What leaves your repository, and what never does.

California Notice at Collection and State Privacy Rights Notice: see section 16 for your rights under applicable U.S. state privacy laws. Notice to European users: if you are in the European Economic Area, the United Kingdom or Switzerland (together, “Europe”), section 17 has additional information about our legal bases, your rights and international transfers.

M82 Labs (“we”, “us” or “our”) provides a developer tool that watches third-party APIs for breaking changes, finds the code in your GitHub repositories those changes affect, writes a fix with an AI agent, and opens a pull request carrying the evidence. A human on your team reviews and merges it. We never merge. The product is called M82 Labs.

This policy describes how we process personal information that we collect through our website at m82labs.dev, our GitHub App, our web application, our emails, and the other activities described here (together, the “Service”).

Two roles. For the personal information described in this policy, such as your GitHub account details, we are the controller (or, under U.S. state law, the business). For the contents of your repositories, you or your organisation remain the owner and we act on your instructions: the permissions you grant on GitHub’s own consent screen are the whole scope of what we may read. Where a customer agreement or data processing addendum applies to your organisation’s use of the Service, that agreement governs repository contents and this policy governs the rest.

Feedback. We may ask you for feedback by email or in a call. It is used only to shape the product and is never attached to your repository data. You can decline, and you can ask us to delete it at any time.

We collect far less than a typical online service, because the product needs almost nothing about you as a person. There is no signup form and no password. The categories below are everything.

Information you provide to us

• Contact data: whatever you include when you email us. Email addresses entered on the waitlist form the site carried before signup opened are still held, as section 6 says, until you ask us to delete them.
• Communications data: the content of your emails to us, and feedback you choose to give.
• Payment data: the card details, billing address and billing email you enter on Stripe’s checkout page. Stripe is the merchant of record for the purchase and holds that data as an independent controller under its own privacy policy; we receive billing identifiers and the subscription’s state, never your card number, and we do not copy the billing email you enter there.
• Settings: preferences you set in the Service, such as whether you receive alert emails.

Information we receive from GitHub, which you use to sign in

When your organisation installs our GitHub App, GitHub sends us the installation ID, the organisation’s name and ID, and the names and IDs of the repositories you selected. GitHub’s consent screen is the only place you pick repositories, so the grant you see there is exactly the scope we hold.

Data about others. If an organisation administrator installs the Service, we receive the GitHub identifiers of the people GitHub tells us may access that installation, so we can show them the organisation’s changes when they sign in. We do not email or contact anyone who has not signed in themselves.

Information collected automatically

• Website visitors: if you only visit the public site, we count the visit and nothing more. Our analytics providers receive the page you viewed, the referring site, your browser’s user agent and a coarse location derived from your IP address, which is not stored. No cookie is set and no identifier is kept. Section 11 has the detail.
• Service logs: when you use the signed-in product, our servers log request metadata (timestamps, request paths, status codes, your user ID and installation ID) for debugging, security and abuse prevention. Logs never carry file contents, diffs or vendor specifications.

Repository data is a separate category with its own section, because it is the part of the product most worth understanding. See section 4.

Sensitive personal information. We do not intentionally collect or process sensitive personal information (such as government identifiers, health, biometric, racial or ethnic origin, political or religious data). Please do not send it to us.

We use personal information for the following purposes, or as otherwise described at the time of collection.

• Service delivery and operations: to detect vendor API changes, match them to your code, write a fix, open a pull request, and email you when we found something but chose not to open a pull request; to sign you in and show you the organisations you may access; to bill your organisation; and to respond to your requests, questions and feedback.
• Evidence: every pull request links to the run log and the files that produced the match, so you can verify the change rather than trust us.
• Precision measurement and service improvement: the only number we optimise is how many of our pull requests are correct. We compute it over structured records: change type, confidence score, outcome, and whether you merged, closed or edited the pull request.
• Security and compliance: debugging, abuse prevention, spend caps, enforcing our terms, complying with law and lawful requests, and protecting the rights, property and safety of you, us and others.
• Service communications: announcements, security notices, and changes to this policy. These are not marketing.
• Aggregated data: we may create aggregated or de-identified statistics (such as pull requests opened per vendor) that cannot reasonably identify you. We do not attempt to re-identify such data.

What we do not do. We do not use your data for advertising, we do not sell it, we do not share it with data brokers, we do not build profiles of you, and we send no marketing email. We do not train any machine learning model on your source code or personal information, and we do not permit our model provider to do so.

No automated decisions with legal effect. The Service makes automated judgements about code: whether a vendor change reaches a call site, and whether to open a pull request. It makes no automated decision about you that produces legal or similarly significant effects, and every pull request requires a human to merge it.

You are granting an AI tool write access to private source code, so this section says exactly what leaves your repository, what never does, and what the agent can and cannot do. Every statement here is enforced by a mechanism in the system, not by a sentence in this document.

What leaves your repository, and nothing else does

What never leaves

How the agent is contained

The fix is written by an AI agent running Anthropic’s Claude models. Here is what is guaranteed and how.

So the honest worst case is this: a fully compromised agent, whether by prompt injection in a code comment, a model failure, or a bug in our code, cannot exfiltrate anything, because it has nowhere to send it and nothing to authenticate with. It can at most produce a bad diff, which is caught by the diff checks, by our test run, and finally by a human who has to press merge.

What Anthropic receives

Anthropic receives three things: the vendor’s changelog prose (which is public), excerpts of your files at the confirmed call sites, and the diff as the agent constructs it. We use Anthropic’s commercial API under terms that do not permit Anthropic to train on this data, and we have not opted in to any training or feedback programme. Anthropic’s own retention of API inputs is governed by its commercial terms and its data processing agreement, not by us.

Service providers. These are the only parties that process data on our behalf. This list is versioned, and adding to it means we email every account holder before that party receives any data.

Stripe processes the payment data you enter on its page under its own privacy policy at stripe.com/privacy.

Other users of your organisation. People GitHub tells us may access an installation can see that organisation’s detected changes, pull requests and evidence, including the GitHub handle of whoever is signed in. Nothing about you is visible to anyone outside your organisation.

Professional advisors. Lawyers, accountants, auditors and insurers, in the course of the services they render to us, under confidentiality.

Authorities and others. Law enforcement, government authorities and private parties, where we believe in good faith that disclosure is required by law or necessary to protect the rights, property or safety of you, us or others. Where the law allows, we will tell you before complying with a request for your data.

Business transferees. If M82 Labs is involved in a merger, acquisition, financing, sale of assets, or an insolvency or receivership, personal information may be disclosed to prospective counterparties and their advisers and transferred to a successor. We notify you before your data transfers to a successor, and you can delete it first.

We do not share personal information with advertising partners, data brokers or marketing partners, and we do not sell it.

Retention follows one question: when someone asks why we edited their code, can we show them what we saw? Data that answers that question is kept until you ask us to delete it. Data that does not is deleted on a schedule, and the schedule is enforced by storage lifecycle rules and checked by tests, not by someone remembering.

Uninstalling the GitHub App revokes our access immediately. No token can be minted, no clone can be made, and nothing further is processed. Deselecting a single repository has the same effect for that repository.

Uninstalling does not delete your data; asking does. We keep your records after an uninstall so that the evidence behind pull requests we already opened stays available to you, and so that an accidental uninstall can be reversed by reinstalling. Email us to delete it, and we delete for your installation: symbol names and file paths, vendor markers, run logs, run diffs, attributed webhook payloads, notification records, and installation-linked access records. Deletion completes within 30 days of your request.

Your personal account is handled separately, so that deleting one organisation cannot remove another organisation or revoke its administrator. Once you no longer have access to any installation, we revoke your GitHub authorisation and delete your local identity, redeemed invitation, and any matching address from the former waitlist on request. Organisation records and billing remain with the organisation.

Two things survive, and you should know before you ask.

1. Pull requests we opened live in your own repository and are yours. We cannot and should not delete them.
2. A labelled evaluation case derived from a run may survive as a purely structural record: the change type, the confidence score, the outcome, and the label. It contains no repository content, no symbol names, and no file paths. If that distinction is not acceptable to you, say so and we remove those cases too. The measurement is not worth a trust failure.

We employ technical and organisational safeguards designed to protect the personal information and repository data we hold. The ones that matter most:

• Ephemeral compute. Every job runs on a machine created for that job and destroyed afterwards. There is no shared filesystem and no worker reuse.
• Narrow tokens. The token used to clone is scoped to one repository for about an hour and is removed from the clone before the agent starts. Compromising a job machine costs one repository for one hour.
• Encryption. All traffic uses TLS. Tokens are encrypted at rest. Database and object storage are encrypted at rest by our hosting providers.
• Verified after the fact. Forbidden paths (.github/workflows/, .env*, .git/) are checked on the actual diff after the agent exits, not requested in a prompt.
• Least access. Our own access to production data is limited to what operating the Service requires, and every administrative action on an installation is recorded in an audit log.
• Incident notice. Security risk is inherent in all internet technologies, and no system is perfectly secure. If we discover a breach affecting your data, we notify affected organisations within 72 hours of confirming it, with what was affected and what we did, and we notify regulators where the law requires.

If you find a security issue, email contact@m82labs.dev. We will acknowledge within two business days. Customers who need more detail on how these controls are built can ask at the same address under a security questionnaire.

We are headquartered in the United States, our infrastructure runs in the United States, and every processor in section 5 is a U.S. company. If you use the Service from outside the United States, your personal information is transferred to and processed in the United States, where privacy laws may differ from those in your country.

If you are in Europe, your personal information is transferred to the United States, which is not the subject of an adequacy decision under the GDPR except for organisations certified under the EU-U.S. Data Privacy Framework. We rely on the Data Privacy Framework (and its UK Extension and the Swiss-U.S. DPF) where a processor is certified, and on Standard Contractual Clauses approved by the European Commission and the UK Information Commissioner’s Office in our agreements with processors otherwise. A copy of the relevant clauses is available on request. Section 17 has more detail.

Wherever you are, you can exercise these by emailing contact@m82labs.dev. We answer within 30 days (45 days where U.S. state law allows, and we will tell you if we need the extension) and never charge for it. We treat every requester the same regardless of location. If you are in Europe these are your rights under data protection law; if you are in California or another U.S. state with a privacy law, they correspond to your rights under that law, and section 16 has the specifics.

Verifying your identity. Because you sign in with GitHub, the simplest verification is a request sent from the email address GitHub shares with us, or a request made while signed in. If neither is possible, we may ask you to confirm control of your GitHub account, for example by adding a short code to your GitHub profile. We never ask for government identification. An authorised agent may make a request on your behalf with your written permission, and we may confirm it with you directly.

Communications. We send no marketing email. Alert emails about detected changes can be turned off in settings by an organisation owner or administrator; service and security notices cannot, because they are how we tell you about changes to this policy or a breach.

Declining to provide information. The Service needs a GitHub account and the repository access you grant. Without them we cannot provide it; nothing else is mandatory.

Linked third-party platform. You can limit what GitHub shares with us through your GitHub account settings, and revoke our authorisation entirely from GitHub’s Applications settings page. Revoking does not remove data we already received; ask us to delete it under section 7.

Do Not Track and Global Privacy Control. We do not sell or share personal information and set no tracking cookies, so there is nothing for these signals to switch off. We treat a Global Privacy Control signal as a valid opt-out of sale or sharing in any case, as the law requires.

This section is our cookie notice. We set no cookie until you sign in with GitHub, and nothing we set is used for tracking, advertising or analytics.

All three are first-party, HttpOnly, Secure and SameSite=Lax. Because none is used for tracking and the two necessary ones cannot be refused without breaking sign-in, we show no consent banner. You can delete them at any time through your browser settings; deleting the session cookie signs you out.

Public site analytics. The public site counts visits with Google Analytics 4 in consent-denied mode and with Cloudflare Web Analytics. Google’s tag runs with every consent type set to “denied” and never granted, the mode Google documents as cookieless: it sets no cookie, stores nothing in your browser, and sends a ping carrying the page you viewed, the referring site, your browser’s user agent and a coarse location derived from your IP address, which Google does not store. Google Signals and advertising personalisation are off, so nothing is joined to a Google account or an ad profile. Cloudflare’s beacon is cookieless by design and does no fingerprinting: it sends the page, the referrer, your browser’s user agent and a coarse country, and keeps no identifier. We see totals: page views, referrers and countries. Neither tool runs in the signed-in app.

What we do not use. No advertising or social pixels, no session recording, no fingerprinting, no email open-tracking pixels, and no third-party embeds on any page.

The Service links to GitHub, to vendors’ public documentation, and to our processors’ own policies. Those sites are operated by third parties under their own privacy policies, which we do not control. A link is not an endorsement.

The product is for software teams and requires a GitHub account. It is not directed at anyone under 16, and we do not knowingly collect personal information from children. If you believe we have, contact us and we will delete it.

We may update this policy from time to time. If a change reduces your protections, adds a subprocessor, or changes what leaves your repository, we email every account holder at least 14 days before it takes effect. Smaller clarifications are noted here with a new version number and effective date. Continuing to use the Service after the effective date means the new version applies; if you disagree, uninstall and ask us to delete your data.

M82 Labs
Email: contact@m82labs.dev (privacy requests, data subject requests and security reports)
Web: m82labs.dev

We operate exclusively online and have a direct relationship with the people whose information we collect, so email is our method for every request.

If any statement in this policy stops being true of the running system, that is a bug in the system and we will fix the system, not the wording. Tell us if you find one.

This section applies to residents of U.S. states whose privacy laws apply to us and grant the rights below (the “State Privacy Laws”), including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”). “Personal Information” here has the meaning given in those laws. Not every right is available in every state, and we may decline a request where the law permits; if we do, we tell you why and how to appeal.

Your rights. Residents of these states may have the right to: know the categories of Personal Information we collect, the sources, the purposes, and the categories of third parties we disclose it to; access a copy of it; correct it; delete it; opt out of sale, sharing for cross-context behavioural advertising, targeted advertising and profiling in furtherance of significant decisions; limit the use of sensitive Personal Information; appeal a denial; and not be discriminated against for exercising any of these. Section 10 says how to make a request and how we verify it.

What we do not do. We do not sell Personal Information, we do not share it for cross-context behavioural advertising, we do not process it for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects. We do not knowingly collect, sell or share the Personal Information of anyone under 16. We do not intentionally collect sensitive Personal Information. We honour Global Privacy Control signals as opt-out requests in any case.

Information practices, currently and during the past 12 months.

Retention. Section 6. De-identification. We do not attempt to re-identify de-identified data except to test that our de-identification works.

Shine the Light. We do not disclose Personal Information to third parties for their own direct marketing, so there is nothing to report under California Civil Code §1798.83. Nevada. We do not sell covered information; a Nevada resident may still record an opt-out of any future sale by emailing contact@m82labs.dev.

Where this applies. This section applies only to individuals in the European Economic Area, the United Kingdom and Switzerland. “Personal information” in this policy includes “personal data” as defined in the EU GDPR, the UK GDPR and the Swiss Federal Act on Data Protection (together, the “GDPR”).

Controller. M82 Labs is the controller of the personal information covered by this policy, except repository contents, for which your organisation is the controller and we are its processor. Contact details are in section 15.

Representatives. The Service is offered primarily in North America, and we do not direct it at people in Europe: we do not market there, price in euros or pounds, or provide the Service in European languages. For that reason we have not appointed a representative in the EU or the UK under Article 27 of the GDPR, and we have not appointed a Data Protection Officer, as the GDPR does not require one for our scale and processing. If you are in Europe and use the Service, this policy still applies to you in full and every right in this section is available to you. We will appoint representatives before we begin offering the Service to people in Europe.

Our legal bases. The GDPR requires a legal basis for each purpose. Ours are:

Retention. We keep personal information only as long as necessary for the purposes above, on the schedule in section 6. Where immediate deletion is not possible, for example because data sits in a rolling backup, it is isolated from further processing until the backup expires.

No automated decision-making with legal effect, and no profiling. See section 3.

Your rights. You may ask us to provide access to your personal information, correct it, delete it, transfer a machine-readable copy to you or a third party, restrict its processing, or object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time. Section 10 says how to ask and how we verify your request. If we refuse a request in whole or in part, we tell you why, subject to any legal restriction.

Complaints. If you are not satisfied with our response, you can complain to the data protection authority where you live. For the EEA, the European Data Protection Board lists them. For the UK, the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, +44 303 123 1113. For Switzerland, the Federal Data Protection and Information Commissioner.

Processing outside Europe. We are a U.S. company and our processors are U.S. companies, so your personal information is processed in the United States. The United States has no general adequacy decision under the GDPR. Where we transfer personal information outside Europe we use one of these mechanisms: a transfer to an organisation certified under the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. DPF, which the European Commission, the UK and Switzerland have recognised as adequate; or Standard Contractual Clauses approved by the European Commission, with the UK International Data Transfer Addendum where UK data is involved, together with the safeguards described in section 8. You may ask us at contact@m82labs.dev which mechanism covers a given processor and for a copy of the relevant clauses.