We read the threads you point us at, keep the sentences that matter, and nothing else.

• Signing in grants no mailbox access. Connecting a mailbox is a separate choice, and it is read-only. Drafting is a further choice, and it never sends.
• We read threads with people outside your company. Threads among your own colleagues are skipped.
• We keep the quote, a short passage around it, and a pointer back to the source. We never keep a copy of your mailbox.
• Disconnect a source and everything that came from it is deleted.
• Nobody trains a model on your content: not us, and not the model providers we use.
• We do not sell data and we do not show ads.

CommitOps runs the website at commitops.ai and the CommitOps service. This policy covers both. CommitOps is in early access, and this policy describes how the service handles data as it is built. When that changes, this page changes first and carries a new date.

When a company uses CommitOps, that company decides what to connect. For the content we read on its behalf, we act as its processor.

Your account

Sign-in uses Google with the smallest scope set Google offers. We receive your name, email address and profile picture, and nothing from your mailbox.

Google data, only if you connect it

From a connected mailbox we read the last 90 days on the first run and new mail after that. A thread is read only if at least one participant is outside the email domains your company set when it connected. We look at a thread’s participants to decide this, and a thread among colleagues is dropped before any of its text is analyzed.

Other sources you connect

If you connect them, we read Outlook mail (Microsoft’s Mail.Read) and Microsoft Calendar (Calendars.Read) under the same rules as Gmail and Google Calendar above; pull request, merge request and issue titles, states and links from GitHub, GitLab, Linear or Jira; account names, deal amounts and stages from your CRM; call transcripts from your transcript provider; and we post to the Slack channel you choose, and to a GitLab merge request only if you turn that note on. Each one is your choice, and each can be disconnected.

Google Drive, Notion and Slack Connect

From Google Drive we read only the files you choose in the Google Picker, under Google’s drive.file permission, which cannot see any other file in your Drive. From Notion we read only the pages you share with CommitOps on Notion’s screen. We read each document’s text again when it changes, keep the sentences that became evidence with the page, heading or block they came from, and drop the rest once it is read. From Slack Connect we read only channels your workspace shares with another company and that you invited our bot to: who wrote each message, their email address, when, and the words, read the same way as mail. We never read internal channels or direct messages. Disconnecting a source, or removing one document, deletes what we kept from it.

RepoOps and SalesAsCode

If you run RepoOps or SalesAsCode and connect it, it sends us what it already holds: for RepoOps, the measured cost and roadmap items of each merged change; for SalesAsCode, deals and the commitments it found, each with its quote. We treat what they send as we treat any source, and disconnecting one deletes it.

Pages and documents for the claim register

If you add them, we read the pages of your own site you list, once a day and within their robots.txt, and the decks, security questionnaires and RFP answers you upload. We keep the sentences that state what your product does, with where they appeared, and nothing else from the page or the file. Removing a page or a document deletes what we kept from it.

Signed contracts and what your system grants

If you upload a signed contract, a model reads it once under zero data retention routing, and we keep the clauses that grant your customer something, word for word with their page, and nothing else from the file. If you add an entitlement source, we read the plan config, flags or code files you name and keep each value with where it was read: for code, the file, the line number and that line, never the file. Contract text is never sent to error reporting, logs or analytics. Deleting a contract deletes every clause read from it.

Single sign-on

If your company signs in through its own identity provider, we keep its public settings (its address, its signing certificate, or its OIDC issuer and client id), the client secret encrypted, and the domains it covers. From each sign-in we keep the name, email address and stable id your provider sends, the id of the answer so it cannot be used twice, and when it happened. Nothing else your provider sends is kept.

Audit exports

An admin can export every commitment with its quotes, history and checks as a signed file. We keep the file for seven days so it can be downloaded, then delete it, and keep a record of who made it, when, how many rows it held and its checksums. The file holds only what the person who made it may see.

Billing

Stripe processes payments. We keep your plan and billing contact. We never see or store a full card number.

Product usage

We record named product events, such as a candidate being kept or discarded, with counts and settings but no customer content. Automatic click capture and session recording are off. Error reports are stripped of every field that can hold a customer’s words before they leave our servers.

For each commitment we find, we store:

• the exact quote, checked character for character against the source
• a short passage around it, so the quote reads in context
• who said it, who it was said to, and when
• a pointer back to the source: a message id, a second in a recording, or a page in a document
• the decisions made about it: who kept or discarded it, linked it to work, or told the customer, and when

We also keep the accounts and work items those commitments refer to. We do not keep a copy of your mailbox, of whole messages, or of whole transcripts. Text that does not become a quote is used to find candidates and then discarded.

Only to run CommitOps for you: to find candidate commitments, show them with their source, link them to the work that satisfies them, and build the lists and pages you see in the app.

Finding candidates uses language models. A short passage of text goes to a model through OpenRouter, and every request requires zero data retention routing and refuses any provider that may collect data. A model that cannot meet that is a model we do not use. Nothing you connect is used to train a model, ours or anyone else’s.

We do not sell personal data, share it for advertising, or use it to show ads.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

In practice, for data from Gmail, Google Calendar and Google sign-in:

• We use it only to provide and improve the features you see in CommitOps.
• We transfer it to others only as needed to provide those features (the subprocessors below), to comply with law, for security, or as part of a merger or sale with notice to you.
• We never use it for advertising, and never sell it.
• No person at CommitOps reads it unless you ask us to for a specific item, it is needed for security or to comply with law, or it has been aggregated and anonymized for internal operations.
• We never use it to develop, improve or train generalized AI or machine learning models.

You can remove CommitOps’s access at any time from your Google Account, under third-party access.

These companies process data for us. None of them receives customer content except where the table says so. Follow changes to this list on the security page.

A company that uses CommitOps can choose to share a promise page with its own customer. It is off until the company turns it on, and each promise appears on it only when a person at that company marks it. The page shows the title the company wrote, a plain status, and, only if the company chooses, the promised date, the work behind it and who owns it. It never shows the quoted words a promise came from, where they were said, or any dollar amount. Anyone holding the link can read that one customer's page without signing in, so the company can replace or turn off the link at any time. A company can also publish a public page of promises it marked public, under titles written for it, naming no customer. We count how many times each page is opened per day and keep nothing else about who opened it: no address, no browser details, no referrer.

We will disclose data if the law requires it, and will tell the affected customer first unless the law forbids that.

Traffic is encrypted in transit. Google and other OAuth tokens are encrypted with AES-256-GCM before they are stored, and stay on our servers rather than in a browser cookie. Every row in the database belongs to one company, and the database refuses to return one company’s rows to another. The full list, with what is built today and what is still being built, is on the security page.

• Disconnect a source and every quote and passage that came from it is deleted, along with any commitment left with no evidence.
• The record that a decision was made (kept, discarded, linked) stays after a disconnect, without the customer’s words, so your history still adds up.
• To delete your whole workspace, write to privacy@commitops.ai. We delete it within 30 days of the request.

You can ask to see the personal data we hold about you, correct it, export it, or delete it. Write to privacy@commitops.ai and we will answer within 30 days. If your data reached us through a company that uses CommitOps, we will pass your request to that company and help it answer.

CommitOps is a business tool and is not meant for anyone under 16.

We post every change here with a new effective date. If a change affects how we use data you have already given us, we email account owners before it takes effect.