Sign in Sign Up

Privacy Policy

Last updated: 20 May 2026

This Privacy Policy describes how Control Group Services, LLC (a Pennsylvania limited liability company, referred to here as “Bridgekeeper,” “we,” “us,” or “our”) collects, uses, and discloses personal information when you visit bridgekeeper.io (the “Site”) or use the Bridgekeeper GitHub App and associated web application (together, the “Product”). It applies to personal information about visitors, users who sign in, and pull-request authors whose repositories install the GitHub App.

Bridgekeeper is the data controller for the personal information described below. For the purposes of the EU and UK General Data Protection Regulation (collectively, “GDPR”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), and comparable laws, Bridgekeeper acts as the “controller” (GDPR) or “business” (CCPA) with respect to the data covered here. For pull-request content processed on behalf of a customer organisation, we act as a “processor” or “service provider” for that organisation under a separate data processing addendum.

1. The data we collect

Marketing site

If you submit the contact form on the Site, we collect the name, email address, and free-text message you provide. We also store a salted hash of your IP address and a timestamp to detect and block abuse of the form. Our hosting provider keeps short-lived web access logs (IP, user-agent, requested path, response code) for up to 14 days for operational and security purposes.

Web application sign-in

When you sign in to the Bridgekeeper web application using “Sign in with GitHub” or “Sign in with Google,” we receive from those providers your account identifier, your primary verified email address, your display name, and your avatar image URL. We do not receive your password. We use these values to create your account, link sessions to your identity, and contact you about your use of the Product. If you connect both providers we merge them by verified email address.

The GitHub App (pull-request content)

When an organisation installs the Bridgekeeper GitHub App on a repository and a pull request is opened, GitHub sends us a webhook event. To produce a review we then read, via the GitHub API:

  • repository, branch, pull-request, and commit metadata;
  • the diff of the pull request and the files it touches;
  • the pull-request title, description, and existing review comments;
  • the GitHub login of the pull-request author and reviewers.

We store the resulting review session, the salient changes we identified, the Socratic questions we generated, the author’s free-text answers, our judge model’s verdicts, and any predictions reviewers submitted before reveal. Source code is read as input to the review process; we do not republish it, and it never leaves your repository except to the sub-processors named below.

Cookies and similar technologies

The Site itself does not set marketing or advertising cookies. The Product sets the following first-party cookies when you sign in or visit an authenticated page:

  • a session cookie issued by Django to keep you signed in;
  • a CSRF token cookie used to protect form submissions;
  • an allauth state cookie used during the OAuth sign-in flow.

We also use PostHog for product analytics. PostHog sets one or more first-party cookies on the Product domain to give each browser a stable identifier and to remember whether you have opted out of analytics. PostHog is configured to mask form inputs and to drop IP addresses at ingestion. You can opt out of analytics at any time from the “Account” page in the Product, or by enabling Global Privacy Control / Do Not Track in your browser, which we honour.

Diagnostic data

When the Product encounters an error we send a diagnostic event to Sentry. These events contain a stack trace, the URL path, the HTTP method, and (where present) your account identifier. We scrub request and response bodies, query strings, headers, and environment variables before they leave our servers.

2. How we use your data

We process the data described above to:

  • operate the Site and the Product, including signing you in and posting review comments back to GitHub;
  • generate review questions and verdicts on pull requests submitted through an installed repository;
  • respond to contact-form submissions and account-related email;
  • detect, investigate, and prevent abuse, fraud, and security incidents;
  • measure aggregate product usage and improve the Product;
  • comply with legal obligations and enforce our Terms of Service.

We do not sell personal information. We do not share personal information for cross-context behavioural advertising. We do not use your data, your repositories’ code, or your review transcripts to train any machine-learning model that we or our sub-processors operate. See the sub-processor section for the contractual guarantees that back this up.

3. Legal bases (EU, UK, and Swiss residents)

Where GDPR applies, we rely on the following legal bases:

  • Contract: to provide the Product to you and to the organisation that installed it (Article 6(1)(b));
  • Legitimate interests: to keep the Site and Product secure, to prevent abuse, and to understand aggregate usage (Article 6(1)(f)). You can object at any time using the contact details below;
  • Consent: for optional product analytics where required by local law (Article 6(1)(a)). You can withdraw consent at any time without affecting prior processing;
  • Legal obligation: to comply with tax, accounting, and lawful requests from authorities (Article 6(1)(c)).

4. Sub-processors and where data goes

We use the following sub-processors to operate the Site and the Product. Each is bound by a written agreement that restricts its use of your data to providing services to us.

  • Amazon Web Services, Inc. (United States): cloud hosting, application compute, database, and backups. Region: us-east-1 with encrypted cross-region replication.
  • GitHub, Inc. (United States): source platform from which we receive pull-request webhooks and pull pull-request content under the permissions you granted at installation.
  • Anthropic, PBC (United States): large-language-model API used to identify salient changes, generate questions, and judge answers. Used under Anthropic’s Commercial Terms with the zero-data-retention and no-training options enabled, so inputs are not retained by Anthropic after a request completes and are not used to train Anthropic’s models.
  • OpenAI, L.L.C. (United States): alternative LLM provider, used only when a customer workspace selects it. Used under OpenAI’s API Data Processing Addendum with zero-retention enabled; inputs are not used to train OpenAI’s models.
  • Google LLC (United States): alternative LLM provider via the Gemini API, used only when a customer workspace selects it. Used under the Google Cloud Data Processing Addendum; inputs are not used to train Google’s foundation models.
  • Postmark (ActiveCampaign, LLC) (United States): transactional email delivery (account email and replies to contact-form submissions).
  • Functional Software, Inc. (Sentry) (United States): error tracking. Configured with server-side data scrubbing.
  • PostHog Inc. (United States): product analytics. Configured with IP-address masking and form-input redaction; we use the EU-hosted PostHog Cloud for visitors who connect from the EU and UK.

We may engage additional sub-processors as the Product grows. We will update this page before any new sub-processor begins processing your data, and customer organisations under a data processing addendum will receive prior written notice and a right to object.

5. International transfers

Bridgekeeper is based in the United States and processes data there. If you access the Product from the EU, the UK, or Switzerland, your personal information will be transferred to the United States. For these transfers we rely on the European Commission’s Standard Contractual Clauses (Decision 2021/914) and the UK International Data Transfer Addendum, with the supplementary measures recommended by the European Data Protection Board where applicable. A copy of the clauses in force with a given sub-processor is available on request to privacy@bridgekeeper.io.

6. How long we keep your data

We retain personal information for the periods set out below. We delete or anonymise data sooner if you ask us to and we have no overriding legal obligation to keep it.

  • Contact-form submissions: 24 months after the last related correspondence, then deleted.
  • Account profile (name, email, avatar URL, OAuth identifiers): for the life of your account, plus 30 days for encrypted backups after deletion.
  • Review sessions, pull-request diffs, questions, answers, and verdicts: for the life of the workspace whose GitHub App produced them. When the GitHub App is uninstalled from a repository, the associated sessions are deleted within 30 days, plus a further 30 days for encrypted backups.
  • Webhook event log: 90 days, for incident replay and debugging.
  • Sentry error events: 90 days from the date of the event.
  • PostHog analytics events: 12 months, after which event-level rows are aggregated and the originals deleted.
  • Web access logs and salted IP hashes: 14 days.

7. How we protect your data

We encrypt personal information in transit (TLS 1.2 or higher) and at rest. Access to production systems is limited to the small number of Bridgekeeper personnel who need it, gated by single sign-on and hardware-backed multi-factor authentication, and logged. We use short-lived GitHub App installation tokens scoped to the installing organisation, and we never store long-lived personal access tokens belonging to your users. No system is perfectly secure; if we become aware of a personal-data breach affecting you we will notify you and any relevant supervisory authority as required by law.

8. Your rights (EU, UK, and Switzerland)

If GDPR applies to you, you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased, subject to limited exceptions;
  • restrict or object to certain processing;
  • receive your data in a portable, machine-readable format;
  • withdraw consent where we rely on it, without affecting prior processing;
  • lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner’s Office (ico.org.uk).

To exercise any of these rights, email privacy@bridgekeeper.io. We will respond within 30 days. We may ask you to verify your identity before acting on a request. Where the data was provided to us by a customer organisation that installed the GitHub App, we will refer your request to that organisation.

9. California residents (CCPA / CPRA)

If you are a California resident, you have the following rights with respect to the personal information we collect about you:

  • the right to know what categories and specific pieces of personal information we have collected, the sources, the purposes for collection, and the categories of recipients;
  • the right to delete personal information we have collected, subject to limited exceptions;
  • the right to correct inaccurate personal information;
  • the right to limit our use of sensitive personal information (we do not currently process “sensitive personal information” as defined by the CPRA);
  • the right to opt out of sale or sharing. We do not sell personal information, and we do not share personal information for cross-context behavioural advertising;
  • the right not to be retaliated against for exercising these rights.

Categories of personal information we have collected in the last 12 months, using the CCPA’s defined categories:

  • Identifiers: name, email address, GitHub login, Google account identifier, avatar URL, salted IP hash.
  • Internet or other electronic network activity information: pages viewed, actions taken in the Product, referring URL, error events, approximate session timing.
  • Geolocation data: only approximate, derived by PostHog from IP address before the IP is dropped.
  • Professional or employment-related information: the GitHub organisation or repository you have access to, to the extent it appears in the content we process.

To submit a request, email privacy@bridgekeeper.io. You may use an authorised agent; we will ask the agent to provide signed permission from you and may verify the request with you directly.

10. Children

The Site and the Product are not directed at children under 16, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please email privacy@bridgekeeper.io and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the date of the most recent change. If we make material changes we will notify you by email (where we have your address) or by an in-Product notice before the changes take effect.

12. How to reach us

Questions about this Privacy Policy, or about how we handle your personal information, can be sent to privacy@bridgekeeper.io. Bridgekeeper is operated by Control Group Services, LLC, a Pennsylvania limited liability company.