Agerius Privacy Policy

Last updated: September 30, 2026

Shoon's LLC, 30 N Gould St, STE R, Sheridan, WY 82801, USA ("Agerius," "we," "us," or "our") is responsible for the personal data described in this Privacy Policy, except where we process repository content solely on a customer's instructions.

Questions and privacy requests may be sent to support@agerius.co.

This Policy explains how we handle personal data relating to:

1. visitors and people who request an audit or a quote through our website;
2. customers and their team members; and
3. people whose personal data appears in customer repositories or materials processed while providing the service.

1. Website, audit and quote requests

Information we collect

• Required signup information: work email address.
• Optional information: name, company, role, website, team size, GitHub organization, organization type, and what the person wants a quote for or the audit to clarify.
• Technical information: signup time, a one-time token used to associate optional details with the correct signup, and a salted hash of the connecting IP address used to limit abusive submissions.

The email address is normalized for storage. The one-time token is stored as a cryptographic hash. The IP hash is pseudonymized technical data; we do not treat it as anonymous information.

Why we use it

We use signup information to:

• respond to the audit or quote request and arrange the scoping conversation the person asked for;
• respond to questions and evaluate interest in Agerius;
• protect the signup process from spam and abuse; and
• understand demand for the service using aggregated information.

Our legal bases, where the GDPR or UK GDPR applies, are steps requested before entering a contract and our legitimate interests in operating, protecting, and improving Agerius. We do not use an audit or quote request for unrelated third-party advertising.

If we later offer optional promotional email, we will provide the required choice and unsubscribe mechanism under applicable law.

Cookies and browser storage

The Agerius website does not use advertising cookies. Our audit and quote request form keeps its one-time token in browser memory rather than persistent browser storage. If this changes, we will update this Policy and request consent where required before enabling non-essential storage.

Third-party destinations, including Polar checkout, operate under their own privacy and cookie practices.

2. Website statistics and error reports

We use privacy-reduced operational data to keep the site working and understand its use.

• Server logs: request outcomes, HTTP status, timing, and aggregate counts. We configure application logs not to contain form contents, authentication tokens, raw IP addresses, or full user-agent strings.
• PostHog: when enabled, page path without query strings, referral hostname, UTM source, medium and campaign, coarse device type, and a random event identifier. Person profiles and GeoIP enrichment are disabled.
• Sentry: when enabled, error type, scrubbed message, stack trace, request method, and request path. Request bodies, authentication headers, cookies, and direct user identifiers are excluded from intentional capture.

Our legal basis is our legitimate interest in operating, securing, diagnosing, and improving the service. Despite our filtering, technical data can sometimes be personal data, and we handle it accordingly.

3. Customers, orders, and communications

When a customer purchases or discusses a service, we may receive:

• name, work email, company, role, and contact details;
• the selected service, order status, and transaction identifiers;
• billing country and other information made available through checkout;
• support messages, call notes, and service-related correspondence; and
• product answers and scope information required to provide the service.

We use this information to prepare and perform the contract, provide support, keep business and legal records, prevent fraud, and manage the customer relationship.

Polar checkout

Polar Software, Inc. acts as merchant of record and authorized reseller for purchases made through Polar. Polar processes checkout, payment, tax, fraud-prevention, and transaction information under its own buyer terms and privacy policy. We receive the order and customer information needed to deliver and support the purchased service. We do not receive the customer's full payment-card number.

4. Customer repositories and materials

To provide a Compliance Audit, Policy Pack, Continuous Compliance, or Custom Check Pack, the customer authorizes Agerius to access agreed repositories and related materials through a GitHub App.

The materials may include:

• source code and configuration;
• repository and pull-request metadata;
• developer names and commit email addresses contained in repository history;
• product descriptions and data-flow information; and
• policies and other documents supplied by the customer.

How repository content is handled

• The GitHub App requests the narrowest permissions reasonably needed for the selected service. The permissions are displayed when the customer installs the App.
• Agerius does not intentionally create or retain persistent copies of customer source code on its own storage.
• Code is retrieved and processed transiently for the requested analysis.
• Agerius personnel do not review customer source code as part of normal service delivery.
• If human access becomes necessary to resolve a customer-requested support issue, we will ask for permission first, unless access is required to address a security incident or comply with law.
• Reports may contain file paths, line references, findings, and descriptions. They do not reproduce customer source code unless the customer specifically requests it.
• Customers should not place production records, credentials, secrets, or unnecessary personal data in repositories supplied to Agerius.

The customer is the controller of personal data contained in its repositories and materials. Agerius acts as the customer's processor when handling that data solely to provide the service. The Agerius Data Processing Addendum applies to that processing.

Agerius remains an independent controller for its own account administration, billing records, service security, abuse prevention, and legal compliance.

5. Automated analysis and AI providers

Agerius uses automated systems, including commercial AI model APIs, to analyze selected repository content and generate findings. Current AI inference providers include:

• OpenAI, L.L.C.; and
• Anthropic, PBC, provider of Claude models.

We configure commercial API access and do not intentionally use consumer chat accounts to process customer repositories. We do not opt customer content into provider model training.

OpenAI states that API inputs and outputs are not used to train its models by default. Depending on the endpoint and account configuration, provider systems may retain content for abuse monitoring or application operation, commonly for up to 30 days unless a different retention control applies.

Anthropic states that commercial API inputs and outputs are not used for model training by default and are normally deleted from its backend within 30 days, subject to agreed settings, misuse enforcement, and legal requirements.

Agerius may add or replace an inference provider only after updating its processor information and, where required by the applicable DPA, notifying affected customers before sending customer content to the new provider.

Automated findings can be incomplete or incorrect. Customers must evaluate findings and obtain professional legal advice where appropriate. Agerius does not make solely automated decisions about individuals that produce legal or similarly significant effects.

6. Service providers and recipients

We use the following providers where relevant:

We may also disclose information to professional advisers under confidentiality, to authorities where legally required, or in connection with a corporate transaction subject to appropriate safeguards.

We do not sell personal data or share customer repository content for advertising.

7. International transfers

Shoon's LLC is established in the United States, and Agerius operations or personnel may access data from Armenia. Our providers may process information in the United States, the European Economic Area, and other countries where they operate.

Where applicable law requires a transfer mechanism, we use an applicable adequacy decision, approved contractual clauses, the UK addendum, or another lawful safeguard. Customers may contact support@agerius.co for information about the safeguard relevant to their data.

For customer-controlled repository data, transfer terms are also addressed in the Data Processing Addendum.

8. Retention

We retain information only for the period reasonably needed for the stated purpose, subject to legal obligations.

We may retain a limited record longer when reasonably required to establish, exercise, or defend legal claims; comply with law; investigate abuse; or document a deletion request.

9. Security

We use measures designed to limit access and reduce the amount of customer information processed, including scoped GitHub App permissions, access controls, transient source-code processing, provider access restrictions, and log filtering.

No system is completely secure. Customers are responsible for removing unnecessary secrets and production personal data from repositories and for controlling who can install or authorize the GitHub App.

10. Privacy rights

Depending on applicable law, a person may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal data, and to withdraw consent where processing relies on consent.

Where we rely on legitimate interests, a person may object to that processing. This right is separate from and additional to any right to unsubscribe from marketing.

Requests may be sent to support@agerius.co. We may need information to verify identity and protect other people. We normally respond within one month where GDPR-style response periods apply, subject to lawful extensions.

People may also complain to the data protection authority where they live or work, or where they believe a violation occurred. UK residents may contact the UK Information Commissioner's Office at ico.org.uk. EEA residents may contact their local supervisory authority.

When Agerius processes repository data solely for a customer, the customer is responsible for responding to the affected person's request. We will assist the customer as required by the Data Processing Addendum.

11. Children

Agerius is a business service and is not directed to children. We do not knowingly invite children to create accounts or purchase services.

12. Changes to this Policy

We may update this Policy as the service changes. We will update the date above and, where a material change affects an active customer, provide reasonable notice before the change takes effect.