Legal

Derive is operated by DERIVE LTD, a private limited company registered in England & Wales.

Company number: 17159546

Registered office: 26 Swanston Grove, Blyth NE24 3UY, United Kingdom

Contact: info@derive-ltd.co.uk

Data controller: DERIVE LTD (details above).

What we collect:

• If you sign in: your identifier from Google or GitHub OAuth (id, login, display name, avatar URL). We store this in a server-side session.
• Project access permissions you've been granted by an admin.
• If you subscribe to project notifications: your email address and your push subscription token.
• Cookies: a single first-party session cookie for authentication. No analytics or advertising cookies.

Why we collect it: to run the service (authentication, session continuity, autonomous SE harness operation), to deliver the notifications you opted in to, and to keep the project data you create. Lawful basis: legitimate interest (UK GDPR Article 6(1)(f)) and contract performance (Article 6(1)(b)) for authenticated users.

Retention: session cookies expire after 7 days (4 hours for the demo). Project data is kept for the lifetime of the project.

Sharing: we use Resend (resend.com, US) to deliver notifications, and Cloudflare for DNS / CDN. We don't share data with anyone else and we don't use any third-party analytics, ad networks, or trackers.

Your rights: you can request a copy of your data, ask us to delete it, or object to processing by emailing info@derive-ltd.co.uk. You can also complain to the UK ICO at ico.org.uk.

Derive is provided as-is, without warranty. DERIVE LTD makes no representations about the accuracy, completeness, or fitness for any particular purpose of the data shown or generated. Don't use it as the sole basis for safety-critical or regulatory decisions.

By using the service you agree not to attempt to break, scrape, overload, or otherwise abuse it. Account access is at the discretion of DERIVE LTD and may be revoked at any time.

These terms are governed by the laws of England & Wales.