Privacy Policy
Last updated: September 22, 2026
1. Data We Collect
We may collect your GitHub identifier, username, and email; repository, organization, and pull request data; metadata such as titles, authors, branches, and commits; and the diffs needed to run inference. Stripe processes payment data, and we do not store complete card data on our servers.
2. Legal Bases
Processing complies with the LGPD, especially Article 7, and may be based on performance of the contract to provide reviews and billing; legitimate interest for security, abuse prevention, and service improvement; and consent when requested for a specific purpose.
3. Purposes
We use the data to authenticate accounts, authorize organizations, process pull requests, generate and deliver reviews, manage credits and subscriptions, prevent fraud, respond to requests, measure performance, and maintain platform security and availability.
4. Sharing and Subprocessors
To operate the service, we may share only the data strictly necessary with Google Cloud for infrastructure and inference, Stripe for payments, GitHub for authentication and repository integration, and Anthropic when the selected model uses that provider. These vendors must apply safeguards appropriate to their roles.
5. Retention
We retain data for as long as needed to provide the service, meet legal obligations, resolve disputes, and exercise rights. Diffs and results may be removed or anonymized when no longer needed, subject to legal retention periods and minimum security and billing records. Raw diagnostic material for each review (the complete output and model reasoning) is retained for up to 30 days and then automatically deleted; execution metadata (model, cost, tokens, and status) remains as an audit record. Product usage events, such as installation, review completion, and checkout, are retained by default for up to 365 days and then automatically deleted. These events contain only predefined categories and counts, with no code text or complete payment data.
6. Data Subject Rights
Under Article 18 of the LGPD, you may request confirmation and access, correction, anonymization, blocking or deletion, portability, information about data sharing, and withdrawal of consent, where applicable. To exercise your rights or contact the data protection officer, email [email protected].
7. Cookies
We use an HttpOnly session cookie to maintain your dashboard login. During GitHub login, we also use a temporary OAuth state cookie with a limited duration to help prevent request forgery attacks. These cookies are necessary for authentication and are not used for behavioral advertising. A temporary cookie, lasting up to one hour, records which installation button on the home page was used. It is removed on the first dashboard visit after installation.
8. International Transfers
GitHub, Google Cloud, Stripe, and Anthropic may process data outside Brazil. In those cases, we will adopt the safeguards and legal bases provided for international transfers under the LGPD and select vendors that offer appropriate protection guarantees.
9. Security and Changes
We apply technical and organizational controls appropriate to the nature of the data, but no internet-connected service is entirely risk-free. This policy may be changed to reflect new features, vendors, or legal requirements. The date at the top indicates the currently published version.