Effective date: September 1, 2026
Information we collect
DDCAL may receive information you provide when requesting or purchasing a service, including your name, email address, organization or project name, public repository or project URLs, service-selection information, intake details, and customer-support correspondence.
The core information pages of ddcal.ca do not intentionally use behavioral advertising trackers. Hosting and security infrastructure may generate ordinary network, server, and security logs needed to operate and protect the service.
Payments
Payments may be processed by Stripe. Stripe may collect payment credentials, billing information, device or network information, fraud-prevention signals, and transaction information according to its own privacy practices and legal obligations. DDCAL does not intentionally store full payment-card numbers or card security codes on its public website or in ordinary business records.
DDCAL may receive transaction metadata from Stripe that is necessary to identify a purchase, provide the purchased service, issue a receipt or refund, respond to a dispute, maintain accounting records, and detect fraud or duplicate transactions.
How information is used
Information is used to respond to inquiries, provide and deliver purchased services, verify scope and authorization, communicate about service intake or delivery, provide support, maintain appropriate business and quality records, address payment disputes or refunds, improve reliability, and protect DDCAL systems from abuse.
Who information may be shared with
DDCAL does not sell personal information. Information may be disclosed to service providers that are reasonably necessary to operate the business, including payment processing, web hosting, email, infrastructure, security, and professional advisers. Information may also be disclosed where required by applicable law or a valid legal process.
Try DDC demo
The public Try DDC demo accepts only a public GitHub repository URL, an optional public ref, and an authorization confirmation. The service resolves public repository data from GitHub and may query the OSV public vulnerability service for supported dependency advisories. Submitted repository code is not executed.
To limit abuse, the demo may use a short-lived rate-limit record derived from the requesting network address. The public demo does not intentionally retain submitted source code or discovered secret values as an assessment record.
DDCAL keeps first-party aggregate operational statistics for Try DDC so the operator can see whether the demo is being used and how it behaves. These records can include event time, completion or error state, released disposition, aggregate finding counts, file-count coverage, and processing duration. They do not intentionally record repository URLs or names, submitted source, discovered secret values, user agents, or raw network addresses.
The private operator dashboard may also summarize ordinary web-server access logs to estimate request and visitor counts. Visitor uniqueness is calculated ephemerally for display and is not added to the Try DDC metrics record.
Assessment evidence
Do not submit confidential evidence, private repositories, credentials, access tokens, personal datasets, or other sensitive material through a public website or ordinary email path unless DDCAL has expressly authorized a suitable evidence-handling channel for that engagement.
Retention
Information is retained only for as long as reasonably necessary for service delivery, quality and transaction records, accounting, dispute handling, security, and applicable legal obligations. Retention periods can vary according to the type of record and engagement.
Access, correction, and deletion requests
You may contact DDCAL to ask about personal information associated with you, request correction of inaccurate information, or request deletion where appropriate and legally permitted. Some transaction, accounting, security, or assurance records may need to be retained.
Contact
Privacy and customer-support inquiries: inquiry@ddcal.ca.