Project BeeKeeper — Privacy Policy

1.1 Data Controller: Hive IT acts as the Data Controller for personal data collected in connection with account administration, user authentication, and trial communications. Where you connect client websites, domain names, or code repositories to the Platform, you act as the Data Controller for any personal data contained within those third-party assets, and Hive IT acts as a Data Processor.

1.2 Contact Details: If you have any questions about this Privacy Policy or our data protection practices, please contact our team at [email protected].

We collect and process different categories of information to provide automated portfolio health monitoring and manage your trial account:

• Account & Identity Data: Full name, email address, and profile picture collected when you sign in with Google or Microsoft (NextAuth.js). We also record your user role, permissions, and organisation slug.
• Integration Credentials & Tokens: OAuth tokens and access credentials for connected version control systems (e.g. GitHub, GitLab) and project management integrations (e.g. Atlassian Jira Cloud). All integration tokens are stored strictly encrypted at rest.
• Repository & Technical Manifest Data: Repository names, file paths, and dependency manifest files (e.g. package.json, composer.json, .csproj, requirements.txt, pom.xml, build.gradle, Gemfile). The Platform reads dependency manifests to identify software frameworks, versions, and security vulnerabilities. We do not copy, store, or train models on your proprietary source code.
• Website & Domain Audit Data: Publicly available technical metadata relating to connected client websites, including domain names, SSL certificate details, HTTP security headers, DNS records (SPF, DMARC, DKIM, MX), WHOIS expiry dates, sitemaps, and automated accessibility scan scores (WCAG impact findings generated via Lighthouse).
• Feedback & Support Data: Information submitted through our authenticated in-app feedback form (categorised into Change, Bug Fix, Query, or Suggestion / New Feature), including problem descriptions, screenshots, and trial correspondence.
• Technical & Usage Data: IP addresses, login timestamps, browser type, audit job logs, and system usage metrics logged during platform sessions.

Under UK GDPR, we rely on the following legal bases to process your personal data:

• Trial Performance & Service Delivery: To create and manage your tenant account, authenticate your login credentials, execute background audit workflows, generate security and accessibility alerts, and sync prioritised actions with your Jira workspace. (Legal basis: Performance of trial agreement.)
• Product Evaluation & Improvement: To analyse aggregated usage patterns, evaluate feature performance, and triage user feedback submitted via our in-app form to refine Project BeeKeeper. (Legal basis: Legitimate interests.)
• Communication & Support: To respond to queries sent to [email protected], communicate platform updates, and notify designated primary contacts regarding trial operations. (Legal basis: Legitimate interests / Performance of trial agreement.)
• Platform Security & Multi-Tenancy: To enforce tenant-level data isolation, protect against unauthorised access, and maintain system integrity. (Legal basis: Legitimate interests / Legal obligation.)

We do not sell, rent, or trade your personal data. To deliver automated scanning and workflow features, we share relevant technical data with trusted third-party service providers:

• Authentication Providers: Google OAuth and Microsoft Entra ID (NextAuth.js) for secure identity verification.
• Vulnerability & EOL APIs: OSV.dev database and endoflife.date API to query open-source package vulnerabilities (using dependency names and version numbers) and technology lifecycle schedules.
• Issue Tracking Integrations: Atlassian Jira Cloud for two-way task synchronisation and internal feedback triage.
• Audit Services: Containerised, headless-Chromium Lighthouse auditing services hosted within our secure cloud infrastructure for accessibility evaluations.
• Cloud Infrastructure: Secure UK and EEA-based hosting infrastructure managed by Hive IT.

5.1 Multi-Tenant Isolation: The Platform enforces strict organisation-level data isolation (slug-based routing) to ensure that your portfolio data, connected repositories, and scan histories are accessible only to authorised users within your tenant account.

5.2 Encryption Standards: All integration credentials, OAuth tokens, and secrets are encrypted at rest using industry-standard AES-256 encryption. All data in transit between your browser, the Platform, and connected APIs is protected using HTTPS/TLS 1.3 encryption.

We retain your personal data and scanned portfolio history only for as long as necessary to fulfil the purposes of the trial. Upon completion or termination of your trial participation, Hive IT reserves the right to archive or permanently delete tenant accounts, integration tokens, and scan histories, unless you transition to a commercial BeeKeeper subscription.

Under UK data protection law, you have specific rights regarding your personal data:

• Right of Access: The right to request a copy of the personal data we hold about you.
• Right to Rectification: The right to request correction of inaccurate or incomplete personal data.
• Right to Erasure ('Right to be Forgotten'): The right to request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to Restrict Processing: The right to request the restriction or suppression of your personal data under certain conditions.
• Right to Object: The right to object to processing based on legitimate interests.
• Right to Data Portability: The right to request transfer of your personal data to another organisation.

To exercise any of these rights, please email [email protected]. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been handled improperly.