Skip to main content
FeatureFactory

Legal / Trust

Privacy Policy

Last updated: July 2026. This policy describes how FeatureFactory collects, uses, and protects information about you when you use our service.

1. Who We Are

FeatureFactory ("we", "us", "our") is a software-as-a-service platform that helps engineering teams plan, build, and measure AI-assisted web development. References to "the service" mean the FeatureFactory application at featurefactory.com and any associated APIs.

For privacy questions, contact us at privacy@featurefactory.com.

2. Data We Collect

Account and Identity Data

When you register, we collect your name, email address, and (if you use OAuth) your GitHub or Google profile information. We do not store your OAuth access tokens beyond the minimum required to operate the integration.

Repository and Code Data

To score pull requests and generate AI recommendations, we read pull request diffs, commit messages, repository metadata, and contributor identifiers from the GitHub repositories you connect. This data is processed by our AI subprocessors (Anthropic, OpenAI) and stored in encrypted form in our database. See our Subprocessors page for full details on what is shared with each vendor.

Usage and Telemetry Data

We log page views, API calls, error events, and feature interactions to improve the product and debug issues. These logs contain IP addresses, browser user-agent strings, timestamps, and the actions taken, but do not include code content.

Billing Data

Payment is handled by Stripe. We receive and store a Stripe customer ID, subscription status, and billing email. We never see or store raw card numbers - those are held exclusively by Stripe.

3. How We Use Your Data

  • -Deliver and operate the service - scoring PRs, generating metrics, running build pipelines.
  • -Send transactional emails: account alerts, billing receipts, and security notices.
  • -Detect and prevent abuse, fraud, and security incidents.
  • -Improve the product by analysing aggregate usage patterns. We do not sell individual data to third parties.
  • -Comply with legal obligations where required by law.

4. Subprocessors

We share certain data with third-party vendors to operate the service. The full, current list is maintained on our Subprocessors page, which includes each vendor's country, the data shared, and a link to their own privacy policy. We will notify customers at least 14 days before adding or replacing a subprocessor that processes personal data or code content.

5. Data Retention

We retain account data for as long as your account is active. If you close your account, we delete your personal data within 30 days, except where a longer retention is required by law (for example, billing records may be retained for up to 7 years for tax purposes).

Code diffs and AI-scored PR content are retained while your team's data is active. Teams on paid plans can request early deletion by contacting support.

6. Security

Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). We use Cloudflare for DDoS protection and CDN. Access to production infrastructure is restricted to authorised personnel using multi-factor authentication.

If you discover a security vulnerability, please report it to security@featurefactory.com rather than opening a public issue.

7. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, email privacy@featurefactory.com with "Privacy Request" in the subject line. We will respond within 30 days.

8. Cookies

We use a session cookie to keep you logged in and a CSRF cookie to protect form submissions. We do not use third-party advertising or tracking cookies. No consent banner is required because we use only strictly necessary cookies.

9. Changes to This Policy

We may update this policy as the product evolves. Material changes will be announced via email at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.

10. Contact

For privacy enquiries, data deletion requests, or DPA negotiations, email privacy@featurefactory.com. We aim to respond within 2 business days.