Privacy Policy

1. Two kinds of data, two roles

• Account and website data. Data about you as a visitor or a user of the Service (your name, your email, how you use the Service). For this data we decide why and how it is processed, and we are responsible for it (the “controller”, or the “database owner” under Israeli law).
• Customer content. What an organization brings into the Service: source code, issues, messages, instructions, and data reached through the tools it grants to its agents. It may contain personal data about other people. The organization is responsible for that data and we process it on the organization’s behalf and on its instructions (as a “processor”, or “holder”). If your data is in an organization’s content, please contact that organization first.

2. The data we collect

Data you give us

• Account details: your name, email address and password (stored only as a salted hash), and the organization you create or join.
• Sign-in with your code host: if you choose to continue with your code host account, we receive your account identifier, username and verified email address from it.
• What you set up: agents, their instructions and rules, schedules, merge policies, proposals, your decisions and your feedback on agents’ work.
• Credentials: keys and tokens for the services you connect (your AI provider, your tools). They are encrypted at rest and are never shown again after you save them.
• Messages: what you write to us by email, and your contact details.

Data from the services you connect

• Code host: for the repositories you choose, their names and settings, events (issues, comments, pull requests, checks), and the repository contents an agent reads while it works.
• Messaging tool: workspace and channel identifiers, the messages that mention an agent, and the identifier of your account there when you link it to your Factorik account.
• Tools granted to agents: whatever an agent retrieves through a tool during a run (for example an error report, a log line or a database record), to the extent it appears in the run’s record.

Data we generate

• Run records: the timeline of each run (the commands and tool calls it made, what it produced, its summary, outcome, duration and estimated AI cost), and each merge decision with its reasons.
• Technical data: IP address, browser and device type, pages requested, dates and times, and server logs of errors and warnings.

We do not ask for, and the Service is not meant for, special categories of data (such as health data or government identifiers). Please do not connect repositories or tools that expose such data to agents.

3. How we use it, and on what legal basis

• To provide the Service (performance of our contract with you): creating and securing accounts, running agents, opening and merging pull requests under your policies, sending the notifications you asked for, and answering support requests.
• To keep the Service safe and working (our legitimate interests): preventing abuse and fraud, investigating incidents, finding and fixing faults.
• To improve the Service (our legitimate interests): understanding how it is used, and reviewing how agents behaved, including the records of their runs, so that they work better. We do not use your source code to train AI models.
• To write to you (contract and legitimate interests): messages about your account, security and changes to the Service or to our terms. We send marketing email only where the law allows it, and every such message lets you opt out.
• To meet legal obligations and to establish, exercise or defend legal claims.

We do not make decisions about people that produce legal effects on them by automated means alone.

4. How AI is involved

Agents work by sending content to AI models: the agent’s instructions, the relevant source code, the event that woke it, and what its tools returned. That content is sent to the AI model provider that the organization connected, using the organization’s own credentials and account with that provider. The provider processes it under its agreement with the organization, including that provider’s own data retention and training terms. Organizations should review those terms and choose the settings that suit them.

Agents run in isolated environments that are created for a single run and destroyed when it ends. What remains afterwards is the run’s record in the Service and whatever the run published to your code host.

5. Who we share data with

We do not sell personal data and we do not share it for advertising. We share it only with:

• Service providers that host and run the Service for us (cloud hosting, the isolated environments agents run in, databases and email), under contracts that require them to protect the data and to use it only on our instructions;
• The services you connect (your code host, your AI provider, your messaging tool, the tools you grant to agents), on your instructions, as needed for agents to do their work;
• Members of your organization, who can see the organization’s agents, runs, proposals and the name of the member who made a decision;
• Authorities and others where the law requires it, or where needed to protect the rights, property or safety of Factorik, our users or the public; and
• A successor, if Factorik is involved in a merger, an acquisition or a sale of assets, subject to this policy.

6. Where data is processed

Factorik is operated from Israel, and our service providers and the services you connect may process data in other countries, including the United States and countries in the European Economic Area. Where we transfer personal data out of the country it was collected in, we rely on a lawful mechanism for doing so, such as an adequacy decision or standard contractual clauses.

7. How long we keep it

• Account and organization data: for as long as the account or the organization exists.
• Run environments: destroyed when the run ends.
• Run records, proposals and merge decisions: for as long as the organization exists, or until deleted.
• Server logs of errors and warnings: about 14 days.
• Credentials: until you remove them or the organization is deleted.

When an account or an organization is closed we delete or anonymize its data within a reasonable time, except for what we must keep to meet a legal obligation, resolve a dispute or enforce our agreements, and for copies in backups, which expire on their own schedule.

8. How we protect it

We use technical and organizational measures suited to the risk, including encryption in transit, encryption of credentials at rest, an isolated environment for every run, short-lived and narrowly scoped access tokens for those environments, separation between organizations, and limited access by our own personnel. No system is perfectly secure, and we cannot guarantee the security of data. If you believe your account is at risk, write to [email protected] at once.

9. Cookies and similar storage

This website sets no advertising or cross-site tracking cookies. The Factorik application keeps a small amount of data in your browser’s storage that it strictly needs: your sign-in session and the organization you last had open. If we add analytics in future, we will update this policy first and ask for your consent where the law requires it.

10. Your rights

Depending on where you live, you have some or all of these rights over your personal data:

• to know whether we hold data about you, and to get a copy of it;
• to have data that is wrong, incomplete or out of date corrected or deleted;
• to have your data deleted, or its use restricted;
• to object to our use of it, including for direct marketing;
• to receive it in a portable form;
• to withdraw a consent you gave, without affecting what was done before; and
• not to be treated worse for using any of these rights.

These rights come, among others, from the Israeli Protection of Privacy Law, 5741-1981, the EU and UK General Data Protection Regulations, and the privacy laws of California and other US states. To use them, write to [email protected]. We may need to confirm who you are before acting, and we answer within the time the law sets. If your data is part of an organization’s content, we will pass your request to that organization.

If you think we have handled your data unlawfully, you may complain to the data protection authority where you live. In Israel that is the Privacy Protection Authority.

11. Children

The Service is for professionals and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to [email protected] and we will delete it.

12. Changes to this policy

We may update this policy as the Service or the law changes. We will post the new version on this page and change the effective date above, and where a change is material we will take reasonable steps to tell you beforehand, such as an email or a notice in the Service.

13. Contact

For any question about this policy or about your personal data, or to use your rights, write to [email protected].