Effective: 16 October 2026. Suhail is operated by dataloup, Abu Dhabi, United Arab Emirates. Questions or privacy requests: [email protected].
Suhail helps small app studios review supported security checks, coverage gaps and evidence for a fix. It needs access to the repositories and services you choose to connect. This policy explains that access and the records it creates during the private pilot.
What Suhail handles
Your account and workspace. Your email address, workspace membership and permissions, sign-in records, session information and connected-product identifiers. Where you use a password, we store its hash. For passkeys, we store the credential identifier, public key and related verification metadata; your private key and biometric information are not sent to Suhail. A shared Dataloup sign-in links your account to the product workspace you are permitted to open.
Connected repositories. Repository names, branches, commit identifiers, selected source and configuration files, dependency manifests and lockfiles. Files can contain names, email addresses, comments and other personal information supplied by your contributors. We process them to run supported checks and record the version checked. Connecting a repository does not mean every file or language is covered.
Connected services. Selected GitHub installation and repository details; Cloudflare account, Worker or Pages identifiers and available configuration metadata; and the credentials needed for the access you grant. Behaviour and recovery checks, where separately configured for a supported test integration, also use test-account credentials, requests, responses and diagnostic results. Use the agreed test accounts and synthetic records for pilot testing.
Findings and evidence. File paths, line numbers, rule identifiers, dependency names and versions, advisory details, coverage summaries, check results, timestamps, review decisions and notes. These records may reveal private business information even when they contain no source code. Secret-scanning results record the location and rule rather than the detected credential value.
Usage and support. Run counts, scanner execution measurements, plan and entitlement references, delivery records and the information you choose to send when asking for help. We also process connection information needed to operate and protect the service, including IP-derived rate-limit identifiers. Our hosting provider receives ordinary network request information.
Why we use it
We use this information to provide the checks you request, show their limits, verify access, prevent abuse, deliver enabled alerts, account for usage and investigate support requests. Workspace permissions govern who can see the results. Dataloup may access relevant records to operate the pilot or investigate a problem.
You decide which repositories and services to connect and must have permission to provide their contents. We handle that content to provide the configured service. We also manage account, security, support and administration records for our own operation of Suhail. Applicable privacy requirements depend on your location and the information involved; contact us before connecting material that needs a particular processing agreement or residency arrangement.
We do not sell personal information or use repository contents for advertising.
Services involved
- Cloudflare hosts Suhail’s application, database and scanner containers, and provides the configured email-delivery service. Selected source files are processed within this infrastructure.
- GitHub provides the repositories and installation information you authorise. Your own GitHub permissions and installation selection control the available access.
- OSV, the vulnerability advisory service, receives dependency package names, ecosystems and versions for supported advisory lookups. Those requests do not contain the full repository, but package details can themselves be sensitive.
- Telegram, if you connect alerts, receives your chosen chat destination and the alert content, which may include app or repository names and finding summaries. Disconnect it if you do not want these messages delivered there.
- Dataloup’s shared account and billing services exchange identity, workspace-access, plan and usage references needed to link the products. A bundle does not give NosyPup general access to your Suhail source or findings.
- Stripe processes payment and subscription information when paid billing is enabled. Public Suhail checkout is currently disabled. Card details entered into Stripe’s checkout are handled by Stripe; Dataloup uses billing identifiers and status records to manage access.
Information may be processed outside your country through these services. The pilot does not offer a verified single-country data-residency commitment. We may also disclose information where legally required or needed to investigate misuse of the service.
Source files, credentials and security
Source files are read for the selected checks. The Linux secret scanner uses temporary working files and removes its job directory when processing finishes, including handled failures. Saved findings and coverage records remain separately. This is not a promise that every provider log, backup or interrupted job disappears at the same moment.
Saved connection credentials are encrypted by the application. Credentials must still be available to the service while it performs the access you authorised. Revoke permissions in GitHub or Cloudflare if you need to stop that access immediately; disconnecting a service does not erase earlier findings.
We use access controls, encrypted connections and bounded checks to protect the service. No security tool can guarantee that an application or its data is safe. For a suspected disclosure, use the reporting instructions on Suhail support.
Cookies and sign-in
Suhail and the shared Dataloup account use essential cookies for sessions and sign-in verification. These are different from advertising cookies. Blocking them can prevent sign-in from working. Your device or password manager controls passkey storage and synchronisation.
The marketing website has its own Dataloup website privacy notice.
Retention and deletion
The current pilot has scheduled cleanup for:
- completed repository-check history, extended-review runs and audit entries older than 90 days;
- resolved monitoring incidents older than 90 days;
- accepted or delivered email records, completed Telegram delivery records and processed finding-notification events older than 30 days;
- Telegram update receipts older than 7 days, and expired temporary sign-in and connection-selection records.
These are cleanup rules in the application, not a guarantee of immediate removal from every backup or provider log. Pending deliveries and open incidents are treated separately.
Findings and finding reviews have no automatic deletion in this release. Account, workspace, connection, billing and commercial-usage records also do not all share one automatic expiry. Turning off a check, disconnecting an integration or cancelling a subscription is not the same as deleting those records.
Email [email protected] to request access, correction, an export or deletion. Tell us which workspace and information you mean. We may verify your identity and authority before changing shared-workspace records. Available in-product evidence exports contain selected results, not a complete personal-data export or a restorable backup.
We will explain the request’s scope and any records that must be retained for security, legal or billing reasons. We have not established a single verified deletion deadline covering all pilot records, backups and provider logs. We will not describe a request as completed before its scope has been checked.
Your choices and rights
You can choose what to connect, revoke provider access, turn optional alerts off, and contact us about your information. Depending on the law that applies, you may also have rights to access, correction, erasure, restriction, objection, portability, withdrawal of consent or a complaint to a data-protection authority. Contact us to exercise those rights or ask which processing basis applies to your request.
Suhail is a professional service for adult developers and studios; it is not intended for children.
Changes and contact
We will update this page and its effective date when the policy changes, and communicate material changes to affected pilot users through the available account contact channel.
[email protected] · dataloup, Abu Dhabi, United Arab Emirates.