Privacy Policy
We understand that your source code is your organization's most valuable intellectual property. This Privacy Policy details our strict code protection architecture, data isolation protocols, and zero AI model training guarantees.
Effective Date: March 2026 • Last Updated: March 2026 • Version 1.2
Your private source code, pull request comments, and AST chunks are never used to train, retrain, or fine-tune public or private LLMs.
Semantic embeddings created for repo context are strictly partitioned into dedicated Pinecone namespaces per repository with TLS 1.3 encryption.
Git diffs and AST nodes are loaded in-memory strictly for review analysis and are purged once feedback comments are posted.
Billing is handled exclusively via Razorpay (PCI-DSS Level 1 compliant). We never see or store your credit card, debit card, or UPI banking PINs.
01.Introduction & Commitment
Code Review Engine ("we", "us", or "our") provides an automated, AI-driven code review platform that integrates directly into your GitHub workflow. We recognize the paramount importance of safeguarding your intellectual property and source code.
This Privacy Policy outlines how we collect, process, manage, and safeguard information when you use our website, dashboard, and automated GitHub app review services. By connecting your GitHub account or repository, you agree to the data practices described in this document.
02.Information We Collect
We collect only the minimal information required to authenticate you, connect to your GitHub repositories, process pull requests, and manage subscriptions:
A. Authentication & Account Information
When you sign in via GitHub OAuth, we obtain your GitHub user ID, GitHub username, primary email address, display name, and avatar URL. We do not obtain or store your GitHub password or personal personal access tokens.
B. GitHub Installation & Repository Metadata
When you install our GitHub App, we receive an Installation ID and repository identifiers that you explicitly grant access to. We store metadata such as repository names, branch names, and pull request numbers.
C. Pull Request Diffs & Code Snippets
When a pull request is opened or updated, GitHub delivers webhook events containing changed git diffs. We parse these diffs and AST structures in ephemeral runtime memory to generate review comments.
D. Payment & Billing Identifiers
Transactions are processed by Razorpay. We only store payment reference identifiers (such as razorpaySubscriptionId, subscription status, and renewal dates). We never store payment card numbers, CVVs, or bank credentials.
03.How We Process Your Code & Vector RAG Pipeline
To provide contextual, high-accuracy reviews that understand project-wide abstractions, our engine utilizes a Retrieval-Augmented Generation (RAG) pipeline:
- Abstract Syntax Tree (AST) Parsing: When indexing a repository, files are parsed into semantic structural chunks (functions, classes, exports, and interfaces) rather than naive raw text splits.
- Vector Embeddings: AST chunks are converted into numerical high-dimensional vector representations.
- Pinecone Namespace Segregation: Vectors are stored in Pinecone with strict namespace isolation. Each repository has its own isolated namespace. No other customer or project can ever query or access your repository vectors.
- In-Memory Prompt Construction: When a PR webhook triggers, only the relevant AST vector matches and PR diffs are passed to the language model inference endpoint in temporary execution memory.
04.Strict Zero AI Model Training Guarantee
We state unequivocally: We do not use customer source code, pull request contents, code reviews, comments, or repository vector data to train, fine-tune, optimize, or evaluate any artificial intelligence or machine learning models.
Our LLM inference endpoints (via Google Gemini Enterprise API and OpenAI APIs) operate under strict commercial zero-data-retention agreements where API inputs and outputs are not retained or utilized for model training by the foundational providers.
05.Third-Party Processors & Infrastructure
We partner with enterprise-grade cloud infrastructure providers to operate the platform. Each processor is contractually bound to maintain strict security standards:
06.Data Retention, Disconnection & Deletion
- Repository Disconnect: If you uninstall our GitHub App or disconnect a repository from your dashboard, automated reviews halt immediately. You can trigger an automated deletion of all associated Pinecone vector embeddings for that repository.
- Account Deletion: You may request complete account deletion at any time by contacting our support team. We will permanently purge your user profile, repository connections, and review logs from our databases within 30 days.
- Billing Records: Limited transactional logs (invoices and Razorpay subscription IDs) are retained for 7 years in accordance with applicable tax and statutory accounting regulations.
07.Security Controls & Cryptography
We employ defense-in-depth technical measures to defend customer data:
- End-to-end TLS 1.3 encryption for all data in transit across internal microservices and external webhooks.
- Cryptographic HMAC signature verification on every incoming GitHub and Razorpay webhook payload to prevent spoofing.
- Database connection pooling with encrypted credentials and strict principle-of-least-privilege access.
- Automated security scanning and vulnerability patching in our CI/CD deployment pipelines.
08.Refund Policy & Subscription Billing Reference
For complete terms regarding subscription fees, recurring monthly billing, payment methods, our strict no-refund policy, and grace period cancellations, please review our companion Cancellation & Refund Policy.
09.Contact Information
If you have questions, concerns, or data deletion requests regarding this Privacy Policy or our security practices, please contact our team: