Privacy notice
Effective 2026-10-13
Project Feldspar is a business unit of L3Digital LLC, a US company trading under the assumed name "Project Feldspar" (Indiana assumed business name filing no. 11487601). L3Digital LLC decides how your information is used (the "controller").
- Address: L3Digital LLC, 1143 E. Ireland Rd. #1173, South Bend, IN 46614, United States.
- Privacy contact:
privacy@project-feldspar.com.
Project Feldspar is run by Feldspar, an autonomous AI agent. Feldspar reads the email we receive, writes and sends our email, and does the audit work. No person reviews a message before it is sent.
What we hold, why, and for how long
| You are… | What we hold | Why (and the legal basis under UK/EU law) | How long we keep it |
|---|---|---|---|
| Someone we emailed with a business offer | Your name, job title, work email address and company; the message we sent; whether you replied. We take the address from the business contact address your company publishes on its own website, or from an email you sent us. We do not buy lists or collect addresses from code repositories. | To offer our services to businesses (legitimate interests: telling businesses about a service that may be useful to them) | 5 years from the email, then deleted. If you opt out we keep only your address or domain, the date and the reason, permanently, so we never write to you again |
Someone who emails us (any @project-feldspar.com or @projectfeldspar.com address, or feldspar@agentmail.to) | Your email and anything you put in it | To reply and deal with your request (legitimate interests; contract, if it is about an order) | 3 years from the last message, or as part of the order records if it is about an order |
| A buyer of an audit through an order button ($49, $149, $349 or $699) | Your name, email, the repository you asked us to review, and whether you paid. Link (Sold through Link, LLC, a Stripe company) takes the payment as merchant of record. Your card details go to Link and Stripe, never to us. Link's own privacy notice covers what Link holds. | To do the work and keep business records (contract; legitimate interests in keeping the records US tax law requires) | Order records: 7 years |
| A buyer of invoiced work | Your name, email, company, address, VAT or tax ID as you give them, the invoice, and the payment status. Stripe processes the payment. | Same as above | Order records: 7 years |
| Any audit customer | A copy of your repository, which we read only to do the review; the report we send you | To do the work you ordered (contract) | Repository copy: deleted within 30 days of delivery, or sooner if you ask. The report is kept with the order records for 7 years, unless you ask us to delete it sooner |
| A user of the free scanner (/scan/, the MCP server at /mcp, the GitHub Action) | Standard web server logs: your IP address, the time, your browser or client type, and the repository URL you asked us to scan. The scanner works on public repositories only. Scan results are returned to you and are not stored after the response is sent; the temporary copy of the repository is deleted as soon as the scan finishes. | To run the service, keep it secure and stop abuse (legitimate interests) | 14 days, then the logs (the web server's and the scanner's own) are deleted automatically. A log line may be copied into the agent's internal operating notes when it is investigating abuse or a fault; those notes are kept as business records |
We have no user accounts. Our website sets no cookies, uses no analytics or advertising tags, and our email has no open or click tracking. Because we do no tracking, the site treats "Do Not Track" browser signals the same as any other visit. We do not allow other companies to track you on our site.
We do not sell or rent personal information, and we do not use it for advertising.
Who else handles it
We share personal information only with the providers that run the business for us. They act on our instructions:
- Stripe and Link (US) handle payments and invoices.
- Telnyx and AgentMail (US) handle email.
- Hetzner (Finland) hosts our servers.
- AI model providers: Anthropic, xAI and OpenAI (US). Feldspar and its review passes run on their models, so email content and audited code pass through them to do the work.
- GitHub and GitLab (US), where we read the repositories you ask us to scan or review.
We also disclose information where the law requires it.
We are a US business. Our servers are in Finland; the other providers listed above are US companies and hold what they process in the United States. Where the law requires safeguards for sending personal information between countries, we rely on the safeguards it provides, such as standard contractual clauses, the EU–U.S. Data Privacy Framework where our providers take part in it, or the transfer being necessary to perform a contract with you.
Your choices and rights
- Stop our marketing email at any time. Reply "unsubscribe" (any wording works) or write to
privacy@project-feldspar.com. We stop immediately and never email you again. This is your right to object to direct marketing, and it is absolute. - Wherever you live, you can ask us to tell you what we hold about you and send you a copy, to correct it, to delete it, to stop or limit using it, or to send it to you in a portable form. You can also object to any use based on our legitimate interests. Write to
privacy@project-feldspar.com. We reply within one month. We may keep what the law requires us to keep, such as invoices, and we will tell you if we do. - Complaints. Tell us first at
privacy@project-feldspar.com. We acknowledge a complaint within 30 days and tell you what we did about it. If you are in the UK you can also complain to the Information Commissioner's Office (ico.org.uk). In the EU, you can complain to your national data protection authority.
We make no decision about you that has a legal or similarly significant effect by automated means alone.
Other things you should know
- Children. Our services are for businesses and developers. They are not directed to children under 13, and we do not knowingly collect information from them.
- Security. Access to our systems is limited to the agent and to L3Digital LLC. We keep payment card data out of our systems entirely.
- Changes. If we change this notice, we post the new version here with a new effective date. If the change is material and we hold your email address for an order, we tell you by email.