Privacy Policy

Effective Date: January 1, 2025

Sluice ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our CI/CD platform and services (the "Service").

By using the Service, you consent to the data practices described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.

1. Information We Collect

We collect information in several ways depending on how you interact with our Service.

1.1 Information You Provide

• Account Information: When you create an account, we collect your email address, name, and organization name.
• Payment Information: When you subscribe to a paid plan, payment information is collected and processed by our payment processor, Stripe. We do not store your full credit card number on our servers.
• Pipeline Configurations: Configuration files and settings you create for your CI/CD pipelines.
• Support Communications: Information you provide when you contact us for support or feedback.

1.2 Information Collected Automatically

• Usage Data: Information about how you use the Service, including pages visited, features used, and actions taken.
• Device Information: IP address, browser type, operating system, and device identifiers.
• Build Logs: Output from your CI/CD pipeline executions, including stdout and stderr streams.
• Audit Logs: Records of actions taken within your account for security and compliance purposes.

1.3 Information from Third-Party Integrations

When you connect the Service to third-party platforms, we may collect information from those platforms:

• GitHub: Repository metadata, commit information (SHA, author name, author email, commit message), branch names, and pull request details. If you provide a Personal Access Token (PAT), we store it in encrypted form to access private repositories on your behalf.
• Container Registries: Credentials for pushing and pulling container images, stored in encrypted form.

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Provide and Maintain the Service

• Execute your CI/CD pipelines and deployments
• Store and display build logs and pipeline status
• Process payments and manage your subscription
• Send transactional emails (e.g., build notifications, account alerts)

2.2 Improve and Develop the Service

• Analyze usage patterns to improve features and user experience
• Identify and fix bugs and performance issues
• Develop new features based on user needs

2.3 Security and Compliance

• Detect and prevent fraud, abuse, and security incidents
• Enforce our Terms of Service and Acceptable Use Policy
• Comply with legal obligations

2.4 Communications

• Respond to your inquiries and support requests
• Send important notices about the Service
• With your consent, send marketing communications (you can opt out at any time)

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:

• Contract: Processing necessary to perform our contract with you (e.g., providing the Service, processing payments).
• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving the Service, preventing fraud, and ensuring security, where these interests are not overridden by your rights.
• Consent: Processing based on your consent (e.g., marketing communications). You may withdraw consent at any time.
• Legal Obligation: Processing necessary to comply with legal requirements.

4. Data Sharing and Subprocessors

We do not sell your personal information. We may share your information with:

4.1 Service Providers (Subprocessors)

We use third-party service providers to help us operate the Service. These providers have access to your information only to perform specific tasks on our behalf and are obligated to protect it:

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Valid legal process (e.g., subpoena, court order)
• Government requests
• To protect our rights, privacy, safety, or property
• To enforce our Terms of Service

4.3 Business Transfers

If Sluice is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.

5. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy:

After account deletion, we may retain certain information as required by law or for legitimate business purposes (e.g., resolving disputes, enforcing agreements).

6. Data Security

We implement industry-standard security measures to protect your information:

• Encryption at Rest: Sensitive data, including secrets and credentials, is encrypted using AES-256-GCM encryption.
• Encryption in Transit: All data transmitted between you and our servers is encrypted using TLS 1.2 or higher.
• Access Controls: We use row-level security and strict access controls to ensure data isolation between tenants.
• Audit Logging: We maintain comprehensive audit logs of system access and data modifications, with automatic redaction of sensitive fields.
• Regular Security Reviews: We regularly review and update our security practices.

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Your Rights

7.1 Rights Under GDPR (EEA, UK, Switzerland)

If you are located in the EEA, UK, or Switzerland, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (subject to legal retention requirements).
• Restriction: Request that we limit how we use your data in certain circumstances.
• Data Portability: Request a copy of your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests or for direct marketing.
• Withdraw Consent: Withdraw consent where processing is based on consent.

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

7.2 Rights Under CCPA/CPRA (California)

If you are a California resident, you have the following rights:

• Right to Know: Request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of your personal information (subject to certain exceptions).
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Notice: We do not sell personal information as defined by the CCPA/CPRA. We do not use or disclose sensitive personal information for purposes other than those permitted by the CPRA.

7.3 Exercising Your Rights

To exercise any of your privacy rights, please contact us at [email protected]. We may need to verify your identity before processing your request.

8. International Data Transfers

Sluice is based in the United States, and we process and store data on servers located in the United States. If you are located outside the United States, your information will be transferred to and processed in the United States.

For transfers from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to provide appropriate safeguards. For enterprise customers requiring a Data Processing Agreement with SCCs, please contact us at [email protected].

9. Cookies and Tracking

We use minimal cookies and similar technologies to operate the Service:

• Essential Cookies: Required for the Service to function (e.g., authentication, session management).
• Analytics: We may use analytics services to understand how users interact with the Service. These services may use cookies to collect usage data.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Service.

10. Children's Privacy

The Service is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will delete that information promptly. If you believe we have collected information from a child under 16, please contact us at [email protected].

11. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by:

• Posting the updated Privacy Policy on this page with a new effective date
• Sending you an email notification (for material changes)

Your continued use of the Service after the effective date of the revised Privacy Policy constitutes your acceptance of the changes.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Sluice
Email: [email protected]
Website: https://sluice.dev

For EEA residents: You also have the right to lodge a complaint with your local data protection authority.