Privacy Policy

1. Information we collect

We collect the following categories of information:

• Account information. When you sign up we and our authentication provider (Clerk) collect your name, email address, and authentication identifiers. Passwords are managed by our authentication provider and are never stored by us in plaintext.
• Repository and integration data. If you connect a GitHub account or install our GitHub App, we receive metadata about the repositories, pull requests, commits, and checks you authorize us to access, in order to run quality checks.
• Content you submit. URLs, target environments, test descriptions, and any other input you provide so our agents can evaluate your application.
• Pilot applications. If you apply for a pilot, we collect your name, work email, company, website, the flow you want to protect, and first-party campaign attribution so we can evaluate and respond to your application.
• Run artifacts. Screenshots, rendered DOM snapshots, console and network logs, and the verdicts and reports our agents generate while evaluating the pages you submit.
• Usage and device data. Log data such as IP address, browser type, pages viewed, and timestamps, collected automatically to operate and secure the Service.
• Cookies. We and our providers use essential cookies for authentication and session management. We do not use advertising cookies.

2. How we use information

• To provide, operate, and maintain the Service, including running checks and returning verdicts.
• To authenticate you, secure your account, and prevent abuse or fraud.
• To communicate with you about your account, runs, and important Service changes.
• To review, attribute, and respond to founding-team pilot applications.
• To monitor, debug, and improve the Service, including model and agent quality.
• To comply with legal obligations and enforce our Terms and Conditions.

3. Service providers and subprocessors

We rely on trusted third parties to run the Service. These providers process data on our behalf under their own terms and security commitments:

• Authentication - Clerk (identity and session management).
• Source control - GitHub (repository and pull request integration).
• AI / LLM providers - the model provider configured for your workspace processes the page content and prompts needed to produce verdicts.
• Object storage - Cloudflare R2 stores screenshots and run artifacts.
• Hosting - our cloud hosting provider runs the application and databases.
• Optional - error monitoring and transactional email providers, where enabled.

4. How we share information

We do not sell your personal information. We share information only with the service providers above, with other members of your workspace as part of normal collaboration, when required by law or valid legal process, or in connection with a merger, acquisition, or sale of assets (with notice where required).

5. Data retention

We retain account information for as long as your account is active. Run artifacts such as screenshots and logs are retained for the life of the project they belong to: deleting a project deletes its artifacts, including the stored screenshots, and we will also delete them on request. We do not currently expire artifacts on a fixed schedule. We may retain certain records longer where necessary to comply with legal obligations or resolve disputes.

6. Security

We use industry-standard safeguards including encryption in transit, scoped credentials, and least-privilege isolation of the browser agent that loads third-party pages. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. See our Security page for more detail.

7. Your rights and choices

Depending on your location, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can manage much of your account data directly in the app, or contact us at the address below to exercise these rights. We will respond consistent with applicable law.

8. International transfers

We and our providers may process and store information in countries other than where you live. Where we transfer personal information across borders, we take steps to ensure it receives an adequate level of protection as required by applicable law.

9. Children's privacy

The Service is not directed to individuals under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the Service.

11. Contact us

Questions about this Privacy Policy or your data? Email us at [email protected].