Privacy Policy
Who we are
Jade is a code intelligence platform operated by Niv Navick, an individual (sole proprietor) based in Israel ("Jade", "we", "us", "our"), who is the controller of the personal data this policy describes.
This policy explains what information we collect when you use Jade, why we collect it, who else can reach it, how long we keep it, and the choices you have. It covers our website, the Jade application, and the interfaces through which your development tools connect to it.
Scope of this policy
This policy applies to two different groups of people, and the distinction matters for your rights:
- Visitors and account holders. People who browse our website, create a Jade account, or use the platform on behalf of an organisation. For their personal data we act as the controller.
- Individuals whose personal data appears inside a customer's content. Source code, commit metadata and configuration can contain personal data — author names and email addresses, for example. For that data we act as a processor on our customer's instructions. See section 11.
Where we have signed a data processing agreement with a customer, that agreement governs our processing of personal data contained in their content, and it prevails over this policy to the extent the two conflict.
What Jade connects to
Jade is only useful once it can read your code, so it is worth being precise about what that means.
Repository access
You connect repositories by installing our application into a source control account or organisation you control, and choosing which repositories it may access. The permissions requested are shown to you at the moment you install it. You can narrow the selection or remove the application at any time from your source control settings. Revoking access stops future scans immediately; it does not by itself delete what we have already derived — use deletion for that.
What a scan does
When you trigger a scan, Jade reads the selected repositories at a specific point in their history, analyses the source files, and builds a structural map of your software from them. Scans run when you ask for them. Jade does not scan a repository on its own initiative, and it never writes to your repositories.
We keep a copy of the source files we analysed, so that we can serve answers about your code without returning to your source control provider each time.
If storing your source code outside your source control provider is not acceptable to your organisation, Jade is not currently a fit, and we would rather you know that from this page than discover it later.
Information we collect
Account and identity information
When you sign in through Google, GitHub or Microsoft, we receive your name, email address, and a stable identifier for that login. We store these to create your account, recognise you across sessions, and associate you with your organisation's workspace. We never receive your password for those services.
Repository content and metadata
From each repository you connect: the source files and their contents, the languages used, version history identifiers and their metadata, and dependency and configuration files. Personal data appears here only because it is present in your repository — author names and email addresses in version history are the common case.
What we derive from your code
The analysis itself: a structural map of your software, summaries of what its parts do, the indexes that make it searchable, and findings about problems we detect. It is derived from your content and it belongs to you.
Your model provider credentials
To use Jade you connect your own AI model provider account. The credential you supply is stored encrypted, used only to make model requests on your behalf, and never returned to the browser or exposed to any other customer. You can replace or remove it at any time. We also record, per request, which model ran and what it consumed — so that you can see your own usage.
Usage and technical information
Information generated by using the platform: IP address, browser and device type, the pages and features used, what your connected tools asked for, request timings, and error diagnostics. We use this to operate the service, diagnose faults, and understand which parts of the product earn their place.
Communications
If you contact us, book a demo, or ask for support, we keep the message, your contact details, and our reply.
How we use information
We use the information described above to:
- Provide the platform: scan the repositories you connect, build and maintain the analysis, and answer what your development tools ask.
- Authenticate you, maintain your session, and enforce the boundaries of your organisation's workspace.
- Keep the service secure, prevent abuse, and investigate incidents.
- Diagnose faults and improve accuracy, performance and cost. Where we measure quality we do it on aggregate measurements, not by reading customer code for its own sake.
- Meter usage and administer plans, credits and billing.
- Send you service messages: security notices, changes to the service, and administrative mail. Marketing mail, if we send it at all, is separate and you can unsubscribe from it.
- Comply with law, and establish or defend legal claims.
Lawful bases (UK and EU GDPR)
Where GDPR applies, we rely on: performance of a contract for everything needed to deliver the platform to you; legitimate interests for security, abuse prevention, fault diagnosis and product improvement, balanced against your rights; consent where we ask for it, which you may withdraw at any time; and legal obligation where the law requires us to act.
AI and model processing
Jade uses AI models to summarise code and to compose the written parts of its answers. Because that means parts of your code are sent to a model, this section is deliberately specific.
Model requests run on your own provider account
Jade requires you to connect your own AI provider account, and calls that provider under your credential. The consequences are worth stating plainly: the request is governed by your agreement with that provider, including any data-retention or enterprise terms you hold with them; the usage is billed to you; and if you have no active provider account, the operation stops with an error rather than falling back to ours.
What is sent to a model, and when
During a scan: the code being summarised, together with context drawn from what we have already derived. When one of your tools asks a question: the material needed to answer that question, which can include excerpts of your code. Nothing is sent to a model outside these two paths.
Training
We do not use your code, your content, or your personal data to train or fine-tune any AI model — ours or anyone else's. We do not grant model providers the right to train on data we send them, and the providers Jade supports do not train on this kind of traffic under their standard commercial terms. Where we improve the product from experience, we do it from aggregate, de-identified measurements.
Monitoring
We monitor model requests so that we can see what ran, how long it took, and what it consumed. That monitoring can include the content of a request, which means it can include excerpts of your code. It is a setting rather than a structural requirement: it can be reduced to usage measurements alone, and we will do that for a customer who requires it. Credentials and secrets are removed before anything is recorded.
Outputs are not verified truth
AI output can be wrong. Jade is built to reduce that — its answers are grounded in what we actually recorded about your code rather than in model recall — but no such measure is complete. Review anything Jade tells you before relying on it in production. The Terms of Service address this as a contractual matter.
Where data is held
Our infrastructure is hosted in the United States. Some of the service providers described in section 7 operate in other countries, so your information may be processed outside the United States as well.
If you are in the EEA, the UK or Switzerland, this means your information is transferred outside your jurisdiction, to countries whose data protection laws differ from your own. For those transfers we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with the safeguards described in section 9. You can ask us which mechanism applies to a particular transfer.
Security
We protect your information with measures appropriate to how sensitive it is. In summary:
- Encryption. Your data is encrypted in transit and at rest. Credentials and secrets are held in a dedicated secret store, encrypted, and never kept in source control.
- Access control. Access to production systems is limited to the people who need it, over authenticated paths, on a least-privilege basis.
- Network isolation. Our data stores are not reachable from the public internet. Only the interfaces you use are.
- Separation between customers. Every record is bound to the organisation it belongs to, and every read is scoped to it, so one customer's analysis cannot be reached from another's account.
- Redaction. Credentials and secrets are removed from diagnostic and monitoring records before they are stored.
We will share a fuller description of our security posture with a customer or prospective customer who asks for one.
No system is perfectly secure, and we cannot guarantee that unauthorised access will never occur. If a breach affects your personal data or your content, we will notify you, and any regulator entitled to notice, without undue delay.
Retention and deletion
We keep information for as long as we need it to provide the service to you, and then for as long as the law requires or permits.
- Account information — for the life of your account.
- Repository content and everything we derived from it — until you delete it, or your account closes. Each scan supersedes the last for the same version of the code.
- Provider credentials — until you replace or remove them.
- Usage and diagnostic records — for a limited operational period, then discarded or aggregated.
- Billing and usage records — for as long as tax and accounting law requires.
Deleting your data
Deleting a project's data clears everything we derived from every repository in it, together with its history. Conversations you have had with Jade are kept deliberately, because they belong to the person who wrote them rather than to the analysis; ask us and we will delete those too.
To close an account and have us erase everything associated with it, email us at the address in section 16. We will complete a verified deletion request within 30 days. Encrypted backups may retain copies for a short period after that before they age out.
Controller and processor roles
For personal data about you as a website visitor or account holder — your name, your email, your usage of the platform — we are the controller, and this policy is our notice to you.
For personal data that appears inside content you connect to Jade, we are a processor and your organisation is the controller. We process that data only to provide the service, on your organisation's instructions. If you are an individual whose personal data appears in a customer's repository — as a commit author, for example — the customer, not Jade, decides what happens to it; we will route your request to them and support them in answering it.
Your privacy rights
Subject to the conditions and exemptions in the law that applies to you, you have the following rights over your personal data.
If you are in the EEA or the UK
- Access — a copy of the personal data we hold about you.
- Rectification — correction of data that is wrong or incomplete.
- Erasure — deletion, where we have no overriding basis to keep it.
- Restriction — a pause on processing while a dispute is resolved.
- Portability — the data you gave us, in a machine-readable form.
- Objection — to processing we base on legitimate interests.
- Withdrawal of consent — at any time, where consent was the basis.
- Complaint — to your supervisory authority. We would rather you came to us first, but this right does not depend on that.
If you are in California or another US state with a privacy law
- Know — the categories and specific pieces of personal information we collected, the sources, the purposes, and who we disclosed it to.
- Delete — subject to the statutory exceptions.
- Correct — inaccurate personal information.
- Opt out of sale or sharing — we do neither, so there is nothing to opt out of.
- Limit use of sensitive personal information — we do not collect it for any purpose requiring this.
- Non-discrimination — exercising a right will not cost you service, price or quality.
In the twelve months before the date of this policy we disclosed personal information to service providers for the business purposes set out in section 7, and we sold or shared none of it.
If you are in Israel
You have the right under the Protection of Privacy Law to inspect the personal data we hold about you and to request its correction or deletion.
Making a request
Email us at the address in section 16. We will respond within one month, extendable where the law allows and we tell you why. We may need to verify your identity first — we will not act on an unverified request to disclose or delete someone's data, since doing so is itself a privacy failure.
Children
Jade is a tool for professional software development. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We will update this policy as the platform changes. When a change materially affects how we handle your information, we will tell you — in the application, or by email to the address on your account — at least 14 days before it takes effect, unless the law requires it sooner. The "Last updated" date at the top always reflects the current version. Continuing to use Jade after a change takes effect means you accept the updated policy.
How to contact us
For any privacy question, to exercise a right, or to report a concern:
- nnavick@gmail.com
- Post
- Postal address available on request by email.
If you have found a security vulnerability, please write to the same address with "Security" in the subject line, and give us a reasonable opportunity to fix it before disclosing it publicly.