Privacy policy

This policy covers the people who use MergeReady: those who make an account, sign in, belong to an organization in it, or join the waitlist on this site. The code and data in a customer's repositories, including the names and comments of the people who work on them, are processed on that customer's behalf under the data-processing terms.

1. Who is responsible

[To be supplied by the owner: the legal name of the company that provides MergeReady], [To be supplied by the owner: its registered address], is responsible for this data. Write to hello@mergeready.ai about it.

2. What we collect, and why

Data	Why
Your name and email address; your password, stored only as a hash	Your account, and signing you in
The version of these terms, the terms of service and the data-processing terms you accepted, and when	A record of what you agreed to
Each session's sign-in time, expiry, IP address and browser	Keeping you signed in, and the security of your account. A session ends 14 days after sign-in
The accounts you link (GitHub, GitLab, Bitbucket, Slack): the account's id, and its sign-in tokens, encrypted	Signing you in with them, and checking your access to a repository before MergeReady acts on your answer or your pause
Failed sign-ins and second-factor answers, counted per account	Stopping someone from guessing your password or code
Your organizations, your role in each, and the invitations you sent or received	Who may see and change what
The audit log: who made each change, paused or answered the agent, and when	Your organization's record of what was done in its name
On the waitlist: your email address, your code host, and, if you give them, a number of repositories and a note	Writing to you once, when MergeReady is generally available on your host

When you choose a password, its strength is checked against Have I Been Pwned's list of breached passwords: that check sends the first five characters of the password's SHA-1 hash, and nothing that names you.

The site and the app set only the cookies that signing in needs. Neither runs analytics or advertising.

3. Who receives it

We do not sell personal data. It reaches the providers that run the service for us, each only for what it is listed for in the sub-processor list: Amazon Web Services hosts the service and its database in the United States (us-east-1), and Amazon SES sends the mail (account verification, password reset, invitations, the waitlist's one confirmation). The sign-in provider you choose sees that you signed in with it.

4. How long we keep it

• Your account, its linked accounts and its record of accepted terms: while the account exists. There is no button to delete a personal account yet: to have yours deleted, write to hello@mergeready.ai.
• Sessions: until they end, at most 14 days after sign-in.
• Your membership and the audit log: for the life of your organization's data. Deleting the organization erases them; your personal account is not part of that erasure.
• The waitlist: at most a year.
• The service's logs and error reports, which can refer to your organization and the requests made in it: 30 days, also after the data they mention is deleted.
• Backups: the service's host is backed up as a snapshot of its whole disk every 4 hours, and the 42 newest snapshots are kept, so a copy of data that was deleted remains in them for at most 7 days.

5. Your rights

You can ask to see the personal data we hold about you, to have it corrected or deleted, or to receive it in a common format, and you can object to how we use it. Write to hello@mergeready.ai. You can also complain to your data-protection authority.

6. Security

Each organization's data is separated from every other's in the database. Sign-in tokens are encrypted. Credentials you give MergeReady (a model key, a registry's credentials, an integration's token) are sealed and never shown again. The data-processing terms list the measures in full.

7. Changes

A new version of this policy gets a new version number and the date it applies from, and is published on this page before it applies.