Legal

Privacy

A structural draft: what the platform holds, where it goes, and for how long.

What this document will cover

1. Who we are: The controller, and how to reach us.
2. What we hold: Account and organisation records; the repositories, issues and documents you connect; the Artifacts, Gates, findings and Evidence a Task produces; usage records per Phase; and the audit trail of who approved, started and changed what.
3. Why we hold it: The lawful bases, stated per category rather than in one sentence.
4. Who else sees it: The subprocessors, including the model providers a Session calls through the control plane.

5. How long: Retention, per category. This is the section a buyer asks about first, and the honest state today is that retention is agreed per deployment rather than published as a product tier — the Enterprise page says so plainly.
6. Where it is processed: Regions, and any transfer mechanism relied on.
7. Your rights: Access, correction, deletion, objection, and how to exercise them.
8. Security: Summarised here and described mechanically on the enterprise page.
9. Changes and contact: How this notice changes and how you are told.

An issue body, a diff and a review comment reach a Session as Untrusted Content — data inside an explicit fence — and are recorded as evidence.
Commits and pull requests carry a per-run identity, so an action in your repository is attributable to a Task, a Session and the person who approved it.
The audit trail exists and is not optional; an override records its justification.
We do not have a product-tier zero-retention position. Ask, and you will be told what your deployment does.