Privacy Policy

Rami Code Review
Effective Date: January 1, 2026
Last Updated: October 2, 2026

1. Introduction

This Privacy Policy explains how Rami Code Review ("Rami," "Service," "we," "us," or "our") collects, uses, and protects your information when you use our AI-powered code review service at rami.reviews.

Data Controller: Rami Code Review is operated by ChangWon Lee, an individual based in the Republic of Korea. For data protection inquiries, contact: support@rami.reviews

By using the Service, you acknowledge that you have read and understood this policy.

2. Information We Collect

2.1 Information You Provide

Account Information:

Organization Information:

Payment Information:

Authentication Tokens:

2.2 Information from GitHub

When you install our GitHub App and use the Service, we access:

We only access repositories where you have installed the GitHub App.

GitHub App Permissions Requested:

2.3 Code You Submit

When you request a code review, we process:

Code is transmitted to third-party LLM providers for analysis.

2.4 Automatically Collected Information

Usage Data:

Technical Data:

Optional Analytics Data (only after you opt in):

Audit Logs:

3. How We Use Your Information

We use collected information to:

Purpose Legal Basis (GDPR)
Provide the code review service Contract performance
Process payments and manage subscriptions Contract performance
Enforce rate limits and quotas Legitimate interest
Prevent fraud and abuse Legitimate interest
Improve the Service Legitimate interest
Measure public site usage with Google Analytics Consent
Send service-related communications Contract performance
Comply with legal obligations Legal obligation
Maintain security and audit logs Legitimate interest

4. How We Share Your Information

4.1 Within Organizations

Installing the GitHub App or making a commit does not by itself create a Rami organization membership. An owner may preauthorize an existing Rami user or create an expiring invitation bound to an immutable GitHub account ID. The invitation creates membership only after the recipient signs in with that GitHub account and accepts it, even if the account's username has changed. Owners can view and revoke pending invitations. Acceptance can be retried safely for 24 hours. After that replay window, accepted records are eligible for deletion with revoked and expired records by our recurring retention process; actual deletion timing depends on successful completion of the scheduled process. Rami may also create or refresh membership when it begins processing an organization pull request whose author already has a Rami account.

If you are a member of an organization, the following information is visible to the organization owner:

4.2 Third-Party Service Providers

Provider Purpose Data Shared
LLM Providers (OpenRouter, OpenAI, Anthropic, xAI, Google, AWS Bedrock) Code analysis Code diffs; relevant repository file excerpts; repository instruction files; learned repository conventions; file paths; repository and pull request identifiers; pull request title and description; review comments and associated GitHub usernames; and recent commit metadata (including commit author and message)
TypeSafe (decision model provider) Classifying the intent of replies to Rami review comments, which decides how Rami responds The text of the Rami review comment and the text of the reply to it
Paddle Payment processing (merchant of record) Email, billing address, transaction data. Paddle acts as an independent data controller for payment processing and as our processor for transaction records. See Paddle's Privacy Policy.
GitHub App installation, PR access Installation tokens, comments
Google Analytics Optional public site usage measurement Public page views, interaction events, language, and technical request data. This provider is loaded only after you opt in and is not loaded on console or admin pages.
AWS Infrastructure hosting All service data

4.3 Legal Requirements

We may disclose information if required by law, legal process, or government request.

4.4 Business Transfers

In case of merger, acquisition, or sale of assets, your information may be transferred to the successor entity.

4.5 With Your Consent

We may share information for other purposes with your explicit consent.

5. Data Retention

Data Type Deletion Eligibility
Account information Until account deletion
Organization data Until organization deletion
Organization usage events 7 years (billing verification)
Member activity timestamps 7 years (billing verification)
Usage logs 90 days
Audit logs 1 year
Cached analysis and completed result snapshots Up to 7 days
Review finding lifecycle history 90 days
Reply-intent evaluation records 90 days
Payment records 7 years (legal requirement)
Organization invoices 7 years (tax compliance)
Session data 14 days of inactivity

After the stated period, records become eligible for deletion or anonymization by periodic background maintenance. A delayed or failed maintenance run may cause deletion to occur later; failed deletions are logged and retried on a later run.

6. Data Security

We implement industry-standard security measures including encryption in transit and at rest, access controls, and audit logging. Despite these measures, no system is 100% secure.

Data Breach Notification: In the event of a data breach affecting your personal information, we will notify affected users and applicable data protection authorities as required by law. For EEA residents, notification will occur within 72 hours of becoming aware of a breach that poses a risk to your rights and freedoms.

7. Your Rights

7.1 All Users

You have the right to:

7.2 European Economic Area (EEA) Residents

Under GDPR, you additionally have the right to:

7.3 California Residents (CCPA)

You have the right to:

We do not sell personal information as defined by CCPA.

Categories of Personal Information (preceding 12 months):

7.4 Exercising Your Rights

To exercise these rights, including requesting a copy of your account data or deletion of your account and personal data, contact us at support@rami.reviews. We will respond within:

We may need to verify your identity before processing requests.

8. International Data Transfers

Your data may be transferred to and processed in countries outside your residence, including:

For EEA residents, transfers are protected by:

EU Representative: As a Korea-based operator without an establishment in the EU, we have assessed our obligations under GDPR Article 27. Our processing of EU personal data is limited to users who actively install our GitHub App and request code reviews. Given the nature and scale of our processing, we have not appointed an EU representative. If you have concerns about this assessment or require assistance exercising your rights, contact us at support@rami.reviews.

9. Third-Party LLM and Model Providers

Code submitted for review is processed by third-party LLM providers, and replies to Rami review comments are classified by a decision model provider. We use the following providers:

Provider Data Retention Training Use Location
OpenAI 30 days (abuse monitoring) Opted out via API United States
Anthropic Not retained after processing Not used for training United States
Google (Gemini) Not retained after processing Opted out via API terms United States
OpenRouter Varies by underlying model Configured for no training United States
xAI Not retained after processing Not used for training United States
AWS Bedrock Not retained after processing Not used for training United States
TypeSafe Retained as long as reasonably necessary to provide the service Not used for training United States

Safeguards: We use API-based access with enterprise terms where available. Data is transmitted via encrypted connections (TLS 1.2+). To analyze a pull request, we send the relevant code diff and contextual repository data to LLM providers. Context may include relevant repository file excerpts fetched during evidence gathering, repository instruction files, learned repository conventions, file paths, repository and pull request identifiers, pull request title and description, review comments and associated GitHub usernames, and recent commit author and message. We do not send Rami account email addresses, billing information, authentication tokens, or organization membership records to LLM providers. To classify the intent of a reply to a Rami review comment, we send TypeSafe only the text of that Rami comment and the reply.

Enterprise Users: If your organization requires specific data processing agreements with LLM providers, contact us to discuss available options.

10. Cookies and Tracking

Cookie Purpose Duration
Session cookie Authentication 14 days of inactivity
CSRF token Security 24 hours
_ga Google Analytics visitor measurement, only after you opt in Up to 2 years
_ga_* Google Analytics session and campaign measurement, only after you opt in Up to 2 years

Analytics is disabled by default. Your choice is stored in your browser so Rami can honor it on later visits. You can change or withdraw that choice at any time through Analytics settings.

11. Children's Privacy

The Service is not intended for users under 16 years of age. We do not knowingly collect information from children. If we learn we have collected information from a child under 16, we will delete it within 30 days.

12. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be communicated via:

Material changes will be notified at least 30 days before taking effect.

13. Contact Us

For privacy-related questions or to exercise your rights:

Email: support@rami.reviews

EEA residents may lodge complaints with their local data protection authority.