Privacy Policy

Specsight (“we”, “us”, “our”) is a product operated by Ola Piętka, a sole proprietorship (jednoosobowa działalność gospodarcza) registered in Poland.

• Business name: Ola Piętka
• Address: ul. Zawodzie 20, 80-726 Gdańsk, Poland
• NIP: 5833430945
• REGON: 389087991
• Contact: ola@specsight.app

We are the data controller for the personal data processed through Specsight. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights regarding that data.

By creating an account or using Specsight, you agree to the collection and use of information as described in this policy.

1. Data we collect

1.1 Account information

When you sign up, we collect:

• Full name and email address
• Password (hashed; we never store or see your plaintext password)
• Google profile data (name, email, avatar) if you sign in with Google OAuth
• Timezone, as your browser reports it, so dates show in your local time. When you create an organisation, its projects’ weekly digests are set to arrive at 09:00 in your timezone.

1.2 Organisation and project data

When you create or join an organisation, we store:

• Organisation name, URL slug, and membership/role information
• Project names and configuration (repository, branch, context description)
• Features, scenarios, annotations, and changelog entries you create or that Specsight generates
• The names of the people who worked on each release (see 1.3)

1.3 Source code (transient)

When you connect a GitHub or GitLab repository and trigger an analysis, Specsight temporarily clones your entire repository into a secure, ephemeral environment. An AI agent then reads, searches, and analyses files within that clone to generate specifications. We do not permanently store your source code. The clone is deleted immediately after the analysis completes. Only the extracted specifications (features and scenarios) are persisted.

During merge-triggered syncs, code diffs between commits are also sent to Specsight for analysis. These diffs are processed in memory and are not stored.

For each release, Specsight also records who worked on it, so your organisation can see who to ask about a change. It reads the authors and co-authors of the commits in that release and stores their names, and their GitHub or GitLab usernames and account numbers where the commit shows them. Their email addresses are read only to tell people apart and are not stored. Bots, and the AI coding tools Specsight recognises, are left out. When you view a release, your browser loads these people’s profile pictures from GitHub.

Repository contents and push notifications can contain personal data about people who are not Specsight users, such as contributor names and email addresses in commit metadata, and the names Specsight keeps for each release. For that data you are the controller and we act as your processor, on your instructions and under the Data Processing Agreement available on request (see our Terms of Service).

1.4 GitHub integration data

When you install the Specsight GitHub App, we store a GitHub App installation identifier that grants access to the repositories you explicitly authorise. We also receive webhook events (e.g., push events containing repository name, branch, and commit hashes) to trigger automatic syncs. We do not store commit messages or file contents from webhooks. We do not store a long-lived GitHub credential: the app requests a short-lived token for each analysis, and that token is never stored.

1.4a GitLab integration data

When you connect GitLab (gitlab.com or a self-managed instance), you create an access token in GitLab and paste it into Specsight together with your instance URL: a fine-grained token that grants only the permissions Specsight uses, or, where GitLab does not offer one, a legacy token with the api scope. For each organisation that connects GitLab we store: the instance URL; the numeric id and username of the account that owns the token, and whether it is a bot account; the token itself, encrypted in Supabase Vault (a dedicated secrets manager); a secret we generate to verify the webhooks we set up; and the token’s expiry date when GitLab reports one.

The token is decrypted only to call the GitLab API on your behalf: to list the repositories it can see and read the ones you watch, to create and remove Specsight’s own webhooks on those repositories, to clone a repository for analysis, and once a day to confirm the token still works. It is sent only to the https GitLab host you entered. A self-managed instance is operated by you, not by us. A fine-grained token created with the permissions we list can only read your user profile and the token’s own details, list and read repositories, branches and code, and create, list and delete webhooks; Specsight refuses a fine-grained token that is missing any of those permissions or that carries more. A legacy api-scope token is not technically read-only. In either case Specsight never writes to your code. We do not log or expose your token. We also receive webhook notifications from GitLab when code is pushed to a watched repository, as we do from GitHub. A GitLab push notification includes the pusher’s name and email address and the authors of the newest commits; we keep only the repository, branch and commit identifiers needed to start a sync, and do not store the commit messages, names or email addresses it carries. Who worked on a release is read from the repository instead, as section 1.3 describes.

We email your organisation’s Admins and Developers 30 days, 7 days, and 1 day before the token expires, and when GitLab rejects it. A rejected token is not removed automatically; you replace it or disconnect GitLab. The stored token is destroyed when you disconnect GitLab, replace the token, or delete your organisation. You can also revoke the token in GitLab at any time, which stops all access immediately.

1.5 Payment data

Payments are processed by Stripe. We do not see or store your credit card number. We store the Stripe customer ID, subscription ID, plan type, billing period dates, the amount your organisation pays each month, and any terms agreed with you individually (such as a custom price, a discount or a free period), so we can manage your subscription. Stripe handles all payment card data under their own Privacy Policy.

1.6 Usage and analytics data

We collect first-party usage data to operate and improve Specsight. This includes AI token usage per organisation (model, input/output token counts, cost, duration), and event logs (e.g., scan started, sync triggered, webhook received). This data is linked to your organisation and is pseudonymised, not anonymised. We also use Vercel Analytics, a cookieless analytics service, to understand how the product is used (page views and product events such as “signup completed”). It sets no cookies and does no cross-site tracking; the data is processed by Vercel (see §4). We do not use advertising trackers.

On our website and the signup and onboarding pages, we also use PostHog, hosted in the EU, to see where visitors leave: page views, how far a page is scrolled, where on a page people click, and campaign tags in the link they arrived from. PostHog sets no cookies and stores nothing on your device. To count visits, it turns your IP address and browser details into an identifier that changes every day, then discards the IP address, so a visitor cannot be followed from one day to the next. We do not record sessions or send the text you type. Inside the signed-in product, your browser sends PostHog only that a page was opened, never its address or content.

When you are signed in, our servers also send PostHog a record of what you do in Specsight, such as creating a project, connecting a repository, choosing a plan, or opening the spec, so we can see where new customers get stuck and which features are used. Each record holds the action, when it happened, a few fixed labels such as the plan or the code host, and the random IDs of your account and organisation. It never includes your name, email address, organisation name, or anything from your code or spec.

1.7 Bring-your-own-key (BYOK)

Organisations that joined on our former BYOK plan can keep using their own Anthropic API key until they move to the Standard plan. The key is encrypted and stored in Supabase Vault (a dedicated secrets manager), decrypted only at the moment of use to make API calls on the organisation’s behalf, and never logged or exposed. We delete it when the organisation moves to Standard, or when an Admin removes it in billing settings.

1.8 Ask Specsight conversations

When you use Ask Specsight — the in-product chat over your spec, and the Specsight Help drawer — we store your conversations: the questions you ask, Specsight’s answers, and any feedback you give on them. This is what lets you reopen, pin, rename, and export a thread. To produce an answer, your question, the conversation so far, and the relevant context — parts of your spec for a project’s Ask, or your account and billing state for the Help drawer — are sent to the Claude API (see §4). Conversations are private to you within your organisation, and you can delete a thread at any time.

1.9 Digest feedback

The weekly digest email asks “Was this useful?”. When you answer, we store your Yes or No with your account and that week’s digest. Only you can see your answer in Specsight; we read the answers to improve digests. Answering also records a product event saying whether it was Yes or No (see §1.6).

1.10 Free trial applications

If you apply for a free trial during setup, we store your answers (your role, your company’s size, how often it ships, and what you mainly want to use Specsight for, including anything you write under Other), the domain of your email address, and our decision. We use them to decide on your application, to email you about it, and to write the trial’s emails to you. During the trial, we also read how it is going (releases followed, changes recorded, Highlights, questions asked, and teammates who joined, along with your project’s name and the wording of its latest Highlight) to choose what those emails say.

2. Legal basis for processing

Under the General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

• Contractual necessity (Art. 6(1)(b)) — processing your account data, source code (transiently), organisation data, and the GitLab access token you provide (if you connect GitLab) is necessary to provide the Specsight service you signed up for. Connection-health emails about that token are sent on the same basis, and so is deciding on a free trial application you submit and telling you before a trial’s first charge.
• Legitimate interest (Art. 6(1)(f)) — collecting usage analytics and event logs to maintain, secure, and improve the service; asking whether a digest was useful; sending the weekly digest and other product notification emails to members, which each member can turn off in their notification settings; sending occasional service announcements about Specsight to people who have created an account (see §3a); sending a free trial’s check-in and end-of-trial emails; and keeping a record of free trial applications so that each company gets one free trial. Our interest is balanced against your rights by limiting data collection to what is necessary, not sharing it with third parties for their own purposes, offering one-click unsubscribe in every marketing email, and letting you turn off each notification email in your notification settings.
• Consent (Art. 6(1)(a)) — adding you to Specsight’s newsletter when you actively opt in (see §3a). You can withdraw consent at any time via the unsubscribe link in any marketing email.
• Legal obligation (Art. 6(1)(c)) — retaining billing records as required by Polish tax law.

3. How we use your data

• Provide the service: Analyse your codebase, generate and maintain product specifications, and deliver them through the Specsight dashboard.
• Authenticate you: Verify your identity and manage access to your organisation’s data.
• Process payments: Manage subscriptions, enforce plan limits, and handle billing through Stripe.
• Send transactional notifications: Email you the weekly digest of what changed in your organisation’s projects (nothing is sent in a week with no changes), and email you about scan completions, sync updates, digest generation, team invitations, a free trial application and the notice before a trial’s first charge, and the health of a GitLab connection (a token about to expire or no longer accepted) — delivered via Resend (see §4). You can opt out of non-essential transactional emails in your in-app notification settings; connection-health emails go to Admins and Developers because they are needed to keep the service working. Marketing and lifecycle emails are covered separately in §3a.
• Improve Specsight: Use aggregated usage data to improve Specsight's analysis accuracy, performance, and user experience.
• Respond to support requests: Use your account information to help you when you contact us.

3a. Marketing communications and lead-magnet data

We send three categories of email outside the transactional product flow:

• Service announcements (auto-subscribed). When you create a Specsight account, we may send you occasional product updates — new features, important changes, and release notes. These are directly related to the service you signed up for. Lawful basis: legitimate interest under GDPR Art. 6(1)(f), balanced against your right to unsubscribe at any time via the link in every email.
• Free trial emails. If you start a free trial, our founder emails you through Loops: a check-in a few days in and, if you cancel, a note when the trial ends asking what was missing. Lawful basis: legitimate interest under GDPR Art. 6(1)(f); you can unsubscribe at any time via the link in either email. The notice before a trial’s first charge is a transactional email and is always sent.
• Newsletter and broader insights (explicit opt-in). We add you to Specsight’s newsletter only when you actively opt in by: ticking the “Send me Specsight’s newsletter” checkbox on the signup page; submitting your email through the newsletter form in the site footer or at the foot of blog posts; or ticking the marketing opt-in checkbox on our cost-of-drift calculator at specsight.app/cost-of-doc-drift. Lawful basis: explicit consent under GDPR Art. 6(1)(a).

If you leave your email when answering our research survey, we subscribe you to the service-announcements category only, as stated on the survey form (lawful basis: consent, Art. 6(1)(a)).

You can withdraw consent or unsubscribe from either category at any time using the one-click link in every marketing email, or by emailing ola@specsight.app. Withdrawal does not affect the lawfulness of processing before withdrawal. When you unsubscribe, our email processor (Loops — see §4) adds you to its persistent suppression list so we cannot accidentally resubscribe you on a later signup.

Marketing emails are delivered by Loops (see §4 for processor details). When you delete your Specsight account, your Loops contact is removed within 24 hours as part of the account-deletion flow.

If you submit the calculator without opting in to marketing emails, we use your email address solely to deliver the calculator’s report (transactional, Art. 6(1)(b) — performance of a service you initiated). We retain the calculator submission record (your inputs and computed results) for 24 months so you can re-access your personalised report URL; you can request earlier deletion via ola@specsight.app.

4. Data sharing and sub-processors

We do not sell your personal data. We share data only with the following third-party services, strictly to operate Specsight:

• Supabase (Supabase Inc., USA) — Database hosting, authentication, real-time subscriptions, and encrypted secrets storage (Vault)
• Anthropic (Anthropic PBC, USA) — AI-powered code analysis, text generation, and Ask Specsight. Your source code is sent to the Claude API during analysis; and when you use Ask Specsight, your questions, the conversation, and the relevant context (parts of your spec, or your account and billing state for the Help drawer) are sent to compose the answer. Subject to Anthropic’s Privacy Policy. Anthropic does not use API inputs to train their models.
• GitHub (Microsoft, USA) — Repository access and webhook delivery via the Specsight GitHub App
• GitLab (GitLab Inc., USA) — Repository access and webhook delivery for organisations that connect gitlab.com. A self-managed GitLab instance is operated by you (or your hosting provider), not by GitLab Inc., and is not our sub-processor
• Stripe (Stripe Inc., USA) — Payment processing and subscription management. Subject to Stripe’s Privacy Policy.
• Vercel (Vercel Inc., USA) — Application hosting, serverless compute, and cookieless usage analytics (Vercel Analytics)
• PostHog (PostHog Inc., USA; data hosted in the EU) — Cookieless website analytics on our public pages, signup and onboarding, and product-usage events linked to the random IDs of your account and organisation (see §1.6)
• Trigger.dev (Trigger.dev Ltd., UK) — Background job orchestration for scans and syncs
• Resend (Resend Inc., USA) — Transactional email delivery
• Loops (Loops Right Inc., USA) — Marketing and lifecycle email delivery, mailing-list subscription management, and hosted unsubscribe. We send your email address, full name, signup source, and mailing-list membership state. For lifecycle emails (an unfinished setup, a free trial, a cancellation), we also send your organisation’s name; for a free trial’s emails, what you said you mainly want to use Specsight for and a summary of how the trial went, including your project’s name and the wording of its latest Highlight (see §1.10); and the reason you gave when cancelling, if any. Subject to Loops’ Privacy Policy.

If you connect an AI tool to Specsight through MCP, such as Claude or ChatGPT, the specification data it reads is sent to that tool’s provider on your instruction and under your own agreement with them. They are not our sub-processors, and their privacy terms apply to that data.

5. International data transfers

Specsight is operated from Poland (EU). Most of our sub-processors are based in the United States. Personal data transferred outside the European Economic Area (EEA) is protected by:

• The EU–US Data Privacy Framework, where the sub-processor is certified, or
• Standard Contractual Clauses (SCCs) approved by the European Commission

If you have questions about the specific safeguards applied to a particular sub-processor, contact us at ola@specsight.app.

6. Data security

We take the security of your data seriously:

• All data in transit is encrypted via TLS/HTTPS
• Database access is protected by Row-Level Security (RLS) policies — users can only access data belonging to their organisation
• BYOK API keys and GitLab access tokens are encrypted at rest in Supabase Vault, a dedicated secrets manager
• GitHub webhook payloads are verified using HMAC SHA-256 signatures with timing-safe comparison; GitLab webhook deliveries are verified against a per-connection secret token with a constant-time comparison
• Authentication endpoints are rate-limited to prevent abuse
• Passwords are hashed using industry-standard algorithms managed by Supabase Auth
• Source code is cloned to temporary directories with restricted access and deleted immediately after analysis

7. Data retention

• Account data is retained for as long as your account is active.
• Source code is never stored permanently — it is cloned into an ephemeral environment and deleted immediately after analysis.
• GitLab access tokens are retained until you disconnect GitLab, replace the token, or delete your organisation, whichever comes first.
• Specifications (features, scenarios, changelogs) are retained until you delete them or delete your project/organisation.
• The names of the people who worked on each release are retained until you delete the project or organisation, or ask us to remove a person.
• Ask Specsight conversations are retained until you delete the thread or delete your organisation. Deleting a thread removes its questions, answers, and feedback.
• Digest feedback is retained until you delete your account or your organisation is deleted.
• Free trial applications (your answers, your email domain, and our decision) are kept after your organisation or account is deleted, so that each company gets one free trial. Deleting your account removes the link between the application and you.
• AI usage logs and analytics events are retained for as long as your organisation exists, for billing and service improvement purposes.
• Website analytics in PostHog are visit statistics that are never linked to your account. Product-usage events in PostHog are linked to your account’s random ID, never to your name or email address, and are deleted from PostHog when you delete your account. Both are kept in PostHog’s EU region under its standard retention.
• Billing records are retained as required by Polish tax law (currently 5 years from the end of the tax year).
• Marketing contacts (Loops) are retained until you unsubscribe or delete your Specsight account. Account deletion removes the Loops contact within 24 hours. Unsubscribing places you on Loops’ persistent suppression list so you are not accidentally resubscribed.
• Organisations after subscription end: When your organisation’s subscription ends, access pauses and all organisation data is retained for 90 days — subscribing again within this window restores it. We send a warning email before the window closes. After 90 days, the organisation and all its data (specifications, conversations, usage logs) are permanently deleted.
• Deleted accounts: When you delete your account, we remove your personal data within 30 days. Organisation data is retained as long as other members remain.

8. Your rights

Under the GDPR and applicable Polish data protection law, you have the right to:

• Access your personal data and receive a copy
• Rectify inaccurate or incomplete data
• Erase your account and associated personal data (“right to be forgotten”)
• Export your data in a portable, machine-readable format
• Restrict processing in certain circumstances
• Object to processing based on legitimate interest
• Withdraw consent at any time for consent-based processing (e.g., the newsletter), without affecting the lawfulness of processing before withdrawal

You can manage most of these directly in your Specsight account settings. For any requests you cannot fulfil through the app, contact us at ola@specsight.app. We will respond within 30 days.

You also have the right to lodge a complaint with the Polish supervisory authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

9. Cookies

Specsight uses only essential cookies required for the service to function. We do not use advertising, analytics, or third-party tracking cookies. The cookies we set are:

• Supabase auth cookies — Authentication session tokens (access and refresh tokens). HttpOnly, Secure, SameSite=Lax.
• active_org_id — Remembers which organisation you last viewed, so we can redirect you on login. HttpOnly, Secure, SameSite=Lax. Expires after 1 year.
• pending_invite_token — Preserves an invitation link if you need to sign up or log in first. HttpOnly, Secure, SameSite=Lax. Expires after 24 hours.
• github_install_state — CSRF protection during GitHub App installation. Deleted immediately after use.
• pending_grant_token — Preserves a deal link from Specsight while you sign up. HttpOnly, Secure, SameSite=Lax. Expires after 7 days.
• pending_promo_slug — Preserves a promo link while you sign up. HttpOnly, Secure, SameSite=Lax. Expires after 7 days.
• pending_magic_next — Remembers the page you were opening when you request a magic sign-in link, so we can return you there. HttpOnly, Secure, SameSite=Lax. Expires after 1 hour.
• sps_vision_reactions — Remembers which items you have reacted to on our public roadmap page, so the same reaction is not counted twice. Readable by the page (not HttpOnly), Secure, SameSite=Lax. Expires after 1 year.

Because these are strictly necessary cookies, they do not require consent under the ePrivacy Directive. Our analytics, Vercel Analytics and PostHog, set no cookies and store nothing on your device.

10. Published release notes

Publishing release notes creates a public page that anyone with the link can read, with no Specsight account. Unpublishing takes the page offline immediately, and republishing restores the same address. Published release notes contain specification data (features, scenarios, changes) but never source code. Digests stay inside your organisation and cannot be shared through a public link.

11. Children’s privacy

Specsight is a business tool and is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 16, we will delete it promptly.

12. Data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority (UODO) within 72 hours of becoming aware of the breach, as required by GDPR Art. 33
• Notify affected users without undue delay if the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Art. 34
• Document the breach, its effects, and the remedial actions taken
• Email your organisation’s Admins and Developers if we have reason to believe a stored GitLab access token or BYOK API key may have been exposed, so you can revoke it at the source, in addition to the notifications above

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a notice in the app at least 30 days before they take effect. Continued use of Specsight after changes take effect constitutes acceptance of the updated policy. The “Last updated” date at the top of this page reflects the most recent revision.

14. Contact

If you have questions about this Privacy Policy, how we handle your data, or wish to exercise your data protection rights, contact us at:

• Email: ola@specsight.app
• Contact form: specsight.app/contact
• Post: Ola Piętka, ul. Zawodzie 20, 80-726 Gdańsk, Poland