and hold what they process in the United States. Where the law requires safeguards for sending personal information between countries, we rely on the safeguards it provides, such as standard contractual clauses, the EU–U.S. Data Privacy Framework where our providers take part in it, or the transfer being necessary to perform a contract with you; you can ask us for a copy of the safeguards we rely on at [email protected].
Your choices and rights
- Stop our marketing email at any time. Reply "unsubscribe" (any wording works) or write to
[email protected]. We stop immediately and never email you again. This is your right to object to direct marketing, and it is absolute. - Wherever you live, you can ask us to tell you what we hold about you and send you a copy, to correct it, to delete it, to stop or limit using it, or to send it to you in a portable form. You can also object to any use based on our legitimate interests. Write to
[email protected]. We reply within one month. We may keep what the law requires us to keep, such as invoices, and we will tell you if we do. - Complaints. Tell us first at
[email protected]. We acknowledge a complaint within 30 days and tell you what we did about it. If you are in the UK you can also complain to the Information Commissioner's Office (ico.org.uk). In the EU, you can complain to your national data protection authority.
We make no decision about you that has a legal or similarly significant effect by automated means alone.
Other things you should know
- Children. Our services are for businesses and developers. They are not directed to children under 13, and we do not knowingly collect information from them.
- Security. Access to our systems is limited to the agent and to L3Digital LLC. We keep payment card data out of our systems entirely.
- Changes. If we change this notice, we post the new version here with a new effective date. If the change is material and we hold your email address for an order, we tell you by email.