Privacy Policy

This Privacy Policy explains how ShintTools ("we", "us", "our") collects, uses, shares and protects personal data when you visit shint.tools, submit a form (including LinkedIn Lead Gen forms), subscribe to our newsletter, create an account, or use our engine plugins, launcher and dashboard.

1. Who we are (data controller)

ShintTools is the data controller for the personal data described here. You can reach us about any privacy matter — including access, deletion or objection requests — at support@shint.tools. We respond to privacy requests within 30 days.

2. What personal data we collect

• Lead and contact forms (including LinkedIn Lead Gen forms and our on-site contact dialog): name, work email, company/job title where provided, and the content of your message.
• Newsletter: email address, language, source of the sign-up, and a record of your consent (text, timestamp).
• Account data: email, name, hashed authentication credentials or OAuth identifiers, plan and role.
• Billing data: handled by Stripe. We store subscription status, plan and invoice identifiers — never full card numbers.
• Licensing and launcher telemetry: license key, a hashed machine identifier, engine and plugin version, activation timestamps.
• Product metrics and metadata: counts of scans, rule hits, issue categories, performance metrics and file-path metadata produced locally by the plugin and uploaded only when you send a report.
• Technical and usage data: IP address, user agent, pages viewed, referrer, and error diagnostics.

3. What we never collect

We do not receive, store or analyze your source code or raw asset binaries. Plugin analysis runs entirely on your machine; only issues, metrics and metadata are ever transmitted, and our ingestion endpoints actively reject payloads that contain source-code fields.

4. Why we use your data and legal bases

• To answer your enquiry (lead and contact forms) — consent and/or steps taken at your request prior to entering a contract.
• To provide the Service (accounts, licensing, dashboard, support) — performance of a contract.
• To send marketing and product updates (newsletter) — consent, withdrawable at any time.
• To secure, debug and improve the Service, and to produce aggregate statistics — legitimate interest.
• To meet accounting, tax and legal obligations — legal obligation.

5. LinkedIn Lead Gen forms

If you submit a LinkedIn Lead Gen form for one of our ads, LinkedIn shares with us the fields you confirmed in that form (typically name, email, company and job title). We are the controller of that data once we receive it. We use it solely to contact you about ShintTools, respond to your request and, where you gave separate consent, to send product updates. We do not sell this data, do not share it for third-party advertising, and do not use it for automated decision-making. You can ask us to delete a LinkedIn-sourced lead at any time by emailing support@shint.tools. LinkedIn's own processing of your data is governed by the LinkedIn Privacy Policy.

6. Who we share data with

We use a small set of vetted processors, each bound by a data processing agreement:

• Supabase — database, authentication and storage.
• Cloudflare — hosting, CDN and DDoS protection.
• Stripe — payments and subscription billing.
• Resend / Lovable Email — transactional emails and newsletter delivery.
• LinkedIn — advertising and lead form delivery.
• AI model providers (Google, OpenAI via the Lovable AI Gateway) — only for prompts you type into the dashboard assistant.

We never sell personal data. We disclose data to authorities only where legally required.

7. International transfers

Some processors operate outside the European Economic Area. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or an adequacy decision.

8. How long we keep data

• Leads and contact messages: up to 24 months from the last interaction.
• Newsletter subscribers: until you unsubscribe, plus proof of consent for 12 months.
• Account and license data: for the life of the account and 12 months after closure.
• Invoices and accounting records: as required by law (typically 6–10 years).
• Technical logs and diagnostics: up to 90 days.

9. Your rights

Depending on where you live, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time without affecting prior processing. California residents may request disclosure or deletion and opt out of any "sale" or "sharing" — we do neither. To exercise any right, email support@shint.tools. You may also lodge a complaint with your local data protection authority.

10. Marketing and unsubscribing

Every marketing email includes a one-click unsubscribe link, and you can also unsubscribe from our unsubscribe page or by emailing us. Transactional messages (billing, security, license) are sent regardless of marketing preferences.

11. Cookies

We use strictly necessary cookies for session and security, and — only if you accept them in our cookie banner — analytics cookies to understand aggregate usage. You can reject non-essential cookies from the banner or clear them in your browser at any time.

12. Security

Data is encrypted in transit (TLS) and at rest, access is restricted through row-level security and role-based permissions, and credentials are stored hashed. No system is perfectly secure, but we notify affected users and authorities of any qualifying breach without undue delay.

13. Children

The Service is intended for professional use and is not directed at children under 16. We do not knowingly collect their data; contact us if you believe we have.

14. Changes to this policy

We may update this policy as the Service evolves. The "last updated" date above always reflects the current version, and we notify account holders by email of material changes.

15. Contact

Privacy questions and requests: support@shint.tools. See also our Terms & Conditions.