Privacy Policy

1. Who We Are

MergeMind is a product of Cyber Global Technologies LLC ("CGT", "we", "us", or "our"). You can contact us at info@cyberglobal.ai.

2. What We Process

• PR diff content — the unified patch (+/- lines) of the pull or merge request being analyzed.
• Repository metadata — the minimum needed to fetch PR information (repo name, PR number, branch names).
• Configuration — settings from your repo's .pr-describer.yml, if present.

We do not access repository secrets or environment variables beyond the API key you explicitly provide as a GitHub/GitLab secret.

This section covers the CI action. For the data collected by this website, see Section 5.

3. Third-Party AI Processing

MergeMind runs entirely inside your own CI environment (GitHub Actions or GitLab CI) — it does not run on any MergeMind-operated server. When it runs, the PR diff is sent directly from your CI runner to OpenAI's API to generate the compliance analysis, title, and description. This happens using the OPENAI_API_KEY you provide as a CI secret; MergeMind's own infrastructure never sees or handles this content.

Data sent to OpenAI is subject to OpenAI's own API terms and data usage policies. Consult OpenAI's documentation for their current defaults on retention and model training.

4. Data Retention

Your PR diffs are never stored by MergeMind — they go directly from your CI environment to the LLM provider you configured, and the only record of a run lives in your own GitHub Actions or GitLab CI run history.

The only product data MergeMind stores is what's needed to deliver and validate licenses: the email address used at checkout, the license key, and the plan purchased. This is kept in a small key store operated by MergeMind. You can request access, correction, or deletion of this data at any time (see Section 9).

Website visit events are separate from this and are described in Section 5 below.

5. Website Analytics

Running the MergeMind action never touches this website. If you visit mergemind.dev, though, the page records a small amount of visit data so we can tell whether the site is working and where visitors come from:

• What we record — the page path you viewed, your country (derived at the network edge from your IP address by Cloudflare), the referring page, your browser's user-agent string, your screen width, and any campaign parameters (utm_source, utm_medium, utm_campaign, utm_content) in the link you arrived on.
• Identifiers — a randomly generated visitor ID kept in your browser's localStorage, and a session ID that expires after 30 minutes of inactivity. These are random values: they are not your name, email address, or IP address, and we do not use them to build a profile of you across other sites.
• Where it goes — events are written to a Supabase database operated by MergeMind. They are not sold, and not shared with advertisers. The site is served through Cloudflare, which also keeps standard request logs and may provide aggregate analytics.
• Retention — visit events are kept for aggregate traffic reporting for up to 24 months.
• Purchase events — when a license is purchased we also record the plan and the checkout email against the signup event, so we can reconcile sales.

Opting out. We honour Do Not Track and Global Privacy Control: if your browser sends either signal, the tracking script does not run at all and no visitor ID is stored. You can also opt out permanently at any time by running localStorage.setItem('cgt_optout','1') in your browser's developer console on this site, or by blocking requests to *.supabase.co.

6. Your Responsibilities

You are responsible for ensuring your organization's data policy permits sending PR diffs to your chosen LLM provider. If your repository may contain sensitive content unsuitable for a third-party AI provider, exclude or mask those files from the diff before MergeMind runs (e.g., via your own CI filtering).

7. Security

The GitHub Action requests only the minimum permissions it needs (pull-requests: write). Never commit your OPENAI_API_KEY or MERGEMIND_LICENSE_KEY to your repository — always store them as CI secrets.

8. Payment Information

License purchases are processed by Stripe via a Stripe Payment Link. We never see or store your card details. After checkout, we send the license key to the email address you provided at checkout; Stripe also sends you a receipt.

9. Your Rights

You may request access to, correction of, or deletion of any account/license data we hold by emailing info@cyberglobal.ai. Because PR diff content is never stored by MergeMind, there is nothing to delete on that front.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above.

11. Contact

Questions about this policy? Email info@cyberglobal.ai, or open a GitHub issue on the MergeMind repo.