Privacy policy
Last updated: 27 October 2026 (draft)
Draft: to be reviewed by a lawyer before launch. This text is a working draft and not yet a binding agreement. Items in square brackets, such as [Company name], [Address] and [Contact email], are placeholders.
This policy explains how [Company name], [Address] ("we"), the controller of your personal data, handles it when you use airepeat. Contact: [Contact email].
What we collect
- Account data: name, email address, password hash, two-factor settings, and when you accepted our terms.
- Workspace data: sites, settings, team members and the audit log of actions taken.
- Provider keys: the keys you add for GitHub, server providers, Cloudflare and AI providers, stored encrypted.
- Technical data: IP address, browser details and request logs, used for security and rate limiting.
- Messages: what you send us, including abuse reports.
The public website does not use advertising or tracking cookies. The dashboard uses cookies needed to keep you signed in, and your browser stores your light or dark theme choice.
Why we use it
- To provide the service you asked for (contract).
- To keep the service secure, prevent abuse and enforce our policies (legitimate interests).
- To send account emails such as verification, password resets and alerts (contract).
- To meet legal obligations.
Who we share it with
- The providers you connect, when the service acts on your behalf (for example GitHub or your AI provider). Their privacy policies apply.
- Our own suppliers, such as hosting and email delivery: [list of processors].
- Authorities, where the law requires it.
We do not sell personal data.
International transfers
[Describe where data is hosted and the safeguards used for transfers.]
How long we keep it
Account and workspace data are kept while your account is open. When you delete your account, we delete or anonymise it within [n] days, except where we must keep records longer by law. Backups roll over within [n] days.
Your rights
Depending on where you live, you can ask to access, correct, export or delete your data, object to or restrict processing, and complain to your data protection authority. You can export your data and delete your account from the dashboard, or email [Contact email].
Security
Provider keys are encrypted at rest and never shown again after you save them. Access within the service is limited by role and recorded in the audit log.
Changes
We will tell you about material changes to this policy by email or in the dashboard.