Privacy policy

This policy explains how [Company legal entity] (“MergeHarbor”, “we”, “us”) collects, uses, shares, and protects personal information when you visit mergeharbor.com, contact us, or use the MergeHarbor services, and the rights you have.

1. Who is responsible

MergeHarbor as controller. We are the controller of personal information we collect for our own purposes: your account and sign-in details, billing and business contact details, website and contact-form data, communications with us, and security and usage records about how the services are used.

MergeHarbor as processor. When our customers use MergeHarbor, we process their source code, pull requests, review results, and the personal information these contain (for example, commit author names and email addresses, usernames, and comments) on the customer’s behalf. For that information the customer organization is the controller, and we act as its processor (or “service provider” under US state law) under our Terms and Data Processing Addendum. If your information is in a customer’s repositories and you want to exercise your rights, please contact that organization; we will help it respond.

Self-hosted installations. When a customer runs MergeHarbor in its own environment, we do not receive the data processed by that installation, and this policy does not apply to it.

Our contact details are in section 12.

2. Information we collect

Information you give us

• Account information: name, email address, password (stored only as a salted hash), organization name, and role.
• Billing information: billing contact, company name and address, tax identifiers, and payment records. Payment card details are collected and processed by our payment processor; we do not store full card numbers.
• Contact and program forms: name, work email, company, team size, and the message you send us, for example in sales, demo, open-source or startup program requests.
• Support and communications: the content of emails and support requests, and any files you attach.

Information collected automatically

• Sign-in and identity information: when you sign in with Google, GitHub, GitLab, Microsoft, a magic link, or your organization’s single sign-on, we receive your identifier, name, email address, and, for single sign-on, group memberships your administrator chooses to share.
• Code-host information: usernames, user IDs, and repository and pull-request metadata from code hosts your organization connects (GitHub, GitLab, Bitbucket, or Gitea), used to attribute reviews, count active developers, and produce analytics.
• Usage and security records: actions in the console and API, sign-ins, permission changes, and exports, with IP address, browser user agent, and timestamps. These records support security, audit logs, billing, and support.
• Device and log data: IP address, browser type, and request logs when you visit our website or services.

We do not knowingly collect special categories of personal data, and we ask customers not to submit them.

3. How we use information and our legal bases

Where the EU or UK GDPR applies, we rely on the following legal bases:

Purpose	Legal basis
Creating and running your account, authenticating you, and providing the services	Performance of a contract with you or your organization; our legitimate interest in providing the services to our business customers
Billing, counting active developers and reviews, collecting payment, and keeping financial records	Performance of a contract; legal obligation
Securing the services, preventing fraud and abuse, keeping audit logs, and investigating incidents	Legitimate interests in protecting our customers and the services; legal obligation
Providing support and sending service and security notices	Performance of a contract; legitimate interests
Responding to sales, demo, and program requests, and sending product updates to business contacts	Legitimate interests in growing our business; consent where the law requires it. You can opt out of marketing emails at any time.
Improving the services using aggregated usage and performance metrics	Legitimate interests in developing our products
Complying with law and enforcing our agreements	Legal obligation; legitimate interests

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not make decisions that produce legal or similarly significant effects about individuals solely by automated means. We do not use customer code, pull-request content, or review results to train AI models, and we use AI model providers only under terms that prohibit them from training on that content.

4. How AI model providers are involved

To review a pull request on our hosted service, we send the pull-request diff and relevant code context to AI model providers. Depending on the customer’s routing settings and the risk of the change, these are Anthropic and OpenAI. We also use OpenAI to generate embeddings of code for search. This content can include personal information that appears in code or pull requests, such as author names in comments. Before anything is sent, we remove common secrets such as API keys, tokens, and passwords. Customers can restrict which providers, models, and regions are used, where available on their plan. Model providers may retain requests for a limited period for abuse and safety monitoring under their terms.

5. How we share information

We share personal information only:

• With subprocessors and service providers who help us operate the services, including cloud hosting, AI model providers, email delivery, payment processing, bot protection on our forms, and support tools, under contracts that limit their use of the information to providing services to us. The current list of subprocessors that handle customer data is in Annex III of our DPA.
• Within your organization: administrators of your MergeHarbor organization can see your account details, activity in the audit log, and analytics about your pull requests.
• With third-party services you connect, such as your code host or identity provider, to post reviews and sign you in.
• For legal reasons: when required by law or valid legal process, or to protect the rights, safety, or property of our customers, users, or MergeHarbor. We review requests for customer data carefully and, where permitted, notify the customer.
• In a business transfer: in connection with a merger, acquisition, or sale of assets, subject to this policy.

6. International transfers

We and our subprocessors process information in Australia (AWS Asia Pacific (Sydney) region) and in other countries where our providers operate, including the United States. When we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, we use the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with additional safeguards where needed. You can request a copy of the relevant safeguards by contacting us.

7. Retention

We keep personal information only for as long as we need it for the purposes above:

• Account information: while your account is active. When an organization is deleted, its data is purged after a 7-day grace period, with backup copies expiring within [Backup retention period, e.g. 90] days.
• Customer review data: according to the retention period the customer’s administrators set in the console, and in any case deleted after the customer’s agreement ends as described in our Terms.
• Audit logs: for the period set by the customer’s agreement, or while the organization exists.
• Contact and program form submissions: up to 24 months after your last interaction with us, unless you become a customer.
• Billing and tax records: for as long as tax and accounting law requires, typically up to [Statutory record-keeping period, e.g. 7] years.
• Sessions and sign-in records: sign-in links, password resets, and expired sessions are deleted within days of expiring.

8. Your rights

EEA, UK, and Switzerland. You have the right to access your personal information, correct it, delete it, restrict or object to our processing of it, receive it in a portable format, and withdraw consent at any time where we rely on consent. You can object at any time to processing for direct marketing. You also have the right to lodge a complaint with your local data protection authority, although we would appreciate the chance to address your concern first.

California and other US states. Residents of California and other states with comprehensive privacy laws have the right to know the categories and specific pieces of personal information we collect, the sources, purposes, and the categories of recipients; to correct and delete it; and to opt out of the sale or sharing of personal information and of targeted advertising. In the past 12 months we have collected the categories described in section 2 (identifiers, commercial information, internet or network activity, and professional information) for the purposes in section 3, and disclosed them for business purposes to the service providers described in section 5. We have not sold or shared personal information, and we do not use sensitive personal information to infer characteristics about you. We will not discriminate against you for exercising your rights. You may use an authorized agent, and you or your agent may appeal our decision by replying to it.

How to exercise your rights. Email privacy@mergeharbor.com. We will verify your request, usually by confirming control of the email address on the account, and respond within the time the law requires (one month under the GDPR, 45 days under California law, extendable where permitted). If your request concerns data a customer controls, we will refer it to that customer.

9. Cookies and similar technologies

Our website does not use advertising or third-party analytics cookies. We use:

• Essential cookies on app.mergeharbor.com to keep you signed in and protect against cross-site request forgery. The services do not work without them.
• Local storage on mergeharbor.com to remember your light or dark theme preference.
• Bot protection from Cloudflare Turnstile on our contact and program forms, which processes your IP address and browser signals to detect automated abuse.

If we introduce non-essential cookies, we will update this policy and ask for your consent where the law requires.

10. Security

We protect personal information with encryption in transit (TLS 1.2 or higher) and at rest, organization-level isolation, role-based access control, single sign-on, hashed session tokens and API keys, secret redaction, and tamper-evident audit logs. No system is perfectly secure, and we will notify affected customers and individuals of a personal data breach as the law requires. See our Security page for details.

11. Children

MergeHarbor is a business service and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Contact

MergeHarbor is operated by [Company legal entity], [Registered address].

• Privacy questions and requests: privacy@mergeharbor.com
• Data protection officer: [Data protection officer name and contact, or remove if not appointed]
• EU representative: [EU representative under GDPR Article 27, if required]
• UK representative: [UK representative under UK GDPR Article 27, if required]

13. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new “last updated” date and, for material changes, notify customers by email or in the console before the changes take effect.