Legal
Privacy Policy
This Privacy Policy explains how Secure Git Bridge handles information in connection with Secure Git Bridge, securegitbridge.com, and related support and commercial services.
1. Controller and contact
The current Secure Git Bridge controller/contracting entity, privacy and security contacts, and appointed EU/EEA and UK representatives are published on our Privacy Contacts & Representatives page so those legally significant details remain accurate if our corporate structure or representative appointments change.
2. Notice at Collection
This notice applies at or before collection on Secure Git Bridge website, account, checkout, Team, support, privacy-rights, and Enterprise surfaces. We do not sell personal information for money or share it for cross-context behavioral advertising.
| Category | Examples / purpose | Retention or criteria |
|---|---|---|
| Identifiers and contact information | Name, email, account ID; account access, Team invitations, support, requested sales follow-up, privacy requests. | Active account/service relationship; sales/evaluation leads up to 24 months after last activity; unverified privacy requests 7 days and terminal privacy-request records up to 24 months; earlier deletion where applicable. |
| Commercial and billing information | Plan, subscription, invoice, transaction status, Stripe customer references; paid service administration, fraud prevention, accounting and disputes. | While needed for the service plus applicable tax, accounting, dispute, fraud-prevention, or legal requirements. Full payment-card numbers are handled by Stripe rather than stored by Secure Git Bridge. |
| Internet / network activity and security metadata | IP address, user agent, request timestamps, hashed rate-limit keys, security/audit events; service delivery, security and abuse prevention. | Rate-limit records age out with their short enforcement windows; raw audit IP/user-agent fields are removed after 90 days; non-network commercial audit events up to 24 months. |
| Device and licensing information | Random device identifier in transit, keyed device hash at rest, generic device label, platform/app version, activation and entitlement state; license enforcement and device management. | While the account/license relationship and security purpose remain active, subject to valid deletion requests and lawful retention exceptions. |
| Professional / evaluation information | Company, developer/repository counts, procurement/security requirements, purchasing timeline; requested Enterprise or sales evaluation. | Up to 24 months after last activity unless a shorter period applies through a valid request or law. |
| Support communications | Support category, subject, message and resolution metadata; customer support and security troubleshooting. | Open until resolved; closed support tickets up to 24 months. |
| Team authentication and administration | Member name/email/role, password hash, MFA secret, recovery-code hashes, invitation state, Team policy/audit metadata; secure Team access and administration. | While Team access/security purposes remain active; security credential material is removed when the relevant account is removed or reset, subject to lawful exceptions; audit retention follows the security schedule above. |
| Optional first-party analytics | Pseudonymous session hash, allowlisted funnel event, coarse campaign/referrer and consent-policy version; product funnel measurement. | Only after affirmative consent; up to 180 days. GPC/DNT keeps analytics off. |
We do not require special-category/sensitive personal information for ordinary use. Do not submit source code, credentials, government identifiers, health information, or other unnecessary sensitive data through public forms. See the Data Retention Schedule, Subprocessors, and Privacy Rights.
3. Information we collect
- Website and security data. IP address, browser/user-agent information, pages or endpoints requested, timestamps, abuse-prevention counters, and security/audit events.
- Account and commercial data. Email, account identifiers, plan/license information, device activation metadata, Stripe customer/subscription/invoice references, and transaction status. Secure Git Bridge does not store full payment-card numbers.
- Team data. Organization, member, role, invitation, authentication, and Team license metadata.
- Support and privacy requests. Contact information and content you intentionally submit, along with status and fulfillment records.
- Sales/evaluation data. Name, work email, company, evaluation requirements, qualification details, consent choices, and requested correspondence.
- Optional analytics. Only after opt-in, a random tab-scoped identifier, stored as a hash server-side, plus coarse page/event and campaign/referrer information.
Do not submit passwords, API keys, private keys, access tokens, source code, or unnecessary sensitive personal information through public Website Sales, privacy, or support forms.
4. Local repository data and AI providers
Secure Git Bridge is designed to enforce repository boundaries locally. Installing or running Secure Git Bridge does not by itself send repository contents to the Secure Git Bridge commercial website.
When you authorize an AI-provider connection, approved prompts, code/file content, and relevant metadata may be transmitted to the provider you choose. Current customer-selected desktop integrations include ChatGPT (OpenAI), Claude Desktop (Anthropic), and GitHub Copilot (GitHub). Customer-selected provider processing is governed by that provider account, configuration, terms, and privacy practices. Repository source code is not stored in Secure Git Bridge's commercial licensing and billing database.
5. Website Sales
The public Website Sales assistant sends the visitor's question and recent in-browser conversation context to OpenAI to generate a product response. The assistant has no repository, customer-account, license-administration, Stripe-administration, or Secure Git Bridge admin access.
Secure Git Bridge does not retain the raw public Website Sales transcript for sales analytics. Optional coarse topic/funnel measurement is stored only when analytics consent is active. A sales lead is stored only when you separately request follow-up and provide the required contact information.
6. EEA/UK legal bases
- Contract and steps requested before contract: account registration, licensing, paid-plan administration, Team membership, requested downloads, support, and requested sales/evaluation follow-up.
- Legitimate interests: service security, fraud/abuse prevention, reliability, necessary operational logging, and responding to visitor-initiated Website Sales questions, balanced against user rights.
- Consent: optional first-party analytics and optional marketing communications. Consent may be withdrawn at any time without affecting prior lawful processing.
- Legal obligation: records or processing required for tax, accounting, legal claims, regulatory compliance, and verified privacy-rights requests.
7. Cookies, local storage, analytics, GPC and privacy choices
Necessary account sessions and preference storage are used to provide security and remember your privacy choice. Optional first-party funnel analytics are off by default until you affirmatively allow them. We do not use advertising or cross-site behavioral-tracking cookies.
We honor browser Global Privacy Control (GPC) and Do Not Track signals by keeping optional analytics disabled and removing the optional analytics session identifier. Necessary account, security, licensing, fraud-prevention, transaction, and user-requested service processing continues.
8. Sharing and service providers
We disclose information only as needed to providers that host, bill, email, secure, or support the service; to a customer-selected AI provider when the customer authorizes that connection; when required by law; to protect rights and security; or as part of a lawful corporate transaction. Current principal providers and purposes are listed at Subprocessors.
9. International transfers
Secure Git Bridge operates from the United States and some providers process data in the United States or other countries. Where EEA or UK law requires a transfer safeguard and no adequacy mechanism applies, we use or support the applicable contractual transfer mechanism, including European Commission Standard Contractual Clauses or the applicable UK mechanism, as appropriate to the processing relationship.
10. Retention
We keep personal data only for service, security, legal, billing, support, consent, and compliance purposes for which it is needed. Specific operational periods and criteria are published in the Data Retention Schedule.
11. Security
We use administrative, technical, and organizational safeguards appropriate to the service, including HTTPS, scoped access, protected administration, local Keychain storage for relevant app secrets, audit records, backups, and incident response. No system can be guaranteed completely secure.
12. Your privacy rights
Depending on applicable law, you may have rights to know/access, correct, delete, restrict, object, receive portable data, withdraw consent, opt out of covered sale/sharing, and appeal certain privacy decisions. You also may have the right to complain to your local supervisory authority.
Submit a verified request through Privacy Rights or email privacy@securegitbridge.com. Signed-in customers can download account-linked data from Account Data Export. We target a 30-day internal response deadline for verified requests, subject to lawful extensions or exceptions.
We do not discriminate against users for exercising applicable privacy rights.
13. California disclosures
For California users, the categories, purposes, sale/share status, and retention information required at collection are provided in Section 2. We do not sell personal information or share it for cross-context behavioral advertising. We nevertheless accept and record sale/share opt-out requests through our Privacy Rights workflow.
We do not use or disclose sensitive personal information for purposes of inferring characteristics about consumers. Global Privacy Control is honored for optional website analytics as described above.
14. Automated decision-making
Secure Git Bridge does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects about website visitors or commercial customers. Website Sales classifications are used for product routing and optional consented analytics, not significant eligibility decisions.
15. Children
Secure Git Bridge is developer and business software and is not directed to children. We do not knowingly sell or share personal information of minors for behavioral advertising.
16. Changes and contact
We may update this Policy when our processing or legal obligations change. Material changes receive additional notice where required.
Official controller and representative contacts: Privacy Contacts & Representatives.
Support: support@securegitbridge.com.