Privacy Policy

1. Who we are, and who handles your payment

Data controller. Modalith, a trading name of Ivan Murzak, a sole proprietor registered in Washington State, USA. Registered address: 13205 97th Ave NE, Kirkland, WA 98034, USA. Contact: support@ai-pipeline.dev.

Payments. Payments are handled by Paddle as merchant of record (Paddle.com Inc., Paddle.com (Canada) Ltd or Paddle.com Market Limited depending on your country — see section 2 of our Terms). For the payment and billing data you give Paddle at its checkout, Paddle is a separate, independent controller, not our processor; it acts as our processor only for data it processes on our instructions. Paddle’s own privacy notice governs that data.

2. The short version

Pipeline is an orchestration and evaluation layer for AI coding agents. Your source code and your AI provider keys stay on your own machines and in your own git repositories, and they do not pass through us. By default the cloud stores only structural metadata about your runs: statuses, timings, token and cost counts, model and pipeline identifiers, and salted fingerprints. Never your prompts, your code, your AI responses, or your answers to in-run questions.

3. What we do and do not receive

We are not a proxy or gateway for AI APIs. Model traffic goes directly from your runner to your AI provider under your own key or subscription. We never see, route, resell or meter those tokens.

Privacy tiers are enforced on your machine, before anything is uploaded:

• metadata (the default): a positive allow-list. Step identity and status, timings, token and cost counts, tool-call names and success flags (never their arguments or output), model and effort identifiers, outcome taxonomy, pipeline and branch names, content hashes, and a salted project fingerprint rather than the raw repository path. Prompts, code, model responses, file contents and question text are stripped before upload. Any unrecognized field is dropped by default.
• events (opt-in, per project): the above plus the full structured event stream, for richer self-analytics.
• full: planned, not yet available. It would add step transcripts and logs.

You set the tier, and the open-source runner agent enforces it before data leaves your machine. The control plane physically cannot receive data above your configured tier. The tiers are documented in full at privacy tiers.

4. Account and operational data we do store

• Account and identity: your email, and, if you connect them, GitHub or other OAuth identifiers and organization membership records.
• Authentication: hashed session tokens and hashed personal access tokens. We store one-way hashes, never the raw secrets.
• Runner registry: runner identifiers, labels, hashed runner tokens, and heartbeat or online state.
• Run metadata: as described in section 3.
• Notification channel configuration: if you configure Slack, Telegram or email channels, the target you provide (webhook URL, bot token, address). These are sensitive; see section 7.
• Billing: payments are handled by Paddle, which acts as Merchant of Record. We store your plan state and Paddle’s customer reference. We do not receive or store full card data. For the payment itself Paddle acts as an independent controller rather than as our sub-processor.

Which role we are in depends on the data. We are a processor for run telemetry and dispatched work, where your organization is the controller, and a controller for accounts, billing, site analytics, the public registry and cross-tenant aggregates. This notice covers the processing we do as controller. Where we act as processor, the notice to members is the organization’s to give.

5. How we use it

To operate the service (run history, live views, scheduling, job dispatch, notifications, and the analytics you asked for), to secure it (abuse prevention, rate limiting, audit), to send you service and account messages, and, if you enable it, to compute your own analytics and digests.

We do not sell personal data. We do not train models on your data.

6. Sharing and sub-processors

We share data only with the providers necessary to run the service, under contract, and where legally required. Today they are:

• OVH: the virtual private server the control plane, both front ends and the production Postgres database run on.
• Amazon Web Services: object storage holding the nightly database backup, encrypted on our side before upload.
• Resend: transactional email, meaning sign-in links and organization invitations.

We give at least 30 days’ notice before adding or replacing one, and you may object. All three are located in the United States, and so is the production database. See section 9.

Paddle is not in this list because it is not our sub-processor: as Merchant of Record it is an independent controller for the payment. A separate published disclosure covers the two cross-organization aggregate features and how to turn each one off; see runner metrics collection.

7. Security

Transport is HTTPS-only, and the .dev domain is HSTS-preloaded. Secrets are stored as one-way hashes where applicable.

One disclosure we would rather not have to make: the notification-channel credentials described in section 4 are currently stored without encryption at rest. If that matters for your Slack or Telegram integration, weigh it before configuring one. Encryption at rest for these is a tracked piece of work.

8. Data retention and your rights

Run and account data is retained for the life of your organization account and is deleted when the account is deleted. Financial records outlive the account, because we are required to keep them.

The plan history windows are display filters, not retention periods. A plan that shows you 7, 90 or 365 days of history is limiting what the dashboard displays. Nothing is deleted at those boundaries.

Data deleted from the live database is removed from backups by expiry rather than by editing the backups.

To request access to your data, an export, a correction or deletion, write to support@ai-pipeline.dev and we will respond. Nothing in this policy limits or excludes any mandatory rights you hold under the data protection law that applies to you.

9. International transfers

The production database, the backup bucket and the transactional email provider are all in the United States. If you are in the EU, the EEA or the UK, using the Service therefore involves a transfer of personal data to the United States.

For those transfers we rely on the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where UK data is involved. We do not rely on the EU-US Data Privacy Framework.

10. Our representative in the EU and the UK

Our Article 27 representative in the European Union and the United Kingdom is Euverify Ltd (Ireland and United Kingdom). If you are in the EEA or the UK you may contact the representative, or us directly at support@ai-pipeline.dev, on any matter relating to the processing of your personal data.

11. Children

The free service is not directed at children under 13, and we do not knowingly collect personal data from them. A paid subscription requires the account holder to be at least 18.

12. Changes to this policy

When we change this policy we will update this page and change the effective date at the top of it.