Privacy Policy

JusticeBridge Technologies, Inc. (“JusticeBridge”, “we”, “us”) operates TrueTag, a launch-readiness assessment product for software teams. This policy applies to account holders, workspace members, and visitors who use www.mytruetag.com, Artifact Guard, and related APIs. Our support contact for privacy requests is support@mytruetag.com.

We process account details (name, email, authentication data), organization and project information, support messages, billing records, and security logs. When you start an assessment, we may process repository files, uploaded archives, live-site responses, dependency manifests, configuration, and the evidence needed to explain a finding.

If you sign in with Google or Apple, we receive the provider subject identifier, verified email (when shared), and display name needed to create or link your account. We do not receive your provider password.

Do not submit source code, credentials, personal data, or applications that you are not authorized to assess. TrueTag redacts detected secrets from findings and model inputs, but you remain responsible for choosing an appropriate scan scope. References to “TrueTag” in this policy mean the product operated by JusticeBridge Technologies, Inc.

We use information to authenticate users, perform requested assessments, generate evidence-backed reports and document drafts, protect the service, prevent abuse, provide support, process payments, and improve rule accuracy. We do not use private customer source code to train general-purpose models.

Where the UK GDPR or EU GDPR applies, we rely on: (a) contract — to provide the service you request; (b) legitimate interests — to secure the platform, prevent abuse, and improve reliability in ways that do not override your rights; (c) consent — where required for optional features; and (d) legal obligation — where we must retain records or respond to lawful requests.

We do not sell personal information and do not share it for cross-context behavioral advertising. California residents may request to know, delete, or correct personal information, and may appeal a denied request by emailing support@mytruetag.com with “California privacy appeal” in the subject. We will not discriminate for exercising these rights. Categories we may process include identifiers, commercial information (subscription status), internet activity on our service, and professional information you provide about your product.

Where the Nigeria Data Protection Act applies, we process personal data for the stated purposes above, apply appropriate security measures, and honor rights of access, correction, deletion, and objection where applicable. Privacy complaints may also be directed to the Nigeria Data Protection Commission after contacting us.

When an AI explanation is enabled, TrueTag may send a minimized, redacted excerpt and scanner evidence to an AI provider (for example Groq or, when configured, OpenAI via a gateway). Deterministic scanners—not an AI model—remain the source of material findings. Hosting (Vercel), database (Supabase/Postgres), workers (Railway), email (Resend), payment, monitoring, source-control, and AI providers process data only for the service functions in which they are used. A current subprocessors list is available on request at support@mytruetag.com.

Service providers may process data in the United States and other countries. Where GDPR/UK GDPR requires a transfer mechanism, we rely on appropriate safeguards such as standard contractual clauses or the provider’s approved transfer tools, plus the contractual and technical controls described here.

Temporary scan workspaces are designed to be deleted after processing. Findings, reports, audit records, and user-approved legal drafts are retained while your account or applicable retention setting requires them. You may request access, correction, export, or deletion by contacting support@mytruetag.com. Some security, transaction, and legal records may be retained where reasonably necessary.

We use encryption, access controls, tenant boundaries, audit logging, isolated workers, secret redaction, and restricted internal access. No security control is infallible.

You may update account information, control optional integrations, disconnect repositories, and request privacy assistance. Depending on where you live, you may have additional rights to know, delete, correct, restrict, object, portability, or appeal. We will verify requests before acting on them.

TrueTag is intended for business and professional users and is not directed to children under 16. We may update this policy as the service changes; the effective date above identifies the current version. Material changes will be communicated through the service or by email where appropriate.

Privacy questions and requests: support@mytruetag.com.