Privacy Policy for AI Code Review Bot

Last Updated: October 9, 2025

Effective Date: October 9, 2025

Rearway Technologies ("we", "our", or "us") operates the AI Code Review Bot GitHub App (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

IMPORTANT

Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not use the Service.

1. Information We Collect

1.1 Information from GitHub

When you install the AI Code Review Bot on your repositories, we collect:

• Repository Information: Repository name, owner, and metadata
• Pull Request Data: PR title, description, file changes, and code diffs
• User Information: GitHub username of PR authors and reviewers
• Installation Data: Installation ID and repository access permissions

1.2 Automatically Collected Information

• Log Data: Server logs including timestamps, request types, and error messages
• Usage Data: Number of PRs reviewed, files analyzed, and review comments posted
• Technical Data: IP addresses (for security and authentication purposes only)

1.3 Information We Do NOT Collect

• Passwords or Credentials: We never have access to your GitHub password
• Credit Card Information: If you use a paid plan, billing is handled by GitHub Marketplace
• Code Storage: We do NOT store your source code beyond the time needed for analysis

2. How We Use Your Information

2.1 Provide the Service

• Analyze pull request code changes
• Generate AI-powered code review comments
• Post review suggestions on your pull requests
• Send welcome messages upon installation

2.2 Improve and Maintain the Service

• Monitor and analyze usage patterns
• Debug and fix errors
• Improve AI model performance
• Develop new features

2.3 Security and Compliance

• Verify webhook authenticity
• Prevent abuse and unauthorized access
• Comply with legal obligations

3. Data Processing and AI Analysis

3.1 Anthropic Claude AI

Your code is sent to Anthropic's Claude AI API for analysis. This processing:

• Occurs in real-time when a pull request is opened or updated
• Is ephemeral - code is not stored by Anthropic beyond the API request
• Is subject to Anthropic's Privacy Policy
• Uses industry-standard encryption in transit (TLS/HTTPS)

3.2 Data Retention

• Code Diffs: Processed in memory only, NOT stored permanently
• Review Comments: Stored in GitHub (we do not maintain a separate copy)
• Metadata: Only operational data necessary for service functionality is retained: Installation IDs
• Repository identifiers
• Pull request numbers
• Timestamps of reviews
• Webhook event metadata
• Logs: Server logs retained for 90 days for debugging purposes

4. Data Sharing and Disclosure

4.1 Third-Party Service Providers

We share data with the following third parties:

4.2 We Do NOT Sell Your Data

We will never sell, rent, or trade your information to third parties for marketing purposes.

4.3 Legal Requirements

We may disclose your information if required by law or in response to:

• Valid legal processes (subpoenas, court orders)
• Requests to protect our rights or property
• Emergency situations involving potential harm

5. Data Security

We implement appropriate technical and organizational security measures:

• Encryption: All data in transit uses HTTPS/TLS encryption
• Authentication: Secure GitHub App authentication with JWT tokens
• Access Controls: Limited employee access to production systems
• Webhook Verification: Cryptographic signature verification for all webhooks
• Monitoring: Continuous security monitoring and logging
• Infrastructure Security: Hosted on AWS with industry-standard security controls

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

6. Your Rights and Choices

6.1 Access and Control

You have the right to:

• Access: Request a copy of data we store about your installations
• Deletion: Uninstall the app to stop data collection
• Correction: Contact us to correct inaccurate metadata

6.2 Uninstallation

To stop all data collection:

• Go to your repository Settings → Integrations
• Find "AI Code Review Bot"
• Click "Configure" → "Uninstall"

After uninstallation:

• We stop receiving webhook events
• New PRs will not be analyzed
• Existing GitHub comments remain (managed by GitHub, not us)
• You may manually delete bot comments from your pull requests on GitHub
• Contact us if you need assistance removing operational data

6.3 GDPR Rights (EU Users)

If you are in the European Economic Area (EEA), you have additional rights under GDPR:

• Right to access your personal data
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing

To exercise these rights, contact us at: alameen@rearway.com

We will respond to your request within 30 days as required by GDPR.

7. Children's Privacy

Our Service is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us.

8. International Data Transfers

Our Service is hosted in AWS Asia Pacific (Mumbai) - AP-South-1 region. If you access the Service from outside this region, your information may be transferred to, stored, and processed in India.

For EEA users: We rely on GitHub's Standard Contractual Clauses and AWS's data protection measures for international data transfers.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Updating the "Last Updated" date
• Posting a notice in our GitHub repository
• Sending an email to installation administrators (for significant changes)

Your continued use of the Service after changes constitutes acceptance of the updated policy.

10. Third-Party Links

Our documentation may contain links to third-party websites. We are not responsible for the privacy practices of those sites. Please review their privacy policies.

11. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us:

Rearway Technologies

Email: alameen@rearway.com

Website: www.rearway.com

GitHub: github.com/rearway-technologies

For GDPR-specific requests or data protection inquiries, please email: alameen@rearway.com

12. Additional Information for Specific Regions

California Residents (CCPA)

Under the California Consumer Privacy Act (CCPA), California residents have the right to:

• Know what personal information is collected
• Know whether personal information is sold or disclosed
• Say no to the sale of personal information (We do not sell data)
• Access personal information
• Request deletion of personal information

To exercise these rights, contact us at: alameen@rearway.com

We will respond to verifiable consumer requests within 45 days as required by CCPA.

European Union Residents (GDPR)

See Section 6.3 for GDPR-specific rights. We comply with all GDPR requirements including:

• Lawful basis for processing (legitimate interest and contract performance)
• Data minimization principles
• Right to be forgotten
• Data portability
• 30-day response timeline for requests

By using the AI Code Review Bot, you acknowledge that you have read and understood this Privacy Policy.

Appendix: Data Processing Summary

Data We Store in Our Database

Our PostgreSQL database contains ONLY operational metadata required for the service to function:

• Installation IDs and configuration
• Repository identifiers (no code content)
• Pull request numbers and timestamps
• Review status and completion markers
• Webhook delivery receipts

We do NOT store:

• Source code or code diffs
• File contents
• Commit messages or code comments
• Any personally identifiable information beyond GitHub usernames
• Payment information

All code analysis happens in memory and is immediately discarded after generating review comments.

Return to Homepage Terms of Service