Privacy

policy

Your code is yours. This page explains exactly what touches our servers and for how long.

No training on your code

GDPR ready

Zero-retention option

Last updated: October 1, 2026

What we collect

Account data you give us (name, email, billing address), usage metadata needed to run the service (task counts, model latency, error traces), and the repository context required for the tasks you run.

We do not collect your source code for training. Task context is encrypted in transit, retained only for the duration of the run plus 30 days of audit log, and never used to train models.

How we use it

To provide the service: planning tasks, executing sandboxes, rendering diffs and billing. To keep it safe: abuse detection, audit logs and incident response. To improve it: aggregate, de-identified performance metrics.

Your controls

Export or delete your account data at any time from Settings → Privacy. Enterprise workspaces can enable zero-retention endpoints and region pinning. Deleting an account purges task context within 72 hours.

Subprocessors & transfers

We use a short, published list of subprocessors (cloud hosting, model inference, error tracking). Transfers outside the EEA rely on standard contractual clauses. The current list lives in the docs and changes with 30 days notice.

Contact

Questions or requests: privacy@rafan.code. Our DPO responds within 30 days as required by GDPR.