Privacy Policy

MacroDeploy is operated by Sakamoto Labs LLC (“we”, “us”). This policy explains what we collect, why, and your choices. We designed MacroDeploy to keep your code and AI usage under your control.

The short version

• Your source code stays yours. Audits run in your own environment (your editor or your CI) using your AI credential. We don’t receive or store your source code.
• You bring your own AI key. Your Anthropic/OpenAI credential is used to run the AI; we never use it for anything else.
• We store the minimum needed to run the service and show your results.

What we collect

• Account info — your name, email, and avatar from Google/GitHub sign-in, and your GitHub login when you connect a repository.
• Audit results — if you choose to save an audit, we store its findings (file paths, line numbers, short descriptions) and summary statistics against your account so you can view history.
• Credentials you choose to store — if you opt to save an Anthropic/OpenAI API key or token with us (to sync to the editor or write to your repos), it is encrypted at rest (AES-256-GCM) and transmitted only over HTTPS. You can remove it at any time.
• Configuration — repositories you connect, preferences (models, settings), and API tokens you create (only a hash of each token is stored).
• Operational logs — standard request/error logs for reliability and abuse prevention.

What we do NOT collect

• Your source code (it is read locally or in your CI by the AI under your credential).
• The contents of your prompts to the AI provider.
• Payment card numbers — payments, if any, are processed by our payment provider, not stored by us.

How we use it

• To provide the service: run audits, save and display your results, apply your settings.
• To secure the service and prevent abuse.
• To communicate with you about the service.

We do not sell your data, and we do not use your code or audit results to train models.

Third parties (sub-processors)

• Anthropic / OpenAI — the AI provider you choose; your code is processed under your own credential per their terms.
• Google Cloud — hosting and database.
• GitHub — when you connect a repository via the GitHub App.
• Google / GitHub — sign-in.

See the full, current list with purposes and transfer safeguards on our sub-processors page.

Data retention

We keep account and saved-audit data until you delete it or close your account. Stored credentials are deleted when you remove them. You can request deletion of your data at any time (see Contact).

Your rights & choices

• Access, correct, or delete your data.
• Revoke API tokens and remove stored credentials in your account.
• Uninstall the GitHub App or the editor extension at any time.

Security

Credentials are encrypted at rest and in transit; tokens are stored only as hashes; secrets written to your repositories use GitHub’s encrypted secrets API. No system is perfectly secure, but we follow least-privilege and defense-in-depth practices.

European Economic Area, UK & Switzerland (GDPR)

Controller: Sakamoto Labs LLC, 3206 NE 2nd Ave #1059, Miami, FL 33137, USA. We are the controller for your account data; for the repository content processed during a run we act as a processor on your behalf — a Data Processing Agreement is available on request at privacy@sakamotolabs.com.

Lawful bases: performance of our contract with you (providing the service), our legitimate interests (securing the service, preventing abuse), legal obligations (e.g. retaining billing records), and your consent where required.

International transfers: we are US-based and use US sub-processors, so your data is transferred to the United States. We rely on the EU–US Data Privacy Framework where the provider is certified, and on Standard Contractual Clauses (included in each sub-processor's DPA). See our sub-processors.

Your GDPR rights: access, rectification, erasure, restriction, portability, and objection. You can export or permanently delete all your data yourself from your account (Data & privacy), or email us. You also have the right to lodge a complaint with your local data-protection supervisory authority.

Retention: we keep account and saved-audit data until you delete it; deletion is immediate and irreversible.

Contact

Questions or requests: privacy@sakamotolabs.com.