Privacy Policy

Introduction and scope

SPECTRALE is a software platform for discovering, analyzing, and visualizing software and technical infrastructure architectures. This policy describes how the public website at https://spectrale.tech and the application at https://app.spectrale.tech handle personal data.

It applies to people who visit the website, create an account, or use SPECTRALE for an organization. It does not change how a customer handles personal data inside systems that SPECTRALE only observes.

Categories of personal data

Depending on how you use SPECTRALE, the service may process:

• Account details, including your name, email address, and company name if you provide one.
• Organization membership, which determines which projects you can open.
• Contact details you submit on the website, including your name, email address, and message, when the contact form is available.
• Project, repository, and infrastructure information from the sources you connect. That material can include personal data that already exists in those sources, such as a name or email address in a commit.
• Subscription status when an organization pays through Stripe.
• An optional analytics choice on the public website, and analytics events only after you allow them.
• Technical and security logs generated while the website and application are operated.

Registration and authentication

Application accounts are authenticated with Supabase Auth. SPECTRALE stores a profile for the signed-in person and does not store passwords or raw authentication tokens in that profile.

Creating an account also creates a personal organization. Projects belong to an organization, and a person can use a project only as a member of that organization.

Hosting and infrastructure

The public website, application, and API are hosted on Railway. Application data is stored in PostgreSQL provided through Supabase. This draft does not name a hosting region.

GitHub and external integrations

A customer can connect GitHub through a GitHub App. SPECTRALE uses the installation the customer authorizes to read the repositories and related technical information needed for discovery. Connection credentials are used to operate that connection and are not shown as part of the architecture view.

When a webhook is configured, GitHub can send installation events to SPECTRALE so the connection can stay current. Other sources are read only when a customer connects them.

Repository discovery and infrastructure analysis

The SPECTRALE Discovery Engine examines the sources an organization connects and derives technical entities and relationships from the available evidence. Discovery does not change the connected repositories or infrastructure. The result can be incomplete or incorrect when the evidence is incomplete.

Architecture graph data

The architecture view is stored as project data for the organization. It can include the names of services, repositories, dependencies, and people where those names appear in the connected sources. It is available to members of that organization.

Subscription billing and Stripe

Paid subscriptions are processed by Stripe. Stripe is the source of truth for whether a subscription grants access. SPECTRALE stores the verified plan and status needed to apply that access, including the project and data-source limits of the plan.

Access continues while Stripe reports the subscription as active, trialing, or past due. Choosing to cancel at the end of a billing period does not, by itself, remove access before Stripe ends the subscription. This draft does not set a refund policy.

Private Beta access

The current Private Beta is invitation-only. Each invitation link can be redeemed once and is valid for 7 days. Activating it gives that person’s organization 30 days of beta access, one non-demo project, and 10 accepted Discovery runs. Activating an invitation does not collect a payment method and does not start a Stripe subscription.

Viewing a workspace and demo discovery do not consume the Discovery-run count. A paying subscription is not counted against that beta limit. Beta access does not automatically become a paid subscription when it ends.

After the beta period ends, SPECTRALE refuses new projects, new data-source connections, and new Discovery runs. Existing projects remain available to view.

Cookies and session management

Optional analytics stays off until you accept it. If you accept, the public marketing site loads Contentsquare. Contentsquare can record the public pages you open, scrolling, clicks, heatmaps, and session recordings, and the campaign or referrer that brought you here. Rejecting optional cookies leaves analytics unloaded. The cookie settings control on the page can withdraw that choice. Withdrawal reloads the page so a tag that already loaded stops with the page.

Form fields are masked before recording. Campaign measurement uses only utm_source, utm_medium, utm_campaign, utm_content, and utm_term, plus the referring site host and the first public path in the browser session. It does not identify a personal account on another service.

The tag is not loaded on sign-in, registration, newsletter confirmation or unsubscribe pages, or the product application. SPECTRALE stores the choice in a first-party cookie named spectrale_consent. A separate first-party reference cookie, spectrale_consent_ref, is limited to 180 days and identifies an append-only history in the PostgreSQL database for that website environment, provided through Supabase. That reference is not sent to Contentsquare. Each stored event has a server-generated identifier, the action, whether optional analytics was allowed, the server time, the notice and policy versions, the source, and the environment. Earlier decisions remain when a person updates or withdraws a choice. The history does not store an IP address, a browser user agent, a session recording, or an analytics payload. A failed write is not treated as consent, and optional analytics stays off unless an acceptance is stored. This draft does not name cookies Contentsquare may set after consent, does not set a retention period for recordings, and does not set a deletion period for the consent history.

The application uses Supabase Auth to keep a person signed in.

Technical logs and security

SPECTRALE and its hosting providers keep technical logs to operate, secure, and troubleshoot the service. Those logs can include request metadata such as time, IP address, and user agent. This draft does not state how long each log is kept.

Data retention and deletion

Account, project, and discovery data are kept while the organization uses SPECTRALE. This draft does not set a fixed retention period. You can ask us to delete personal data by writing to contact@spectrale.tech. Some information may remain where it is required for security, billing records held by Stripe, or a legal obligation.

Third-party service providers

SPECTRALE uses the following providers to run the service:

• Railway, for hosting the website, application, and API.
• Supabase, for authentication and PostgreSQL.
• Stripe, for subscription payments when a customer starts a paid plan.
• GitHub, when a customer connects a GitHub App installation.
• Contentsquare, only after a visitor accepts optional analytics on the public marketing site.
• The SPECTRALE Discovery Engine, which is SPECTRALE’s own analysis of the sources a customer connects.

This draft does not publish a complete subprocessor list or the contracts that govern each provider.

International data transfers

Railway, Supabase, Stripe, and GitHub may process data outside the country where you live. This draft does not name the countries involved or the safeguard used for a particular transfer. Those details will be added when the operator’s hosting and contract arrangements are confirmed.

GDPR legal bases

Where the GDPR applies, SPECTRALE relies on these bases:

• Contract, to provide the account, organization, and service you request.
• Legitimate interests, to keep the service secure, operate logs, and prevent abuse, where those interests are not overridden by your rights.
• Consent, for optional website analytics. You can withdraw that choice in this browser.
• Legal obligation, where a law requires SPECTRALE to keep or disclose information.

Data subject rights

Where the GDPR applies, you can ask for access, correction, deletion, restriction, or a copy of your personal data, and you can object to processing based on legitimate interests. You can withdraw analytics consent without affecting processing that happened before the withdrawal. You can also complain to a data protection authority. This draft does not name a lead supervisory authority.

Privacy inquiries

Privacy requests and questions go to contact@spectrale.tech. The legal operator’s name and postal address are not published in this draft.

Policy updates

When this policy changes, SPECTRALE will update this page and the date above. A later legal review may replace this draft.