userbugs.ai. Privacy Policy

Data Controller

Cicure ApS (under formation)
Copenhagen, Denmark
legal@userbugs.ai

This policy applies to the userbugs.ai beta platform.

What We Collect

Account and waitlist data

If you sign up for the waitlist or create a beta account, we collect your email address. That’s it. We don’t ask for your name, company, or any other personal information unless you volunteer it.

Usage analytics

We currently collect no usage analytics. No page view tracking, no session recording, no heatmaps. This may change in future: if it does, we’ll update this policy and notify you.

What we explicitly do NOT collect

• No tracking pixels
• No third-party analytics (no Google Analytics, Mixpanel, Amplitude, etc.)
• No ad network integrations
• No fingerprinting

Bug Report Data

The bug reports on userbugs.ai are aggregated from publicly available sources: public forums, community discussion sites, review pages, and public issue trackers. The specific sources we draw on and how we discover them are proprietary.

Our current pipeline does not persist source-page text or supporting quotations. Our pipeline processes source content through AI and stores only structured, AI-synthesised bug metadata: title, severity, affected version, category, and similar fields. This is a deliberate architectural decision, not an oversight.

What we hold are synthesised reports of user-reported problems with products, including hardware: not copies of what people wrote. A report records that people reported a problem and how well that is supported. Support is not proof that a reported problem is real or accurately described. Holding synthesised reports rather than source copies limits how much third-party expression, and how much personal data, we keep. It is a data-minimisation measure and not a legal exemption: it does not by itself place what we do hold outside copyright, database-right or data-protection law, and it does not reduce the rights described below.

Legacy source text was removed from live records. Earlier versions retained supporting quotations with some findings and a small number of source-text records in our evidence store. Our controlled reconciliation on 2026-09-08 removed that legacy text from our live report and evidence records. It preserved our synthesised reports, source references and provenance hashes. Historical backups and copies held by external services were outside its scope.

To substantiate that a defect was genuinely reported and independently corroborated, we may keep a provenance record for a source: a one-way content fingerprint (a hash) of the text we extracted from the page, its length, the public source URL we cite, and the date we accessed it: but not the source text itself. A hash is a one-way check value. It cannot reconstruct the page, and it is not evidence that what the page said was true. Comparing it requires obtaining the same text again, from the source or from an archive: on its own, a hash lets nobody reconstruct a vanished source or check it independently.

These fingerprints are not interchangeable, and we do not present one as another: the fingerprint of the text we originally extracted, a digest of a raw payload held by a web archive, and the versions of our own synthesised report each cover different material. Our synthesised reports, your submissions and vendor statements are a separate category and are not deleted by the removal described above, which concerns externally collected source text only. That is not a promise of unconditional retention: they remain subject to correction, to withdrawal, and to your erasure and takedown rights.

We may also ask a public web archive (the Internet Archive) to snapshot the cited public page, so that an independent third party also holds a dated copy. A request is not a guarantee: the archive may decline it, it may fail, or a capture may later be removed, and we do not claim a snapshot exists unless we have confirmed the capture itself. Where we publish a timestamp anchored to the Bitcoin blockchain, a submitted but unconfirmed timestamp is not a confirmed one.

A provenance record is deliberately small, but it is not anonymous: a public source URL can identify a person on its own, for instance where it points to a post published under their name. Keeping only metadata is therefore not an exemption from erasure or takedown. You can ask us to remove the provenance record for any specific source URL.

User Submissions

If you submit a bug report through the platform:

• Unauthenticated / anonymous: the submission is stored with user_id: null. We have no way to link it to you.
• Authenticated: the submission is linked to your account. You can request anonymisation at any time: we’ll set user_id to null, removing the attribution. The bug data itself is preserved (it’s a public interest record), but it will no longer be associated with your account.

Cookies

We use a single session cookie:

• Purpose: keeping you logged in
• Type: HttpOnly, SameSite=Lax
• TTL: 30 days
• Third-party cookies: none

No tracking cookies. No consent banner needed for the session cookie under Danish/EU law, but we’re telling you anyway.

Legal Basis (GDPR Art. 6)

Data Processors (GDPR Art. 28)

We use a limited number of sub-processors. Each is listed below with the legal name, purpose, data processed, and a link to their Data Processing Agreement (DPA) or equivalent.

Note on Google Cloud: Cicure’s Google Cloud DPA was accepted at the time the GCP account was created. The DPA is Google’s standard Data Processing Amendment and covers all GCP services, including Vertex AI.

All processors listed above are contractually bound to Cicure under GDPR Art. 28 Data Processing Agreements. Where a processor transfers data outside the EU/EEA, they rely on Standard Contractual Clauses (SCCs) or an adequacy decision as the legal transfer mechanism.

If you have questions about a specific sub-processor, contact legal@userbugs.ai.

Data Storage and Transfers

All data is stored in our Elasticsearch cluster hosted on Azure Germany West Central (Frankfurt region). This is an EU data centre. We do not transfer personal data outside the EU/EEA.

Data Retention

Your Rights (GDPR Art. 15–22)

You have the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: correct inaccurate data
• Erasure: request deletion of your account and personal data
• Portability: receive your data in a machine-readable format
• Restriction: ask us to limit processing while a dispute is resolved
• Object: object to processing based on legitimate interests

To exercise any of these rights, email legal@userbugs.ai. We’ll respond within 30 days (the GDPR maximum).

If you’re not satisfied with our response, you have the right to lodge a complaint with Datatilsynet (the Danish Data Protection Authority): datatilsynet.dk

Changes to This Policy

We’ll notify beta users by email if we make material changes. The “last updated” date at the top will always reflect the current version.

Questions

Email legal@userbugs.ai. We’re a small team and we take this seriously. See also our Beta Terms of Service.