Privacy policy

Last updated 1 October 2026

The short version

We never read your disk and never store your code. The free scan runs on your machine; the server scores the results in memory and keeps only the finished report, for seven days, behind an access code.
Signing in takes an email address. We keep it as a contact record, with the name of the tool you connected from, for three years after your last sign-in.
SDLC projects are kept until you delete them, and you can delete them at any time, with or without a licence.
Google Analytics, Google Ads and the Reddit pixel set cookies only if you click Allow. Our own visit counts use no cookie, no identifier and no stored IP address.
We do not sell your data and do not add you to the newsletter unless you sign up.
Questions or requests: our contact form. One message is enough.

1. Who we are

prodready is a service of Innovate d.o.o., Ljubljana, Slovenia. Innovate d.o.o. is the controller of the personal data described here. Write to us through our contact form about anything on this page. We have not appointed a data protection officer; the same form reaches the person responsible.

This policy covers prodready.si, the MCP server at mcp.prodready.si and the emails they send. Your MCP host (Claude, Codex, Cursor or another) and the AI provider behind it are not ours: what you type into them, and what they read on your computer, is governed by their terms.

2. What we collect, why, and for how long

Each row is one thing you might do. Giving us your email address is needed to sign in to the MCP server, ask for the SDLC, get the install line by email or join the newsletter; everything else on the site works without it.

What you do	What we get	Why, and the legal basis	How long we keep it	Who helps
Browsing the site	IP address, browser and device type, the page asked for, the time.	To deliver the page and keep the site safe. Legitimate interest, Art. 6(1)(f).	We keep no request logs of our own. Our host processes the data for as long as it needs to deliver and protect the request.	Cloudflare; Google Fonts (typefaces); jsDelivr (one animation script on /sdlc)
Anonymous counts (details)	Daily totals per page and event, a short button label, a coarse source label, and the name of the ad a visit came from. No cookie, no identifier, no stored IP address.	To know which pages and ads work without tracking anyone. Legitimate interest, Art. 6(1)(f).	Totals: 90 days. The flood guard's hash of your IP address: 60 seconds. The ad's name in your browser's session storage: until you close the tab.	Cloudflare
Google Analytics and the Reddit pixel (details)	Cookie identifiers, pages seen, clicks, form sign-ups, device and browser data, IP address.	To measure visits and whether an ad led to a sign-up. Your consent, Art. 6(1)(a), given on the banner.	Google: the retention period set on our Analytics property. Reddit: under Reddit's own terms.	Google, Reddit
Signing in to the MCP server	Your email address, the time of your first and your latest sign-in, how many times you have signed in, the names of the MCP hosts you signed in from (for example "Claude Code"), and the sign-in tokens issued to your host.	To let your host use the tools, and to know who uses them and answer when you ask for the SDLC. Contract, Art. 6(1)(b), and legitimate interest, Art. 6(1)(f).	Sign-in link: 15 minutes. Access token: 24 hours. Refresh token: 90 days, replaced each time it is used. Contact record: 3 years after your last sign-in.	Cloudflare (storage), Resend (the sign-in email)
Running the free scan or due diligence	The results of read-only checks your host ran on your computer: counts, file paths, configuration shapes.	To score them and write your report. Contract, Art. 6(1)(b).	The results are scored in memory and discarded: never stored. The finished report page (score, rule names, counts, the file paths it quotes): 7 days, behind an access code. A scores-only summary of the latest scan (no findings, no paths): 7 days. Rate-limit counters, which hold only a one-way hash of your email address or IP address: up to an hour.	Cloudflare
SDLC project documents	What your host records through the SDLC tools: stories, sprints, gate results, reviews, decisions, and report pages.	To run the SDLC you licensed. Contract, Art. 6(1)(b).	Until you delete the project (`sdlc_project_delete`, which works with or without a licence). SDLC report pages: 7 days, or sooner when the project is deleted.	Cloudflare
Asking for the SDLC	Email, and whatever else you give: name, company, product, MCP host, number of projects, a note, the plan you chose.	To send you the payment links and answer questions. Steps before a contract, Art. 6(1)(b).	A request made from your MCP host: 180 days. A request from the website form: kept only as email in our mailbox (see below).	Cloudflare, Resend, Google Workspace (our mailbox)
Paying for the licence	Stripe collects your card and billing details. We see your name, email, billing country, amount, and the Stripe ids of the payment; never your full card number. The licence record holds the plan, its dates and those Stripe ids.	To take payment, activate and end the licence, and keep accounts. Contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c).	Licence record: up to about 13 months after the last payment. Invoices and accounting records: as long as Slovenian tax and accounting law requires.	Stripe
Emailing yourself the install line	The email address you type, which MCP host you picked, and the page you were on.	To send you the line; a copy tells us someone is about to try the scan. Your request, Art. 6(1)(b), and legitimate interest, Art. 6(1)(f).	We keep no database of these. The copy sits in our mailbox (see below).	Cloudflare, Resend, Google Workspace
The newsletter	Your email address.	To send the newsletter. Your consent, Art. 6(1)(a).	Until you unsubscribe (the link in every mail, or reply "stop").	Resend
Writing to us	Your name, email address and message when you use the contact form, whatever you put in an email, and the notes our systems send us when you sign in for the first time, request the install line or ask for the SDLC.	To answer you and keep business correspondence. Legitimate interest, Art. 6(1)(f), or contract where it concerns one.	Up to three years after our last exchange, longer only where a claim or the law requires it.	Cloudflare, Resend (the contact form), Google Workspace

Where we rely on legitimate interest, the interest is running and protecting the service, knowing who uses it, and answering people who have shown interest in it. You can object to it at any time (see Your rights).

3. Your code and the scan

The MCP server never reads your disk. It returns read-only commands; your MCP host runs them on your computer and sends back the results.
Those results are scored in memory and discarded. They are not written to storage and the server keeps no request logs, so they cannot turn up later.
What is kept is the finished report: the score, the rule names, counts and the file paths it quotes. It sits at an unlisted address for seven days, opens only with the six-character access code your host prints next to the link, and is then deleted. Your host can ask for the report inline instead, and then nothing is stored at all.
The SDLC tools refuse text that looks like a password or key, an email address, a web address carrying query parameters, or pasted code, to keep those out of project documents.
If a project document still holds personal data about other people, we process it on your behalf. We sign a data processing agreement under Art. 28 GDPR on request (see the Terms).

On your first visit a banner asks whether we may use Google Analytics 4 and the Reddit advertising pixel. Until you answer, and if you say no:

the Reddit pixel is never loaded;
Google Analytics sets no cookie. Its script still loads and sends Google cookieless signals for the pages you view and the actions you take on them (clicks, sections viewed, install lines copied, sign-ups). They carry your IP address and browser details, but no identifier that ties one page view to the next.

If you click Allow, both set cookies (see the table below) and record the pages you see and the actions you take, such as signing up. Your choice is stored in your browser. To change it, use Cookie settings at the bottom of any page: the banner opens again and you can say no as easily as you said yes. Withdrawing consent does not affect what happened before.

When we have configured it, the MCP server also reports product events to the same Google Analytics property: that someone registered, signed in, connected, ran a scan or the due diligence, used an SDLC tool (and its name) or opened a report, together with the MCP host and the grade and score. It sends no email address. The id Google receives is derived from your account with a secret key, or is a random id we keep for your account for up to about 13 months, so Google cannot link it back to your address. Ads personalisation is switched off on these events. The legal basis is our legitimate interest in understanding how the tool is used.

5. Anonymous counts

Because most visitors say no to the banner, the site also counts visits in a way that identifies nobody, whether or not you accepted. Each page view, and a handful of actions (copying the install line, clicking a button, signing up to the newsletter, asking for the install line by email, requesting the SDLC), adds one to a counter for that day and page on mcp.prodready.si. A count can carry:

a short label, such as which button it was;
for the first page of a visit only, a coarse source such as "reddit", "google" or "direct", taken from the link you followed;
if you arrived from one of our ads, the ad's name: the campaign and advertisement from the link, for example five-eu-e-builders, cleaned to letters, digits and hyphens and at most 30 characters. It is the same for everyone who clicked that ad, so it names the ad, not you. The first page you land on is counted under that name, and while the tab stays open your browser keeps the name in session storage (pr_ad, see below) so that copying the install line, signing up or asking for the install line or the SDLC later in the same visit is also counted once under the ad's name. Closing the tab deletes it.

No cookie is set, no identifier is created, and your IP address is not stored. To stop floods, a one-way hash of your IP address and the current minute is kept 60 seconds and then expires. What remains are totals such as "40 views of /mcp from reddit on 30 September" or "3 install lines copied after ad five-eu-e-builders on 30 September", which cannot be tied to you or to any other visit. Automated visitors that say they are bots are not counted. The totals are deleted after 90 days. The legal basis is our legitimate interest in knowing which pages and ads work.

6. Cookies and browser storage

Name	Where	What it does	How long	Consent
`prodready.consent.v1`	prodready.si, local storage	Remembers your answer on the cookie banner.	Until you clear site data	Necessary
`pr_nl`	prodready.si, local storage	Remembers that the newsletter box was shown, closed or used, so it does not keep asking.	Until you clear site data	Necessary for the choice you made
`pr_ad`	prodready.si, session storage	Holds the name of the ad this tab arrived from (campaign and advertisement, for example `five-eu-e-builders`), so the anonymous counts can tell which ad led to an action later in the same visit. It is the same for everyone who clicked that ad and says nothing about you. Set only when you arrive from one of our ads.	Until you close the tab	Not asked: it holds no identifier
`pr_signin`	mcp.prodready.si, cookie	Ties a sign-in link to the browser that asked for it, so nobody else can use it.	15 minutes	Necessary
`pr_r_<id>`	mcp.prodready.si, cookie	Remembers the access code of a report page you opened, so it reloads without the code.	7 days	Necessary
`_ga`, `_ga_*`	Google Analytics, cookies	Tell one visit from another and count returning visitors.	Up to 2 years	Only after you click Allow
`_gcl_*` (Google Ads)	Google Ads, cookies	Tells Google whether someone who clicked our ad went on to check their app.	Up to 90 days	Only after you click Allow
`_rdt_uuid` and the Reddit pixel	Reddit, cookie	Tells Reddit whether someone who saw our ad visited or signed up.	Set by Reddit	Only after you click Allow

7. Who processes data for us

These companies handle personal data on our instructions, under data processing terms that bind them to the GDPR. Stripe and Reddit act for themselves, as the table says. Google Fonts and jsDelivr receive only what any web request carries: your IP address and browser details.

Who	What for	Where	Transfer safeguard
Cloudflare, Inc.	Hosts the site and the MCP server; stores accounts, report pages, project documents, licences and the anonymous counts	Global network, United States company	EU–US Data Privacy Framework and Standard Contractual Clauses
Resend	Sends every email: sign-in links, the install line, SDLC requests, the newsletter; holds the newsletter list	United States	Standard Contractual Clauses
Google (Workspace, Analytics, Fonts)	Our mailbox; visit statistics after consent; the site's typefaces	United States and elsewhere	EU–US Data Privacy Framework and Standard Contractual Clauses
Stripe	Takes payments. Stripe is responsible for its own handling of payment data as a separate controller; see stripe.com/privacy	EU (Stripe Payments Europe, Ireland) and United States	EU–US Data Privacy Framework and Standard Contractual Clauses
Reddit, Inc.	Measures our ads, only after consent. Reddit decides what it does with the data it receives	United States	Standard Contractual Clauses
jsDelivr	Serves one open-source animation library on /sdlc	Global content network	The request carries your IP address and browser details only

We share nothing else with anyone, and we do not sell personal data. We would disclose data to an authority only where the law obliges us to.

8. Transfers outside the EU

Several of the providers above are based in the United States or run global networks, so personal data can be processed outside the European Economic Area. Where it is, the transfer relies on the provider's certification under the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) or on the Commission's Standard Contractual Clauses in its data processing terms, as listed in the table. Write to us for a copy of the relevant safeguards.

9. How we protect it

Everything travels over HTTPS, and the site asks browsers to insist on it.
There are no passwords to steal: sign-in links expire after 15 minutes, work once, and work only in the browser that asked for them; the emailed code is refused after five wrong tries.
Access tokens expire after 24 hours; you can revoke your host's access at any time.
Report pages sit at unguessable addresses and open only with their access code.
Almost everything we store has an expiry date, listed above. The exceptions are your SDLC projects and their index, which you delete when you choose; the newsletter list, which keeps your address until you unsubscribe; and our mailbox.
Should a breach put your data at risk, we will tell the supervisory authority and, where the law requires, you.

10. Your rights

Under the GDPR you can ask us to:

see the data we hold about you and get a copy (Art. 15);
correct it (Art. 16);
delete it (Art. 17). SDLC projects you can delete yourself with sdlc_project_delete; for anything else, ask us;
restrict how we use it (Art. 18);
receive it in a portable format (Art. 20). sdlc_project_export gives you your projects at any time;
object to processing based on legitimate interest (Art. 21);
withdraw consent at any time, without affecting what happened before (Art. 7(3)): for cookies, with Cookie settings at the bottom of any page; for the newsletter, with the unsubscribe link in every mail.

Write to us through our contact form. We answer within one month, and ask you to give the email address the request concerns so we know it is you. It costs nothing.

You can also complain to a supervisory authority. Ours is the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si. You may instead go to the authority where you live or work.

11. Automated scoring

The readiness score and the due diligence grades are calculated automatically from the check results. They describe your software, not you, and no decision with legal or similarly significant effect on you is made from them, so Art. 22 GDPR does not apply.

12. Children and changes

The service is for people building software professionally and is not directed at children under 16. If you think a child has given us personal data, tell us and we will delete it.

When what we collect changes, this page and the date at the top change with it. If a change matters for data we already hold, we will tell signed-in users and licence holders by email before it takes effect.