Privacy Policy

1. Who We Are

GateTest ("we", "us", "our") operates gatetest.io, the GateTest command-line tool, the GateTest MCP server and the GateTest apps for GitHub and Gluecron. We are based in New Zealand.

This Privacy Policy explains what personal data we collect, why, how long we keep it, who we share it with, and the rights you have over it. It is written to meet the disclosure requirements of the New Zealand Privacy Act 2020, the EU and UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act as amended by the CPRA.

Our role. For the data you give us to run your account, take payment and deliver scans, we are the controller (the "agency" under New Zealand law). For personal data that happens to be inside the repositories you ask us to scan, you are the controller and we are your processor: that processing is governed by our Data Processing Addendum, which forms part of the Terms of Service.

Contact. For any question, request or complaint about your personal data, e-mail support@gatetest.io. We do not currently have a separate privacy or security mailbox; that address reaches the people who run the service.

2. Scope

This policy applies to everyone who visits gatetest.io, signs in, buys a scan or subscription, installs one of our git-host apps, runs the CLI or MCP server, or writes to us. It covers the hosted service and the telemetry the CLI can send; it does not cover what the CLI does entirely on your own machine with your own keys, which never leaves your computer.

It does not cover the practices of the git hosts, payment provider or other services we integrate with when they act on their own account. Their policies apply to the accounts you hold with them.

3. Information We Collect

Account

When you sign in with GitHub, GitLab or Google we receive your login name, display name and e-mail address from that provider, plus an OAuth access token. We request only the read:user and user:email scopes. The token is kept inside your encrypted session cookie (see the Cookie Policy) and is not stored in our database.

Payment

Checkout is hosted by Stripe. Your card number is entered on Stripe's pages and never reaches our servers. We keep your e-mail address, Stripe customer and payment identifiers, the tier you bought and the repository URL the scan is for. So that a receipt describes what was delivered, the module names that ran and the number of issues found are attached to the payment record.

Repository and scan data

To scan a repository we fetch an archive of it from your git host into memory (memoised for 120 seconds so a burst of pushes is not fetched repeatedly) and, for the hosted engine, into a temporary workspace on our server. The workspace is deleted when the scan finishes. We do not retain your source code after a scan.

We do retain the results: each finding (rule, message, file path, line number and a short excerpt, all capped in length), the pass/fail verdict, the score and the summary. We also keep scan-queue records: repository, commit SHA, ref and, for pull-request scans, the PR number.

We do not execute your code. Modules that would run customer-controlled programs (mutation, chaos, unitTests, integrationTests, e2e, lint) are skipped by the hosted engine and only run when you invoke them yourself in your own CI.

Telemetry

The CLI and hosted engine send a small usage signal after each scan: module names, rule identifiers, integer counts, verdict, duration, the source (CLI, MCP server, editor extension, CI or hosted) and a random per-scan identifier that lets us recognise a batch sent twice. It never includes code, file paths, repository names, finding text or any customer identifier, and the telemetry store keeps none attached. If you set GATETEST_API_KEY, that same upload also carries the key, so that the scan counts (never the findings) appear in your own account's usage meter; without it nothing is tied to you. It exists so that noisy rules can be found and quietened. Switch it off with GATETEST_NO_TELEMETRY=1 in your environment or "telemetry": false in .gatetest.json.

Technical

Our servers see your IP address and ordinary request metadata (URL, method, user agent, timestamps). We use it in memory for rate limiting and, through Sentry, for error monitoring. Sentry also records sampled browser session replays: 10% of sessions, and 100% of sessions in which an error occurs. Request bodies, source code, prompts, keys and cookies are scrubbed before anything is sent.

Cookies and browser storage

We set the minimum needed to keep you signed in and nothing for advertising. Every cookie and storage key is listed in the Cookie Policy.

Support

If you e-mail us we keep the correspondence, including anything you choose to attach, so we can help you and refer back to it. Please do not send secrets or full source files unless we ask.

4. How We Use Information

• To deliver the service — run the scans you request, post commit statuses and pull-request comments, open auto-fix branches, send receipts and scan digests.
• To take payment — create checkout sessions, reconcile webhooks, run the billing portal and handle refunds under the Refund Policy.
• To generate AI review and fixes — send the files being reviewed to Anthropic (and, if you opt in on a Forensic scan, a second provider) as described in AI processing.
• To keep the service secure and available — rate limiting, abuse prevention, error monitoring, and the audit log of security-relevant actions.
• To improve detection quality — anonymous telemetry that tells us which rules fire too often, with no link back to you.
• To communicate with you — service messages about your scans, account and changes to these policies. We do not send marketing e-mail.
• To meet legal obligations — tax and accounting records, and responding to lawful requests.

We do not sell personal data, use it for advertising, build profiles for third parties, or use your source code to train any model.

5. Legal Bases (GDPR and UK GDPR)

Where the EU or UK GDPR applies, we rely on the following bases under Article 6(1):

• Contract (Art. 6(1)(b)) — account, payment, repository and scan data needed to provide what you bought and to support you.
• Legitimate interests (Art. 6(1)(f)) — securing the service and preventing abuse; rate limiting; monitoring and fixing errors; keeping an audit log of security-relevant actions; improving rule accuracy from anonymous telemetry; establishing, exercising or defending legal claims; and sending service messages. We have weighed each of these against your interests and you may object at any time (see Your Rights).
• Consent (Art. 6(1)(a)) — optional integrations you switch on yourself (for example a Gluecron repository, a notification webhook, or a second-opinion AI provider). Telemetry can be switched off at any time with GATETEST_NO_TELEMETRY=1. Withdrawing consent does not affect processing that already happened.
• Legal obligation (Art. 6(1)(c)) — tax and accounting records, and responding to lawful requests from authorities.

6. AI Processing

The deterministic scan — the modules that produce the verdict — uses no AI and sends nothing to any model provider.

AI review and auto-fix (Scan + Fix, Forensic, the fix_issue and explain_finding MCP tools, and gatetest fix in the CLI) send the complete contents of each file being reviewed or fixed, its path and the finding text to Anthropic (Anthropic, PBC). We send whole files rather than snippets because a fix that cannot see the surrounding code is usually a wrong fix.

Anthropic holds API inputs and outputs under its standard 30-day retention. We are not on a zero-data-retention arrangement, and we say so plainly so that you can decide which repositories to point the AI features at. Under Anthropic's commercial terms your content is not used to train its models.

Bring your own key. If you supply your own API key (the CLI and MCP server always use yours; the hosted fix route accepts one per request) it is used for that request only and is never stored, logged or echoed back.

Second opinion. On a Forensic scan you may opt in to a consensus pass that also sends the files being fixed to OpenAI (OpenAI, L.L.C.). Nothing goes there unless you turn it on.

AI output is a suggestion. Every fix is delivered as a branch or pull request for a human to review; we never merge to your default branch.

7. Sharing and Sub-processors

We never sell personal data and we never share it for advertising. We disclose it only to:

• Sub-processors — the providers below, each bound by a data-processing agreement and receiving only what its function needs.
• Your git host — GitHub or Gluecron, which receives the statuses, comments and branches you asked us to write back.
• Recipients you configure — for example a notification webhook you supply.
• Authorities — where the law requires it, and only after we have checked that the request is valid. We will tell you unless we are legally prevented from doing so.
• A successor — if GateTest is acquired or merges, under the same commitments as this policy.

The full list records the legal entity, exactly what data each provider receives, and a link to its data-processing terms. It is updated before any new provider is added.

8. International Transfers

We are in New Zealand and most of our providers are in the United States, so personal data leaves the country in which it was collected. We rely on:

• EU — the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), incorporated in each provider's data-processing agreement.
• UK — the International Data Transfer Agreement or the UK Addendum to the EU clauses, likewise through the provider's agreement.
• New Zealand — Information Privacy Principle 12 of the Privacy Act 2020: we disclose personal information overseas only to recipients bound to comparable safeguards, which is what those agreements provide.

You can ask us for a copy of the transfer terms that apply to your data.

9. Data Retention

Each window below is either enforced by code or requires an action by you. We do not delete customer data without your instruction; we do not currently run an automatic purge of scan findings.

10. Security

All traffic is encrypted in transit. Your session cookie is encrypted and signed, HttpOnly and Secure. Secrets live in environment configuration, never in code. Git-host access uses short-lived installation tokens with the narrowest permissions the feature needs. Scan workspaces are deleted when the scan ends, and the hosted engine does not execute your code. Error reports are scrubbed of bodies, code, prompts, keys and cookies before they leave our process.

What we do and do not have — including which certifications we hold — is set out on Trust & Security. No transmission or storage is perfectly secure; if you believe your data has been compromised, e-mail us immediately.

11. Your Rights

Wherever you are, you can ask us to:

• Access — confirm whether we hold personal data about you and receive a copy.
• Correct — fix data that is inaccurate or incomplete.
• Erase — delete your account and the data we hold, subject to records the law requires us to keep.
• Restrict — pause processing while a dispute is resolved.
• Port — receive the data you gave us in a structured, machine-readable format.
• Object — to any processing based on legitimate interests.
• Withdraw consent — for any optional integration or telemetry, at any time.
• Complain — to the New Zealand Office of the Privacy Commissioner (privacy.org.nz), to your EU data-protection authority, or to the UK Information Commissioner's Office. We would rather hear from you first.

How. E-mail support@gatetest.io from the address on your account, saying which right you are exercising. Requests are handled by e-mail; there is no self-serve export or deletion tool yet. We may ask for enough information to confirm you are the account holder.

When. Within 20 working days under the New Zealand Privacy Act 2020, and within one month under the GDPR and UK GDPR (extendable by two further months for complex requests, in which case we will tell you why). Requests are free unless they are manifestly unfounded or excessive.

12. California Privacy Rights

This section is the notice at collection for California residents under the CCPA as amended by the CPRA. In the preceding 12 months we have collected these categories of personal information:

Sources are you, your git host and your browser. We disclose these categories only to the service providers on the sub-processor list for the purposes above. We do not sell or share personal information, have not done so in the preceding 12 months, and do not use sensitive personal information for any purpose that would trigger a right to limit.

• Right to know what we have collected about you and to delete or correct it.
• Right to non-discrimination — exercising a right does not change the price or quality of the service.
• How to exercise — e-mail support@gatetest.io. We respond within 45 days and may extend once by a further 45 days with notice. An authorised agent may submit a request with your signed permission; we will still verify with you directly.
• Global Privacy Control — we honour GPC signals as an opt-out of sale or sharing. Because we do not sell or share personal information, the signal changes nothing about advertising: there is none.

13. Children

GateTest is a developer tool for adults and organisations. It is not directed at anyone under 16, and we do not knowingly collect personal data from anyone under 16. If you believe a child has created an account, e-mail us and we will delete it.

14. Automated Decision-making

Scan verdicts are produced automatically by rules and, where you choose it, by AI. They describe code, not people, and have no legal or similarly significant effect on you. Whether a verdict blocks a merge is a setting you control in your own CI. If you want a person to look at a result, e-mail us and one will.

15. Data Breaches

If a security incident affects your personal data we will notify you without undue delay, and where the GDPR applies within 72 hours of becoming aware, with what happened, what data was involved, what we have done and what you should do. Where the New Zealand Privacy Act 2020 requires it, we will also notify the Office of the Privacy Commissioner. Where we are your processor, we will give you what you need to meet your own notification obligations under the DPA.

16. Changes to This Policy

When we change what we collect, who we share it with or how long we keep it, we update this page and its effective date and e-mail account holders before the change takes effect. Clarifications and corrections may be published without notice. The current version is always the one at this address.

17. Contact

GateTest — support@gatetest.io. Contact is by e-mail.

Include the e-mail address on your account so we can find your records.