Legal
Privacy policy
Last updated 8 October 2026
We collect the least we need to run your CI on your machines: who you are on GitHub, your workflow and job metadata, and the state of the machines you connect. Never your code’s contents, your job logs or your secrets.
Draft, under legal review and not yet in effect. Highlighted items are details still to be filled in.
Who we are#
[legal entity name], [registered address], runs Buildhound and is responsible for the personal data described here. Contact: [privacy contact email].
What we collect#
| Data | Why |
|---|---|
| Your GitHub account: username, user id, avatar, and email if you share it | To sign you in and tell you about your account |
| The GitHub App installation and the repositories you select | To know where Buildhound may act |
| Workflow files, and run and job metadata: names, labels, timings, results, who or what triggered them | To price your CI, run the audit, route jobs and show where each job ran |
| Machine details from the agent: machine name, operating system, hardware size, agent version, status and policy states such as plugged in or idle | To route jobs to machines that can take them and to keep them updated |
| Billing records from our payment provider: plan, status, invoices | To manage your subscription. We never see or store card numbers |
| Product usage events from the dashboard | To understand which features help and fix what breaks |
What we do not collect#
- Your source code, beyond the workflow files the audit reads.
- The contents of your jobs, their logs or their outputs. The agent sends heartbeats and job metadata only.
- Your secrets. They go from GitHub to the job’s virtual machine and are destroyed with it.
- Anything from the rest of your machine: your files, keychain, browsing or other apps.
Who processes it for us#
We use a small set of providers, each only for the job named:
- Cloudflare, to run our API and queues;
- Supabase, for our database;
- Vercel, to host this website and the dashboard;
- PostHog, for product analytics and error tracking;
- our payment provider, for subscriptions and invoices;
- GitHub, which you already use, through the GitHub App.
We do not sell personal data and do not share it for advertising.
How long we keep it#
- Run and job history: 90 days, rolling.
- Findings, reports and spend summaries: while your account exists.
- Webhook deliveries: 7 days.
- After you uninstall the GitHub App or cancel, everything is deleted after 30 days.
Your choices and rights#
You can ask for a copy of your data, ask us to correct or delete it, or object to how we use it, by writing to [privacy contact email]. Uninstalling the GitHub App stops new data from arriving. Depending on where you live, you may also complain to your data protection authority.
Where data is processed#
Our providers run in several countries. Where data leaves your region, we rely on the safeguards those providers offer, such as standard contractual clauses.
Changes#
We will post changes here with a new date, and tell account holders about material ones by email or in the dashboard.