Notifications + privacy — what leaves the platform and how to control it

For: all
Tier: free+
Time: ~5 min

Why you'd do this

Compliance tooling that itself has loose data hygiene is a hard sell. ComplianceLint deliberately minimises data egress and gives every user explicit control over the categories that DO leave: error stack traces (Sentry), transactional vs marketing email. This chapter is the consolidated reference so privacy reviews don't require reading the full Privacy Policy to find the toggles.

Before you start

Awareness that some opt-outs degrade product capability (e.g. disabling Sentry means no automated error reporting; bug fixes depend on you reproducing manually)

Step 1

There is no cookie banner: ComplianceLint sets no analytics or advertising cookies and uses no third-party analytics service. The cookies and browser storage it does use are needed for signing in, security (CSRF protection), a setting you choose (the collapsed sidebar) or a privacy choice you make (the error-reporting opt-out). The full list is in the Privacy Policy, section 4.1.

Step 2

Page views are counted on our own server: for each full page load, the date and the page (its route, with identifiers such as repository IDs removed) — nothing else. No visitor or account identifier, no unique visitors, no IP address or browser information in the statistics. Counts are kept for 24 months.

If you object under Art. 21 GDPR (Settings → "Object to legitimate-interest processing"), your page loads while signed in are no longer counted.

Step 3

Sentry collects unhandled errors / stack traces from the browser + server. Source code paths and error messages can contain incidentally-PII data (e.g. a user's email in a URL). We:

Use Sentry's beforeSend hook to scrub email + IP from each event before transmission
Filter known PII fields by name (email, phone, ssn, api_key, etc.)
Drop anything from a URL containing a UUID-like token

Opt-out — Privacy Policy, section 4, "Error tracking" → "Disable error reporting in this browser". Errors from this browser are not sent to Sentry. Caveat: bug fixes that would have benefited from auto-collected stack traces require you to reproduce + manually report.

Step 4

Three email categories with different opt-out treatments:

Transactional — sign-in magic links, scan completion notifications, billing receipts. Cannot be opted out (the platform stops working without sign-in emails). Sender: noreply@compliancelint.dev.

Critical operational — unauthorized API key use, subscription past-due, account locked. Default ON; opt out via Settings → Email preferences. We strongly recommend keeping these on; opt-out flows are a frequent root cause for missed lockouts.

Marketing / product news — release notes, feature announcements. Default OFF (we don't believe in default-on marketing). Opt-in is explicit on the Settings page.

Every email carries a one-click unsubscribe in the footer (transactional excepted; those say "this notification cannot be turned off").

Step 5

Data residency — primary database + evidence storage in the EU (Germany, Hetzner). Sentry in the EU (Ireland). LemonSqueezy billing in the US (subprocess; covered by SCCs).

GDPR Article 15 (right of access) — Settings → Danger Zone → Request data export. See Settings - account.

GDPR Article 17 (right of erasure) — Settings → Danger Zone → Delete account → Hard delete option.

GDPR Article 20 (data portability) — same data export, structured JSON. See readme inside the export bundle for schema notes.

GDPR Article 21 (right to object) — Settings → "Object to legitimate-interest processing", or email info@compliancelint.com with the specific purpose; we respond within one month per Article 12(3).

What can go wrong

I opted out of Sentry but errors still mention me by name in support tickets — Two possibilities: (1) the error was captured before your opt-out — historical Sentry data isn't retroactively scrubbed, but it auto-purges after 90 days. (2) Support staff have direct DB access for tickets you filed; that's not Sentry, that's the support workflow. Email privacy@compliancelint.dev to request name redaction in the ticket itself.
Data export bundle doesn't contain my LemonSqueezy invoices — Billing data lives in LemonSqueezy's system, not ours — we store only the subscription state (active / past_due / canceled) plus their customer id. Invoice PDFs are downloadable from the LemonSqueezy customer portal (linked from Settings → Billing). For data-portability purposes, both bundles together constitute the complete record.

Last updated: 2026-10-29

Notifications + privacy — what leaves the platform and how to control it

For: all
Tier: free+
Time: ~5 min

Why you'd do this

Before you start

Awareness that some opt-outs degrade product capability (e.g. disabling Sentry means no automated error reporting; bug fixes depend on you reproducing manually)

Step 1

Step 2

If you object under Art. 21 GDPR (Settings → "Object to legitimate-interest processing"), your page loads while signed in are no longer counted.

Step 3

Sentry collects unhandled errors / stack traces from the browser + server. Source code paths and error messages can contain incidentally-PII data (e.g. a user's email in a URL). We:

Use Sentry's beforeSend hook to scrub email + IP from each event before transmission
Filter known PII fields by name (email, phone, ssn, api_key, etc.)
Drop anything from a URL containing a UUID-like token

Step 4

Three email categories with different opt-out treatments:

Marketing / product news — release notes, feature announcements. Default OFF (we don't believe in default-on marketing). Opt-in is explicit on the Settings page.

Every email carries a one-click unsubscribe in the footer (transactional excepted; those say "this notification cannot be turned off").

Step 5

Data residency — primary database + evidence storage in the EU (Germany, Hetzner). Sentry in the EU (Ireland). LemonSqueezy billing in the US (subprocess; covered by SCCs).

GDPR Article 15 (right of access) — Settings → Danger Zone → Request data export. See Settings - account.

GDPR Article 17 (right of erasure) — Settings → Danger Zone → Delete account → Hard delete option.

GDPR Article 20 (data portability) — same data export, structured JSON. See readme inside the export bundle for schema notes.

What can go wrong

I opted out of Sentry but errors still mention me by name in support tickets — Two possibilities: (1) the error was captured before your opt-out — historical Sentry data isn't retroactively scrubbed, but it auto-purges after 90 days. (2) Support staff have direct DB access for tickets you filed; that's not Sentry, that's the support workflow. Email privacy@compliancelint.dev to request name redaction in the ticket itself.
Data export bundle doesn't contain my LemonSqueezy invoices — Billing data lives in LemonSqueezy's system, not ours — we store only the subscription state (active / past_due / canceled) plus their customer id. Invoice PDFs are downloadable from the LemonSqueezy customer portal (linked from Settings → Billing). For data-portability purposes, both bundles together constitute the complete record.

Last updated: 2026-10-29

Notifications + privacy — what leaves the platform and how to control it

Why you'd do this

Before you start

Step 1

Step 2

Step 3

Step 4

Step 5

What can go wrong

Related

Notifications + privacy — what leaves the platform and how to control it

Why you'd do this

Before you start

Step 1

Step 2

Step 3

Step 4

Step 5

What can go wrong

Related