Privacy policy

Precedent Labs s.r.o., Příkop 4, 602 00 Brno, Czechia, Company ID: pending

The controller of your personal data is the company named above. For any data protection question, write to info@precedentlabs.eu.

This policy covers the hosted Precedent Review GitHub App (the “app”) and this website. The precedent command-line tool that you run on your own machines or in your own CI sends no data to us and is not covered by this policy.

When a pull request is opened or updated in a repository where the app is installed, the app fetches the repository, including its commit history, and reviews the changes. For that:

• We fetch repository contents only for the duration of one review, into a temporary directory in Google Cloud, region europe-west1 (Belgium, EU).
• When the review ends, the temporary directory is deleted, also when the review fails. Repository contents are never stored.
• Your code is never used to train any model.
• In this deployment no AI or LLM model sees your code: the review is a deterministic code analysis and the optional semantic filter is off.
• When we do not run a review (a private repository without a paid plan, or the daily limit is reached), the repository is not fetched at all.
• The review result (the summary comment, inline comments and the precedent check run) is written to the pull request. It contains file paths, line numbers and symbol names, and stays on GitHub as part of your repository.

Commit history contains author names and email addresses. We process these, and any other personal data in the code, only for the duration of the review and only to perform it.

In a Google Cloud Firestore database in region europe-west1 we store only:

• the GitHub installation id of the app;
• the login, numeric id and type (user or organization) of the account the app is installed on;
• the GitHub Marketplace plan and seat count, if you purchased the app;
• per-day review counters (UTC days), in total and per installation, for the free plan's daily limit.

No code, pull request contents or access tokens are stored in the database.

The app's services write operational logs to Google Cloud Logging. They contain metadata only, such as the installation id, repository, pull request number, review result and duration, and error messages. They contain no code and no pull request contents. Logs are kept for 30 days and then deleted automatically.

This website is served by Firebase Hosting (Google). We use no analytics, no tracking code and no cookies, and the site loads nothing from third-party servers; fonts are self-hosted. When you open a page, Google as the hosting provider processes technical request data (such as your IP address and browser type) to deliver it.

If you email us, we use your address and message only to reply and to handle your request.

• Google Cloud EMEA Limited and Google Ireland Limited (Ireland): running the app in Google Cloud (Cloud Run, Firestore, Cloud Tasks, Secret Manager, Cloud Logging) in region europe-west1 (Belgium, EU), and hosting this website (Firebase Hosting).
• GitHub, Inc. (USA): the platform the app runs on and the source of repository events. For GitHub Marketplace purchases GitHub is the merchant of record: GitHub handles payment and invoicing, payment details never reach us, and we receive only the account, plan and seat count. Data GitHub processes about you is governed by the GitHub Privacy Statement.
• INTERNET CZ, a.s. (Forpsi, Czechia): hosting of the info@precedentlabs.eu mailbox.

We do not sell your data and do not share it with anyone else unless the law requires it.

• Performance of a contract (Art. 6(1)(b) GDPR): running reviews and keeping the installation, plan and seat count.
• Legitimate interest (Art. 6(1)(f) GDPR): daily limits and abuse prevention, operational logs for security and troubleshooting, replying to emails.
• Legal obligation (Art. 6(1)(c) GDPR): accounting and tax records, for example for Enterprise contracts.

Personal data inside repository code (such as commit authors) is processed only briefly, within the review requested by whoever installed the app.

• Repository contents: only for the duration of one review, then deleted.
• Installation record: while the app is installed. When GitHub notifies us of the uninstall, the record is deleted immediately.
• GitHub Marketplace plan records (account id, plan, seat count): deleted when the purchase is cancelled or the account uninstalls the app.
• Per-day review counters: deleted automatically 30 days after the UTC day they belong to, within 31 days at the latest.
• Operational logs: 30 days.
• Email correspondence: as long as needed to handle the request; for contractual and accounting matters, as long as the law requires.

You have the right to access your personal data, to have it corrected or erased, to restrict its processing, to data portability, and to object to processing based on legitimate interest. Send requests to info@precedentlabs.eu; we handle them without undue delay and within one month at the latest.

The quickest way to have the app's data erased is to uninstall the app on GitHub. We do not carry out automated decision-making or profiling with legal effects.

If you believe we process your data unlawfully, you can lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or with the supervisory authority of the EU country where you live or work.

We may change this policy, for example when we add a feature or a processor. The new version is published on this page with its effective date; material changes are announced at least 30 days in advance.

Terms of service · Support