Privacy Policy — Salesforce PR Reviewer

      Plain-language summary: We read the source code files changed in
      your pull requests, send them to an AI API for review, and post the
      findings back as a PR comment. We do not store your source code.
      We store only the minimum operational data needed to enforce usage limits
      (your GitHub account login and a review count).
    

1. Who We Are

Salesforce PR Reviewer is a GitHub App that performs automated code review on Salesforce repositories using AI-powered code analysis. The App is operated as an independent service. References to "we", "us", or "our" refer to the operator of this GitHub App.

2. What Data We Collect

2.1 Source Code (Transient)

When a pull request is opened, synchronised, or reopened in a repository where the App is installed, we retrieve the diff of changed Salesforce files via the GitHub API. This file content is:

Transmitted to our AI processing partner's API to generate the code review.
Never written to disk or any persistent store by our application.
Held only in process memory for the duration of a single review request (typically under 30 seconds).

2.2 GitHub Account Login (Persistent)

We store your GitHub organization or user account login (e.g., my-org) in Redis for the purpose of:

Enforcing your plan's monthly review limit.
Looking up your current billing plan (Free or Pro).

Review count keys are automatically deleted after 35 days via a Redis TTL. Plan records are retained until you cancel your Marketplace subscription.

2.3 Webhook Event Metadata

GitHub sends us webhook payloads containing event metadata: repository name, PR number, commit SHA, sender login, and event type. This data is logged for operational purposes (debugging, security monitoring) and is not stored in a database. Server logs are retained for up to 30 days by our hosting provider.

2.4 Billing Data

Billing is handled entirely by GitHub Marketplace. We receive marketplace_purchase webhook events that inform us of your plan (Free or Pro). We do not receive or store payment card information.

3. How We Use Your Data

We use collected data solely to:

Perform the core service: send your changed Salesforce files to our AI processing partner for review and post the findings as a PR comment.
Enforce monthly review limits per your plan tier.
Route your review requests to the appropriate AI model based on your plan.
Debug operational issues and monitor for security anomalies.

We do not use your source code to train AI models, sell data to third parties, or perform any secondary analytics.

4. Third-Party Sub-Processors

4.1 Anthropic (AI Processing)

Your changed Salesforce file content is transmitted to Anthropic's API to generate the code review. Anthropic processes this data as a data processor on our behalf. Anthropic's privacy policy is available at anthropic.com/privacy. By default, Anthropic does not use API inputs to train its models.

4.2 Railway (Hosting)

Our application is hosted on Railway (railway.app). Railway provides the server infrastructure and Redis database used for usage tracking. Server logs are subject to Railway's data retention policies.

4.3 GitHub

The App authenticates as a GitHub App installation and uses the GitHub REST API to fetch PR file diffs and post review comments. Data transmitted to and from GitHub is governed by GitHub's Privacy Statement.

5. Data Security

We implement the following technical controls to protect your data:

HMAC-SHA256 webhook verification using a timing-safe comparison to authenticate all inbound GitHub webhooks.
Short-lived installation tokens from the GitHub App JWT flow — tokens expire in one hour and are not persisted.
HTTPS-only communication with all third-party APIs (GitHub, AI processing partner, Redis).
No source code storage — file content is never written to disk or a database by our application.
Prompt injection mitigations — file content is treated as untrusted data; all file references are validated against the submitted set and free-text field lengths are capped.
HTTP security headers (via Helmet.js): Content-Security-Policy, X-Frame-Options, X-Content-Type-Options.

6. Data Retention

Data Type	Retention Period
Source code file content	Not retained (in-memory only, discarded after review)
Monthly review count (Redis)	35 days (auto-deleted via TTL)
Billing plan (Redis)	Until Marketplace subscription cancelled
Server / application logs	Up to 30 days (Railway infrastructure)

7. Your Rights (GDPR & CCPA)

If you are located in the European Economic Area, United Kingdom, or California, you have additional rights regarding your personal data:

Right to access — request a copy of data we hold about your account.
Right to erasure — request deletion of your account data (review counts and plan record).
Right to portability — receive your data in a machine-readable format.
Right to object — object to processing where we rely on legitimate interests.

To exercise these rights, open an issue at our GitHub repository or contact us via the Support page. We will respond within 30 days.

8. Children's Privacy

This service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "Last updated" date at the top of this page and, where appropriate, through a notice in the GitHub Marketplace listing. Continued use of the App after such changes constitutes acceptance of the updated policy.

10. Contact

For privacy enquiries, data deletion requests, or questions about this policy, please use our Support page or open an issue on the GitHub repository.