Stage procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Your information may be transferred to and processed in countries other than your own, including the United States. We rely on Standard Contractual Clauses (SCCs) and other legally recognized transfer mechanisms to ensure your data is protected when transferred internationally. Our service providers are contractually obligated to protect your information in accordance with this policy.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Depending on your jurisdiction, you may have the right to:” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Account data (profile, sessions, OAuth tokens) is deleted promptly.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Repository data and AI-generated content are also deleted when you revoke access to the associated repositories.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Upon account deletion or repository disconnection, your account data and AI-generated content are deleted promptly. Generation run metadata is anonymized. For full details on data retention, see our” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Generation run metadata (e.g., when a review was generated and for which pull request) is anonymized — your user association is removed, but the aggregate record is retained for operational analytics.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ . We do not store raw source code beyond the temporary processing window required to generate your review.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We retain your data for as long as your account is active and as needed to provide the Service. When you delete your account:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ If you subscribe to a paid plan, payment details (such as credit card information) are collected and processed directly by Stripe. We store only your Stripe customer and subscription identifiers — never your full card number.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We collect error reports and diagnostic information when the Service encounters technical issues. This may include stack traces, request context, and environment details. This data is sent to our error monitoring provider (Sentry) to help us identify and fix bugs.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ To provide the Service, your code is transmitted to third-party AI providers (currently Anthropic) for processing. These providers process your code solely to generate responses and do not retain or use your code for model training. For details, see” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ by Stripe. We do not store your full payment card details — Stripe handles this according to their privacy policy and PCI-DSS standards.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We do not sell your personal information. We may share your data with:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ database storage, caching, analytics, and error monitoring (e.g., Vercel, Neon, Upstash, PostHog, Sentry).” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Certain features of the Service may require a paid subscription. By subscribing to a paid plan, you agree to pay all applicable fees. Subscriptions automatically renew at the end of each billing cycle unless you cancel before the renewal date. You may cancel your subscription at any time through your account settings; cancellation takes effect at the end of the current billing period. No refunds or credits are provided for partial billing periods, except as required by law.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ We reserve the right to change our pricing with at least thirty (30) days' prior notice. Continued use of the Service after a price change takes effect constitutes acceptance of the new pricing.” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.