01Who holds your data
Avancei Tecnologia LTDA, Curitiba, PR, Brazil, is the controller for the data described here. Data-protection requests go to legal@crewbit.sh; our data-protection officer is Emerson Almeida.
02What we hold
Your account. The identifier, name and email your identity provider gives us, and which orgs you belong to.
Your configuration. Projects, the sources attached to them, the verify command, the base branch, fix-round limits and turn budgets.
Run state and its context. Because the Run is our source of truth rather than a label on your issue, we store the state, the stage, the fix-round count and the outcome, and the text each stage read or produced: the Spec title and body as cached from your provider, its comments, the plan, the verdict, and the evidence a verdict cites. That text can quote your source code.
Operational records. Structured log lines from the server and from your runners, including timings, turn counts, rate-limit events and estimated cost per stage; runner connections, versions and slots.
Credentials. The provider credential you grant, and hashes of the runner credentials you mint, encrypted at rest.
Billing. Plan, org, and the identifiers our payment processor returns. We never see your card.
03What we do not hold
Your repository. The clone lives on your runner and is deleted with its workspace; we hold no copy of your tree. We also never receive your model credential: your runner talks to your own Claude Code, and that session is between you and its vendor. Nothing in this policy covers what that vendor does with what it is sent; read their terms.
04Why we hold it, and on what basis
To run the service you asked for (performance of a contract under art. 7, V of the LGPD). To keep it working and secure, to bill it, and to compute the metrics the product judges itself by, aggregated over your org's own Runs (legitimate interest under art. 7, IX). We do not sell data, we do not use your Spec text, plans or code to train a model, and we do not profile you.
05Who processes it with us
Cloudflare (application hosting and the runner socket), Supabase (the database and sign-in), Stripe (billing) and PostHog (aggregate page and product events). Each is bound by a processing agreement and none receives more than it needs. The list changes as the stack does, and this section changes with it.
06Where it lives, and for how long
The application runs on Cloudflare's network, which serves a request from wherever you are, and the database it reads runs in eastern North America. So your data is processed outside Brazil; that transfer relies on being necessary to perform the contract you entered into with us, under art. 33, V of the LGPD. Run state and its context are kept while your org exists and for 30 days after you delete it. Operational logs are kept 90 days. Billing records are kept as long as tax law requires. Deleting a Project deletes its Runs.
07Your rights
Under the LGPD you may ask what we hold about you, correct it, ask for it to be anonymised, blocked or deleted, ask for it in a portable form, know who we share it with, and withdraw consent where consent is the basis. Write to legal@crewbit.sh and we will answer within 15 days. If our answer does not satisfy you, you may complain to the ANPD.
08Cookies and analytics
The app sets the cookies its sign-in needs. The marketing site records aggregate events (which page was opened, which plan was clicked) without a profile of you across sites and without advertising cookies.
09Security, and what we would tell you
Credentials are encrypted at rest, a runner credential is shown once and stored as a hash, and access to an org's data is scoped to its members. If a breach reached your data we would notify you and the ANPD, with what happened and what to do about it, rather than a statement about how seriously we take security.
10Changes
A new version is posted here with its date. If a change means we hold something new, we say what and why before it starts.