Privacy policy
Last updated
This policy explains how Pullwise Ltd ("Pullwise", "we", "us") handles personal data when you visit pullwise.ai, use the chat assistant, contact us, or use the Pullwise service.
1. Who we are
Pullwise Ltd, [Registered address to be confirmed], is the controller of the personal data described in this policy, except where we process data on behalf of a customer (see section 4). Contact us about privacy at privacy@pullwise.ai.
2. What we collect
| Data | Where it comes from | Why | Legal basis |
|---|---|---|---|
| Name, email, password (hashed), workspace name, role | You, when you sign up or are invited | Create and run your account | Contract |
| Google profile (name, email) if you use Google sign-in | Sign you in | Contract | |
| Review records: repository, MR number, outcome, risk rating, review summary, token counts | The Service, from your connected platforms | Show review history and usage, bill for credits, support you | Contract |
| Billing records: credit purchases, balance, Stripe payment references | You and Stripe | Take payment, keep accounts | Contract; legal obligation |
| Contact form details: name, email, company, message | You | Reply to you | Consent; legitimate interests |
| Chat assistant messages | You | Answer your questions about Pullwise | Legitimate interests |
| Technical data: IP address, browser, pages requested, error logs | Your browser | Run, secure and fix the site and Service; limit abuse | Legitimate interests |
| Analytics (only if you accept analytics cookies) | Your browser | Understand how the site is used | Consent |
We do not sell personal data and we do not use it for automated decisions that have legal or similarly significant effects on you.
3. Source code and merge requests
To review a merge request we fetch its diff, title and description from your platform, mask common secret patterns, and send it to the AI model your workspace has chosen. We do not keep the diff after the review. Code can include personal data (for example, names in commit text); we process it only to produce the review. We do not use your code to train models.
4. When we act for our customers
For data inside a customer's workspace, such as member accounts and content from connected repositories, we act as a processor for the customer. The customer is the controller and their instructions, and our data processing terms, apply. If you are a member of a customer's workspace, please contact that customer about your data first.
5. Who we share data with
We use trusted service providers who process data for us under contract:
| Provider | Purpose | Location |
|---|---|---|
| Oracle Cloud Infrastructure | Hosting the Service | Europe |
| MongoDB Atlas | Database (settings, review records) | EU (Ireland) |
| Supabase | Database (accounts, billing) | UK (London) |
| Stripe | Payments | EU / US |
| Twilio SendGrid | Account emails | US |
| Optional sign-in | US | |
| AI model provider used by the chat assistant | Generating chat answers | US |
If your workspace uses its own AI provider (such as OpenAI, Anthropic or Google), review content is sent to that provider under your agreement with them.
We may also disclose data where required by law, or to protect our rights, users or the public.
6. International transfers
Where data is transferred outside the European Economic Area, we rely on an adequacy decision (such as the EU decision for the United Kingdom, or the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses, with additional safeguards where needed.
7. How long we keep data
- Account data: while your account is active, then deleted within 90 days of closure unless we must keep it longer.
- Review records: while the workspace is active, or until the workspace admin deletes them.
- Billing records: as long as tax and accounting law requires (usually up to 10 years).
- Contact messages: up to 2 years after our last exchange.
- Chat assistant: the conversation is kept in your browser tab only and cleared when you close it. Our servers keep messages briefly to answer them and in security logs for up to 30 days.
- Technical logs: up to 30 days.
8. Security
We protect data with encryption in transit, isolated workspaces, access controls and secret masking. See our security page for details.
9. Your rights
Under the GDPR you can ask to access, correct, delete, restrict or port your personal data, and object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time, for example through . Email privacy@pullwise.ai and we will respond within one month.
You also have the right to complain to a data protection authority. Our lead authority is the Information and Data Protection Commissioner (IDPC), Malta, but you can contact the authority where you live or work.
10. Children
Pullwise is a business service and is not intended for anyone under 18.
11. Changes
We will post any changes here and update the date above. For significant changes we will also tell account holders by email.