Git AutoReview

GDPR overview

Git AutoReview never calls itself “GDPR compliant” in so many words, but its privacy policy is built around the regulation. Effective 5 January 2026, it names a legal basis for each purpose — contract performance for the licence, legitimate interest for improvement and security, consent where required — and splits the roles explicitly: the publisher is controller for the website and the licensing system, and processor for the code review itself. Section 7.1 lists seven data subject rights (access, rectification, erasure, restriction, portability, objection, withdrawal of consent), exercised via privacy@gitautoreview.com and answered within 30 days; CCPA and CPRA rights are covered as well, and under-16s are excluded. Transfers outside the EEA rely on Standard Contractual Clauses, the main infrastructure sitting in the EU. Missing: no Article 27 EU representative, no named DPO, no DPA, and no SOC 2 or ISO 27001 certification claimed by the publisher.

Who owns the data?

Under the terms you keep every ownership right in the code you submit; the publisher claims no ownership interest in it (8.2). It also assigns you all rights in the Output, the generated review comments and suggestions (8.3), while noting that similar code may produce similar or identical Output for other users. The publisher takes only a limited, non-exclusive licence to process your code for the sole purpose of delivering the service (8.4), and states that it never uses your code to train AI models. The extension, the website and the documentation remain its property (8.1). Under the GDPR it is controller for the website and the licensing system, and processor for the code review itself.

Reuse rights

The review comments and suggestions generated from your own code are assigned to you, so you can read, edit, publish and ship them without asking permission, in commercial work included. The restrictions apply to the product rather than to the Output: your licence to the extension is limited, non-exclusive, non-transferable and revocable, and covers installation, internal use and use of the Outputs (clause 5.1). You may not reverse-engineer the service, create derivative works from it, resell or sublicense it, use it to build a competing product, or share your licence key (5.2). The assignment covers only Output derived from your own inputs, and you warrant that you hold the rights to the code you submit (6.2).

Data retention & training

Hosting summary

Source code is never hosted. It leaves VS Code for the AI provider you selected and is discarded once the review is done, with no cache on the publisher's side. API keys and Git tokens also stay local, in VS Code's SecretStorage backed by the operating system keychain. What is hosted is the surrounding service: Supabase, located in the EU, handles licence validation and usage tracking; Render hosts the website and web services; Whop processes payments and licence delivery; Google Analytics with IP anonymisation and Microsoft Clarity session recordings provide analytics. All data in transit is encrypted with TLS 1.3. International transfers are possible, since the AI providers may process data in the United States, and they rely on Standard Contractual Clauses, with the main infrastructure in the EU. No specific hosting country is named; only the EU region is stated. The website's IP resolves to a Cloudflare anycast node, which says nothing about where anything is actually hosted. The governing law is Ukrainian (terms 14).