acuvis
Sign in

Privacy

Privacy policy.

Last updated 2026-10-10. We process the minimum needed to make the product work, and we tell you exactly what that is. This policy is written to be read end-to-end.

Who we are and our role

Acuvis is operated by Paweł Lisowski, ul. Słoneczna 12, 76-200 Bierkowo, Polska, NIP 8393198485, REGON 368330844. Contact: privacy@acuvis.dev. Full operator details are on the imprint page. We act in two roles:

  • Controllerfor data about our customers' accounts and our relationship with them: sign-in and account data, billing data, emails with us, security logs, and visits to acuvis.dev.
  • Processor for the content organisations connect to Acuvis: code, pull requests, comments and the personal data in them, such as the names, GitHub usernames and email addresses of authors and commenters. For this data the customer organisation is the controller, and we process it only on its instructions under our Data Processing Agreement. If your data reached us through an organisation's repositories, please contact that organisation first; we will help it answer.

Categories of data we process

  • Account data — your GitHub or Google identifier, GitHub username, display name, email addresses, avatar URL, the organisations you belong to inside Acuvis and your role in them, and your notification preferences.
  • Repository and pull request data— the repositories you grant access to, branch names, pull request titles and descriptions, commit SHAs and subject lines, author usernames, file paths, the diff hunks of the changes under review, and review comments synced from GitHub, including from people who don't use Acuvis.
  • Collaboration data — comments, replies and verdicts you author inside Acuvis, feedback on findings, seen-state, and in-app activity events (for example which file you opened) that keep your place in a review.
  • Audit and security data — the hash-chained audit log of actions in your organisation, server and proxy logs that include IP addresses and user agents, webhook delivery records, and error reports from our servers and your browser (scrubbed of tokens and email addresses).
  • Billing data — when applicable, the Stripe customer identifier, plan, seats, invoice history, the billing address used for tax, and the GitHub usernames counted as active developers. Card numbers are held by Stripe; we never see them.
  • Communications — emails we send you (invitations and notifications) and emails you send to our support and privacy addresses.

Source code handling

Acuvis does not keep copies of your repositories. To analyse a pull request, a worker in a dedicated Firecracker microVM (Fly.io, Frankfurt) fetches the changed files and, for context, parts of directly imported files and repository guideline files such as AGENTS.md or CONTRIBUTING.md. That working copy lives on the microVM's temporary storage and is destroyed with the microVM when the analysis ends.

We do store the diff hunks of each reviewed pull request (the changed lines and a few lines around them) in the review document, so the review can be reopened later; findings and suggested fixes may also quote code. Review documents are stored in our database in France, scoped to your organisation, and are included in database backups. We do not store full files or unchanged code outside the diff, and we do not copy review content into analytics systems.

Legal basis for processing

Where we act as a processor, the customer organisation decides the legal basis. For data we control:

  • Performance of a contract (Art. 6(1)(b) GDPR) — account data, billing data and the emails needed to deliver the service you signed up for.
  • Legitimate interest (Art. 6(1)(f) GDPR) — audit log, security logs, error tracking, fraud and abuse prevention (such as applying trial limits per GitHub account), and aggregate usage metrics that contain no code. The interest is keeping the service secure, fair and operable; the processing is the minimum needed for that.
  • Legal obligation (Art. 6(1)(c) GDPR) — invoice and tax records retained per Polish accounting law, breach notifications, lawful authority requests.
  • Consent (Art. 6(1)(a) GDPR) — only where we ask for it, e.g. optional marketing emails. You can withdraw consent at any time.

Retention

  • Account data — for the life of the account, deleted within 30 days after you ask us to delete it at privacy@acuvis.dev.
  • Review documents, comments and settings — for as long as the organisation uses Acuvis, deleted within 30 days after the organisation asks us to delete them or closes its account.
  • In-app activity events — 90 days, then automatically deleted.
  • Audit log — retention by plan: 30 days on the trial, 1 year on Team, 3 years on Business and Enterprise (legacy plans: 90 days on Starter, 1 year on Team, 3 years on Scale). Older events expire automatically.
  • Copies of emails we send — 30 days. Records that stop us sending the same notification twice are kept for 90 days.
  • Error events — 30 days, then automatically purged. Grouped error records (error type, code location, counts and a scrubbed sample) are kept for as long as needed to fix the underlying problem.
  • Server and proxy logs — kept only as long as needed to operate and secure the service, then rotated out.
  • Trial usage records — the GitHub account a free trial was used on is kept as long as needed to apply trial limits.
  • Backups — database backups are retained for up to 30 days, so deleted data can remain in a backup for up to 30 days before it is overwritten.
  • Invoices and tax records — 5 years from the end of the relevant tax year (Polish statutory minimum).

Sub-processors and international transfers

We use a small number of sub-processors to deliver the service. The complete list, including each sub-processor's jurisdiction and the legal mechanism for any transfer outside the EEA, is published at /sub-processors. For transfers to the United States we rely on the EU-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise on the EU Standard Contractual Clauses (Commission Decision 2021/914) with supplementary measures where appropriate. We notify customers at least 30 days before adding or replacing a sub-processor.

Some data goes to services that an organisation chooses to connect rather than to our sub-processors: review comments and checks are written back to the organisation's GitHub repositories, and an admin can send review notifications to the organisation's own Slack workspace.

AI inference providers

Reviews are generated with large language models run by two providers, both under data processing terms:

  • Fireworks AI (United States) runs open-weight models, currently DeepSeek, for extraction, clustering and triage. Fireworks does not log or store prompts or outputs for these models and does not train on them; it logs only metadata such as token counts. The models were developed by DeepSeek but are hosted by Fireworks: no data is sent to DeepSeek.
  • OpenAI (OpenAI Ireland Ltd, with processing in the United States) runs GPT models for the in-depth review, finding validation and reasoning across the whole change. OpenAI does not use API data to train its models. It may keep API inputs and outputs for up to 30 days to detect abuse, after which they are deleted unless the law requires longer retention.

Prompts contain diff hunks, surrounding code context, the pull request title and description, your team's review rules and the results of static-analysis tools. If a pull request contains a secret, it reaches these providers as part of the diff. The model output is validated against our JSON schemas before display.

Acuvis does not make decisions about people based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR). The output concerns code changes, it is advisory, and a person decides whether to merge or reject a pull request.

Cookies and similar technologies

The marketing site at acuvis.dev sets no cookies and loads no analytics, advertising or tracking scripts; its fonts are served from our own domain. It is delivered through Cloudflare, which processes your IP address to deliver and protect the site.

The application at app.acuvis.dev uses only what it needs to work: a session cookie (HttpOnly, Secure, SameSite=Lax) that keeps you signed in for up to 14 days, a cookie that remembers the last organisation you opened, a short-lived state cookie that protects the GitHub or Google sign-in against forgery, and your browser's local storage for display preferences you set, such as panel width. Browser errors are reported to our own error tracker. We do not use third-party analytics, advertising pixels or session replay tooling. Because all of these are strictly necessary for the service you asked for, we do not ask for cookie consent.

Your rights under GDPR

You have the right to access your personal data, to have inaccurate data corrected, to have data erased, to have processing restricted, to data portability, and to object to processing based on legitimate interest. Mail privacy@acuvis.dev to exercise them. We aim to respond within 7 days and always within one month, as required by Art. 12(3) GDPR. For data we process on behalf of an organisation, we pass your request to that organisation and help it respond.

You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — UODO), at ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or with the supervisory authority of the EU member state where you live or work.

Security and breach notification

Technical and organisational measures are summarised on the security page. If a personal data breach affecting data we control is likely to result in a risk to your rights and freedoms, we notify UODO within 72 hours of becoming aware of it and inform affected people without undue delay where the risk is high, in line with Art. 33 and 34 GDPR. For data we process on behalf of an organisation, we notify that organisation without undue delay so it can meet its own obligations.

Children

Acuvis is a service for businesses and is not directed at children. You must be at least 18 years old to create an account.

Changes to this policy

We publish the date at the top of the page each time the policy changes. Material changes — new data categories, new sub-processors, new processing purposes — are announced by email to organisation owners at least 30 days in advance. Trivial corrections (typos, clearer wording) take effect immediately on publication.

Contact

privacy@acuvis.dev for privacy questions, data subject requests, or DPA negotiations. Operator details, including registration numbers, are on the imprint page.