Privacy Policy

We collect the following categories of information. Personal data is any of it that identifies a person, such as a name, email address, or IP address.

Account data. Your name, email address, and profile details from your sign in provider (for example GitHub or Google), your organization and role, and your phone number if you use text message verification. We use it to create your account, sign you in, and contact you about your account.

Decision ledger. The text you or your team send to Rerove through the web app, the command line tool, or an AI assistant connected to Rerove. It also includes content you import from apps you connect, for example Linear documents, Google Docs, Google Meet transcripts, Notion pages, Confluence pages, and meeting transcripts. From this content we create statements, topics, glossary terms, and a search index. Each statement keeps a short quote of its source. This content can contain personal data, such as the names of authors, meeting speakers, and the people a statement is attributed to.

Code data. When Rerove reviews a pull request or reads repository documents, we process code, diffs, file names, commit messages, pull request descriptions, and the GitHub or GitLab usernames involved.

Usage data. Our servers log each request with its time, IP address, user agent, and the page or action requested. We keep an audit log of security events in your account, with the IP address and user agent. On our website and in the web app we collect analytics, performance, and error data (see Section 10).

Payment data. If you subscribe to a paid plan, our payment processor collects your billing details. We do not store card numbers.

Data you should not send. Rerove does not need payment card data, health information, government identification numbers, passwords, or API keys. Do not include them in content you send or import.

You can connect Rerove to an AI assistant, for example ChatGPT or Claude, by signing in with your Rerove account.

Rerove receives only what the assistant includes in a request, such as search words, text you ask it to save, and your decisions on items in your decision ledger. It does not request or receive your chat history, files, or location. Text you save goes into your decision ledger, and we record which assistant app sent it. Rerove returns data from the decision ledgers you can access. The assistant provider's own privacy policy covers what it does with that data.

To end the connection, remove Rerove in your assistant's settings.

We use the information we collect to:

• Build, search, and maintain your decision ledger
• Review pull requests
• Answer tool calls from AI assistants you connect
• Send transactional emails and text message sign in codes
• Process payments
• Keep the service secure, and find and fix errors
• Prevent fraud, spam, and abuse of the service
• Understand how the product is used, so we can improve it
• Comply with legal obligations

We do not sell personal data, use it for advertising, or use your content to train AI models.

Rerove sends content to AI models to extract statements, find contradictions, build the search index, and write review comments. Each request includes only the content needed for that task.

AI output is advisory and may not be accurate, complete, or free of errors.

Zero data retention is available on request for AI gateway processing. The DPA explains activation and scope. Rerove's retention periods are in section 6.

We share personal data only with:

• Service providers that run Rerove for us, such as hosting, AI models, sign in, payments, email, and monitoring. Our Subprocessors page lists each one, what it does, and what data it receives
• Services you choose, such as apps you connect and the AI assistant you use with Rerove
• Authorities, when the law requires it (see Section 9)

AI model providers do not use your data to train their models.

Your decision ledger stays until your organization is deleted. It keeps a history of every change. When you delete an ingestion, it leaves your active decision ledger, and statements that came only from it go back to review. The ingestion and its statements stay in the history. Rejected statements stay in the history too.

Code data. Repository copies we use for reviews are deleted after 30 days without use. Raw events from GitHub are deleted after 14 days. Review results stay until your organization is deleted.

Account data stays while your account is active. When you delete your account, we delete your account data within 30 days and remove your email address, IP address, and user agent from the audit log. Content you added stays with its organization. Server logs, backups, and email blocks follow the periods below.

Blocked email addresses and domains. If we suspend an account for fraud, spam, or abuse, we may block its email address or email domain from new sign-ups and invitations. A block holds only the address or domain, the reason, and who added it and when. We keep a block after the account is deleted, until we remove the block. Our legal basis is our legitimate interest in preventing fraud and abuse (GDPR Art. 6(1)(f)). To object to a block, email hello@rerove.app.

Removed members. When an organization removes you, we delete your membership after 30 days. Content you added stays with the organization.

Deleted organizations. We permanently delete all of an organization's data 30 days after the organization is deleted.

Server logs are kept for 1 year.

Audit log. We keep email addresses, IP addresses, and user agents in the audit log only while the organization exists.

Backups of our database and files are kept for 30 days. Deleted data leaves the backups within 30 days.

Connected app tokens are deleted when you disconnect the app.

Beyond the periods above, we keep data only when the law requires it.

Rerove offers sign in with Google and a Google Workspace connection. When you sign in with Google, we receive your name, email address, and profile picture. When you connect Google Workspace, we read file names so you can choose what to import, and we read the Google Docs and Meet transcripts you import. We use Google user data only to provide these features.

Rerove's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not use Google user data for advertising or market research, and we do not use it to train AI models. We do not sell Google user data to third parties, data brokers, or information resellers. You can revoke Rerove's access at any time in your Google Account permissions.

We implement technical and organizational measures to protect your information, including encryption at rest (AES-256) and in transit (TLS 1.2+), per-tenant isolation with dedicated containers and storage, least-privilege access controls, and audit logging.

Access to customer data is limited to authorized personnel who require it to operate, develop, or improve the service. While we strive to protect your information, no security system is impenetrable, and we cannot guarantee absolute security. For full details on our security practices, see our Security page.

We may disclose your information if required to do so by law or in good faith belief that such action is necessary to:

• Comply with a legal obligation, subpoena, or similar legal process
• Protect and defend our rights or property
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users or the public
• Respond to a government or regulatory request

Our website uses Google Analytics to understand how visitors use it. Google Analytics sets cookies and collects pages visited, session length, and referral source. You can opt out with the Google Analytics Opt-out Browser Add-on.

Our website also uses Lightsage to measure visits from people and AI agents. For each page request it receives the page address, IP address, user agent, country, and referrer. It sets a cookie with a random visitor ID so it can count clicks on sign up buttons.

The web app uses cookies to keep you signed in. It uses a performance monitoring service, which sets its own cookies, to measure page load times. It uses an error monitoring service to report errors. When an error happens, that service records a replay of the session with on screen text and form inputs masked.

We do not use advertising cookies or sell your data to third parties.

Rerove Inc. is a United States company, and service data is hosted in the United States. Rerove personnel who access customer code and data are based in the United States and Poland (European Union). Rerove does not access customers' own end-user data, which customers must not send or import. The DPA sets out the applicable transfer terms. Our Subprocessors page lists provider locations.

For users in the European Economic Area (EEA), we rely on Standard Contractual Clauses and other lawful transfer mechanisms to ensure your data is protected in accordance with GDPR requirements. The DPA also includes the UK Addendum and Swiss terms where the relevant law covers the data.

GDPR (European Economic Area). If you are located in the EEA, you have the right to access, correct, delete, or port your personal data, as well as the right to restrict or object to processing. To exercise these rights, contact us at hello@rerove.app.

CCPA (California). California residents have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, email us at hello@rerove.app. We will respond within 30 days.

If your personal data appears in a customer's content, contact that customer to exercise your rights. The customer controls that content; Rerove processes it on the customer's behalf under the DPA and assists the customer in responding. If you contact us about that content, we will direct the request to the customer.

In the Rerove app you can:

• Delete ingestions and reject statements
• Disconnect connected apps
• Download your account data
• Delete your account

You can remove Rerove from your AI assistant at any time in the assistant's settings. You can uninstall the GitHub App in your GitHub organization or account settings. You can revoke Google access in your Google Account permissions.

To delete your organization's data or make any other request, email hello@rerove.app.

Rerove is not directed at children under 16. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us and we will promptly delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the effective date. Your continued use of the service after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, contact us at:

Rerove Inc. 1304 Mcdaniel Ln Se Apt 103, Lacey, WA 98503, USA Email: privacy@rerove.app