Privacy Policy

1. Who we are

AgenticReview is operated by DataRBL AB, 559385-4754, Agavägen 64, 181 55 Lidingö, Sweden ("we", "us"). We are the controller for the personal data described in this policy. Contact: info@agenticreview.ai.

2. What we collect

• Account data: your email address and the account name you choose, used to sign you in and run your account.
• Account settings: the country, region and industry you choose, used to place you in benchmarks.
• GitHub installation data: the GitHub account or organisation the app is installed on, the installation ID, and the names and IDs of the repositories you give access to.
• Derived metrics: scores and aggregated measurements produced by each review. These describe the codebase and the team as a whole. We never store source code, file names, commit messages or per-person data.
• Billing data: your plan and subscription status. Payments are handled by Stripe; we do not receive or store card details.
• Enterprise enquiries: name, work email, company and the message you send through the contact form.
• Onboarding guide: if you start the voice guide on our website, the conversation is processed by Tavus.
• Technical data: server logs needed to operate and secure the service.

3. How reviews handle your code

Code is read in an ephemeral GitHub Actions runner and discarded; only derived metrics are stored, in the EU. Details on Security & data.

4. Why we process data

• To provide the service you signed up for (performance of a contract, GDPR Art. 6(1)(b)).
• To secure and improve the service, and to answer enterprise enquiries (legitimate interest, Art. 6(1)(f)).
• To build aggregated benchmarks from public GitHub repositories and, in anonymised and aggregated form, from customer reviews (legitimate interest, Art. 6(1)(f)). No individual organisation or person can be identified in a benchmark, and a benchmark cell is only shown when it contains at least 50 organisations. Account owners can opt out in their account settings; accounts that opt out do not have access to benchmarks, since benchmarks are built from the results of participating customers.
• To meet legal obligations such as bookkeeping (Art. 6(1)(c)).

5. Who we share data with

• Supabase - hosting, EU.
• GitHub - sign-in via GitHub App.
• Stripe - payments, independent controller.
• Tavus - voice guide on the website.

Where data is processed outside the EU/EEA, transfers are based on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses.

Subprocessors for customer data are listed in the DPA.

6. How long we keep data

• Account, installation and derived metrics: while your account is active, and deleted within 30 days after you close it.
• Enterprise enquiries: up to 24 months.
• Billing records: as long as Swedish bookkeeping law requires.
• Aggregated benchmarks: kept, because they contain no personal data.

7. Your rights

You may request access to, correction or deletion of your personal data, object to processing based on legitimate interest, ask us to restrict processing, and receive your data in a portable format. Contact info@agenticreview.ai. You may also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

8. Cookies and local storage

We use only what is strictly necessary to keep you signed in. Fonts are served from our own servers.