Effective date: 30 October 2026
Service operator: TODO: company legal name
Website: https://codecare.si
Contact: privacy@codecare.si
1. About this policy
This draft explains how CodeCare may process information when someone visits this website or uses the planned software maintenance service. The site at https://codecare.si includes the marketing pages and the workspace at https://codecare.si/workspace/. The contact form stores valid messages in the CodeCare database when the API is running. It saves your light or dark theme choice in this browser’s local storage so the preference is remembered on return; that setting is not sent to CodeCare. Accounts, repository connections, and billing run through the workspace API.
2. Information that may be processed
When the service is implemented, the operator must confirm exactly what it collects. The expected categories to review include:
- Account details such as name, email address, authentication identifiers and team membership.
- GitHub account and repository identifiers, permission scopes, branch and pull request metadata, and activity records needed to provide maintenance.
- Source code, dependency manifests, test results, issue context, logs or other repository data expressly made available by a user.
- Service usage, diagnostics, support messages, billing records and security event data, if those systems are enabled.
Do not connect a repository until the final policy describes the actual access scope and data flows.
3. GitHub access and repository data
CodeCare is designed to connect through GitHub. Before launch, this section must identify the GitHub application, requested permissions, how authorization tokens are secured and revoked, which repository contents are read, what actions can be taken, and how users can disconnect. Repository contents may include confidential source code; confirm the access model, execution environment, staff access rules and deletion behavior before offering the service.
4. Source code and AI processing
The planned maintenance engine may analyze source code, errors and test context to diagnose issues or prepare code changes. Before launch, identify each AI model and third-party provider, the data each receives, processing locations, retention and training settings, and available opt-outs. Do not state that providers do not train on data or that processing occurs in a particular region until verified contractually and technically.
5. Why information may be used
Subject to the final service design, data may be used to provide requested features, secure accounts and integrations, diagnose service problems, respond to support requests, process payments if billing is enabled, and meet applicable legal obligations. The operator must document the applicable legal basis and purpose for each use before launch.
6. Storage and retention
Retention periods are kept while the account is open, then deleted on account deletion, except security and billing records we are required to retain. Before launch, specify how long account records, repository snapshots, prompts, generated changes, execution logs, telemetry, support records and backups are kept, how deletion requests are handled, and what remains in GitHub after disconnection or account closure.
7. Sharing and service providers
Recipients include GitHub, infrastructure and storage vendors, AI providers, customer-support providers, professional advisers, and Dodo Payments (https://dodopayments.com). Dodo Payments is the merchant of record for subscriptions. CodeCare sends the account email, name, organization id, and selected plan so Dodo can open hosted checkout and a customer portal. Card details are collected by Dodo, not stored by CodeCare. Subscription status comes back through a signed webhook. The static marketing site currently embeds Google Fonts, which may cause a browser to request font files from Google; confirm applicable provider terms and whether self-hosting is preferred.
8. Security
The operator should describe implemented safeguards here, including access controls, encryption, environment isolation, credential management, incident response and vulnerability handling. These practices have not been verified for this website draft, so no security certification or guarantee is made.
9. Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, restrict or receive certain personal information, object to some processing, or withdraw consent. The final policy must explain the rights that apply, how to make a request, identity checks, response timelines and any appeal route. Contact: privacy@codecare.si.
10. Children and international processing
Minimum age requirements and any international data transfer arrangements must be confirmed before service launch. Do not submit information for a child or connect a repository unless authorized to do so.
11. Changes and contact
Material policy updates should be described on this page with an updated effective date and any notice required by law. Questions may be directed to privacy@codecare.si.