Managed platform
Privacy Policy
Last updated 19 October 2026
Pullsight operates the hosted Pullsight service. This policy describes the personal data that service stores and how it is used.
Data the service stores
Passwords are not stored. Sign-in uses OAuth, one-time codes, or API keys.
- Account: email, display name, and avatar URL from the identity provider.
- Auth: hashed API keys, hashed one-time codes, and encrypted OAuth or personal access tokens.
- Organizations and repositories: organization name, repository full name, platform metadata, and webhook secrets.
- Reviews: findings, severity, pull request metadata, and optional indexed file content used for review context.
- Notifications: email digest preferences, and messages when email delivery is enabled.
- Audit: security event metadata, including the action, IP address, success, and resource identifiers.
- Billing: Stripe customer and subscription identifiers when a subscription exists. Card numbers are collected by Stripe.
Model providers
Pull request diffs and related code context are sent to the model provider configured for the hosted service so Pullsight can produce reviews.
Retention
Review records and related events remain until they are deleted. One-time codes expire quickly, and a stored row may remain until it is cleaned up. Audit events are kept for security review.
Requests
To ask for access to or deletion of personal data on the hosted service, email info@pullsight.dev.