Resolve Interim Ltd (“Resolve Interim”, “we”, “us” or “our”) respects your privacy. This policy explains how we handle personal data when you visit aitrustbom.com, contact us, buy AI TrustBOM, or use it, including its trustbom command-line tool and GitHub Action (together, the “Software”).
For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, Resolve Interim Ltd is the controller of the personal data described in this policy. Some licensing features described below are planned but are not yet available: the production license service has not been deployed and no Software release can currently connect to it. We will update this policy if the live service or its data practices materially differ from those described here.
1. Who we are
- Legal name: Resolve Interim Ltd
- Company number: 17311747 (England and Wales)
- Registered office: Abingdon, Wagon Lane, Hook RG27 9EJ, United Kingdom
- Privacy enquiries: privacy@aitrustbom.com
- General enquiries: contact@aitrustbom.com
2. How AI TrustBOM handles repository data
AI TrustBOM processes repository files locally on your computer or within the CI/CD runner where you run it. It may read tracked manifests, lockfiles, allowlisted configuration, detector packs and Git metadata to produce its results. The Software does not send repository source code or repository contents to Resolve Interim’s license service, and we do not collect them through product telemetry. The Software has no product telemetry.
Free CLI operations, including init, scan, gate, readiness, request-approval, stamp, export --draft and license status, do not contact Resolve Interim’s license service. Software installation and updates may contact the package registry or download host you choose. The GitHub Action can communicate with GitHub to perform the workflow tasks you configure, such as publishing check results or a pull-request comment; that communication is between your workflow and GitHub using the permissions you grant it. GitHub may process data under its own privacy terms.
When the license service becomes available, explicit license-management operations and paid operations that need a lease will communicate with it over HTTPS. A paid operation with a valid cached lease may run without contacting the service.
3. Personal data we handle
We handle personal data only where it is needed to provide the Software and related services, administer customer relationships, meet legal obligations or protect our services.
| Context | Data we handle |
|---|---|
| Trial request | Email address, GitHub owner name and AI TrustBOM client version. The request is sent only after the trial privacy notice and confirmation, or when you provide an email to the license request-trial command. We use the email once, to send the trial key; the license service does not store it. |
| License activation or lease request | License key and client version. The service hashes the key for lookup and stores a license record containing the GitHub owner, license type, entitlement end date, relevant Paddle identifiers and revocation status. The lease request does not send repository contents or the GitHub owner. |
| Purchase and billing | Paddle processes payment and billing information as merchant of record. We may receive subscription and transaction identifiers, entitlement dates, the GitHub owner associated with the purchase and the customer email needed to deliver a license key. The license service reads that email from Paddle when it sends the key and does not store it. We do not store complete payment-card details. The checkout page (aitrustbom.com/buy/) loads Paddle's checkout script (Paddle.js) from Paddle's servers, so Paddle receives your browser's IP address and technical details when that page loads, and Paddle may set cookies or use similar browser storage to run the checkout. The GitHub owner you enter on that page is sent to Paddle with your order and passed on to us. No other page of this website loads Paddle or any other third-party script. |
| Support and business communications | Information you choose to include in an email, support request, contract or order, such as your name, business contact details, company, role and the contents of your message. |
| Website and service security | Technical request and security logs may include IP address, browser or client details, timestamps, referral information and diagnostic data. Cloud platform logs may record an IP address even though the license application does not store IP addresses in its own records. |
We do not require a machine or runner fingerprint, and the license protocol does not send a list of commands you execute. Please do not include personal data, secrets or source code in support requests unless necessary.
4. Why we use personal data and our lawful bases
We rely on the following lawful bases under Article 6 UK GDPR:
| Purpose | Lawful basis |
|---|---|
| Responding to a trial request and taking the steps you request before entering a license agreement | Contract and pre-contract steps (Article 6(1)(b)). |
| Activating a license, issuing leases and providing paid Software features | Contract performance (Article 6(1)(b)). |
| Processing customer orders, maintaining required accounting and tax records, and complying with legal requirements | Legal obligation (Article 6(1)(c)); contract performance where needed to fulfil an order. |
| Securing the license service, preventing abuse and misuse, and investigating service incidents | Legitimate interests (Article 6(1)(f)) in operating and protecting our business and intellectual property. We balance these interests against your rights and expectations. |
| Responding to support requests and maintaining business relationships | Contract performance where you are a customer, or legitimate interests (Article 6(1)(f)) in responding to business enquiries. |
| Website and infrastructure security | Legitimate interests (Article 6(1)(f)) in keeping our website and services secure and available. |
We do not use a trial-request email for marketing unless you separately agree to receive marketing.
5. How we share personal data
We do not sell or rent personal data. We share it only as needed:
- Paddle is our payment provider and merchant of record. It processes payment and billing data for its own services and legal purposes and may act as an independent controller, subject to its privacy notice. We use relevant transaction details to issue and maintain licenses.
- Cloud and email providers. We use third-party cloud service providers, specifically Microsoft Azure, to securely host our application services, manage databases, process license validations, and maintain operational logs. Transactional email providers deliver license keys and administrative notices. These providers process data strictly on our instructions as data processors under appropriate contractual safeguards, including Microsoft’s Data Protection Addendum (DPA). Data stored in Azure is encrypted both in transit and at rest.
- Website hosting provider. Spaceship hosts aitrustbom.com and logs technical information about visits, such as IP address, browser details and request times, in accordance with Spaceship's privacy policy.
- Professional advisers such as accountants, auditors and lawyers may receive information where needed for professional advice, accounting or compliance.
- Authorities and other parties may receive information where disclosure is required by law, court order or to establish, exercise or defend legal claims.
The GitHub Action's use of GitHub is controlled by the workflow and permissions configured by the repository owner. GitHub's handling of that data is governed by GitHub's own terms and privacy notice.
6. International transfers
We intend to host the license service in the UK or EEA. Some providers or professional advisers may process data in other countries. Where personal data is transferred outside the UK, we will use a UK adequacy regulation where applicable or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, together with any required transfer assessment.
7. How long we keep personal data
We keep personal data only for as long as needed for the purposes in this policy, then delete or securely dispose of it unless a longer period is required by law.
- License and subscription records: up to 13 months after the entitlement ends.
- Trial markers: up to 24 months after the trial key is issued.
- Operator audit records: 2 years.
- Application and platform logs: 30 days.
- Financial and accounting records: 6 years after the end of the relevant financial year, plus the remainder of that financial year where applicable.
- Support enquiries: up to 2 years after the enquiry is resolved, unless a longer period is needed to handle an ongoing matter or legal claim.
The license service is not yet deployed. These periods describe the retention schedule intended for its launch and will be applied in the production configuration before personal data is processed through that service.
8. Your rights
Subject to the conditions and exceptions in data protection law, you may have the right to:
- request access to your personal data and information about its use;
- request correction of inaccurate or incomplete data;
- request erasure or restriction of processing;
- object to processing based on our legitimate interests;
- request data portability where the legal conditions apply; and
- withdraw consent where we rely on consent, without affecting processing already carried out.
To exercise a right, contact privacy@aitrustbom.com. We may ask for information to verify your identity. We normally respond within one month; where a request is complex or you make multiple requests, the law may allow us to extend that period, and we will explain why.
You may also complain to the UK supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
ico.org.uk · 0303 123 1113
9. Third-party services and links
The Software or website may link to services operated by others, including GitHub, package registries, our website host, Spaceship, and Paddle (whose checkout script runs on our checkout page). This policy applies to Resolve Interim's handling of personal data, not to those third parties' independent practices. Review their privacy notices and configure your GitHub workflow permissions carefully.
10. Changes to this policy
We may update this policy to reflect changes in law, our services or our data practices. The current version will be published at https://aitrustbom.com/legal/privacy/, with its updated date. If a material change affects an active subscription, we will notify the relevant billing contact by email where appropriate.
Contact
Resolve Interim Ltd
Company number 17311747
privacy@aitrustbom.com · contact@aitrustbom.com
https://aitrustbom.com