Data controller
I SEE U, a SARL (French limited liability company) with share capital of €200,000, RCS Perpignan 517 980 165, 3 rue Camille Desmoulins, 66000 Perpignan. Contact for any question about your data: bonjour@isee-u.fr.
Trust · Legal
Privacy policy
What personal data LibWatch processes, why, for how long, with whom, and how to exercise your rights.
This English translation is provided for convenience only. The French version is the only legally binding one and prevails in case of any discrepancy: read it in French.
- Controller:
- I SEE U
- Contact:
- bonjour@isee-u.fr
- Last updated:
- October 23, 2026
- Hosted in France by OVHcloud
- No sale of data, no advertising
- Your code is never sent to public databases
- Analytics only with your consent
Data processed
What we process, and for how long
Each row gives the purpose of the processing and its legal basis under the GDPR.
| Data | What it is | Why · legal basis | Retention |
|---|---|---|---|
| Account | First name, last name, email, password (hashed), profile picture, language, time zone, notification settings, two-factor authentication secret | Providing the service · contract | As long as the account exists |
| Third-party sign-in | Identifier and email sent by GitHub, GitLab, Google, Microsoft or your company's SSO | Signing you in · contract | As long as the account exists |
| Organization and billing | Organization name, members, roles, plan, invoices. The card number stays with Stripe | Invoicing · legal obligation | As long as the organization exists; invoices: 10 years (French Commercial Code) |
| Projects | Monitored repositories, access tokens (encrypted), dependency inventory, analysis results. May contain the names of commit authors | Providing the service · contract | As long as the organization exists |
| composer.json checker | Email, list of packages and declared PHP version. The email and a summary of the request (file name, PHP version, number of packages, follow-up requested or not, origin of the visit), never the list of packages, are also recorded in Chatwoot, the team's contact management tool, hosted by I SEE U in France (desk.isee-u.fr), so that we can contact you again | Sending you the report, then the 14-day follow-up if you tick the box · consent | Packages: 14 days. Email: 14 days, or until you unsubscribe if you tick the box. In Chatwoot: To be defined |
| CVE newsletter | Email, IP address and sign-up date, to prove your consent. The email and a summary of the sign-up are also recorded in Chatwoot, the team's contact management tool, hosted by I SEE U in France (desk.isee-u.fr), so that we can contact you again | Keeping you informed · consent | Until you unsubscribe. In Chatwoot: To be defined |
| Analytics | Page views, events and Google Analytics cookie identifier, only if you accept it | Improving the website · consent | Cookies: 13 months at most. Statistics: 14 months |
| Security | Log of sensitive actions (sign-ins, permissions, administration) with the originating IP address | Protecting the service · legitimate interest | To be defined |
| Technical errors | Error report, which may contain your account identifier | Fixing errors · legitimate interest | To be defined |
Invitations not accepted: deleted 30 days after they expire. Exports of your data: deleted 7 days after they are created. Cookies are detailed on the Cookies page.
When we act as a processor
For the data that a customer organization entrusts to LibWatch (its team members, the recipients of its alerts), I SEE U acts as a processor on behalf of that organization, which remains the data controller.
Recipients
Your data is accessible to the I SEE U team that operates the service, and to a few service providers, each for its own task. The list, with what each one sees and where, is on the Subprocessors page.
Depending on what you connect, data also passes through GitHub, GitLab, Google, Microsoft or your company's identity provider (sign-in), and through Slack, Zulip or your webhooks (alerts). Public vulnerability databases receive only package names and versions, never any personal data (see Data sources).
Transfers outside the European Union
The data is hosted in France. Stripe, Google Analytics (if you accept it) and the sign-in or alert services you choose may transfer some data to the United States; these transfers are governed by the EU–U.S. Data Privacy Framework or by the European Commission's standard contractual clauses.
Security
Connections are encrypted (HTTPS), passwords are hashed, and access tokens and secrets are encrypted in the database. Two-factor authentication is available to everyone and mandatory for administrator accounts.
The public website's forms are protected by a self-hosted captcha (ALTCHA): your browser solves a small calculation, without cookies and without going through a third-party service.
What we do not do
- Sell or rent out your data.
- Advertise, or track you on other websites.
- Make automated decisions that produce legal effects concerning you.
Your rights
What you can do, and where
Access, rectification, erasure, restriction of processing, portability, objection, and instructions regarding your data after your death.
-
Open my profile →
Update your information
Name, email, photo, language, notifications: you can change all of it from your profile.
-
Export my data →
Export your data
A file of your personal data, to download. It is deleted 7 days after it is created.
-
Delete my account →
Delete your account
From your profile. Your account data goes with it; only invoices remain, for 10 years, as required by law.
-
Unsubscribe
Newsletter and composer.json checker follow-up: every email contains an unsubscribe link.
-
bonjour@isee-u.fr →
Any other request
Write to us: we reply within one month.
-
cnil.fr/plaintes →
Complaint
If you believe that your rights are not being respected, you can lodge a complaint with the CNIL (the French data protection authority).