Privacy Policy

This policy explains how Codas Labs, LLC(“Codas Labs,” “we,” “us”) handles information in connection with Tore (the “Service”), at tore.ai and the applications and help centers we host for our customers.

Who is responsible for your information

Codas Labs, LLC is a North Carolina limited liability company. We are the controller of information we collect about you directly: your account, your billing details, and how you use the Service. Contact: privacy@codaslabs.com.

For the information inside the content our customers put into Tore, meaning their support conversations, their customers’ details and their bug reports, we act as a processor and our customer is the controller. Our obligations in that role are in the data processing addendum.

If you are a member of the public who contacted a company that uses Tore, that company decides what happens to your information and is the right place to send a request. We will help them answer you, and we say below what we do if you write to us instead.

We have not yet appointed representatives in the United Kingdom or the European Union under Article 27 of the UK and EU GDPR, and we do not have a statutory Data Protection Officer. Neither is currently required of us. Where one becomes required, it will be appointed and named here.

What we collect

Information you give us

• Account details, name, work email, password (stored only as a hash), and the organization you belong to.
• Billing details, handled by our payment processor. We receive a customer reference, the plan, and the status of the subscription. We never see or store full card numbers.
• Anything you type to us, support requests, replies to our emails, form submissions.
• Connection settings, the credentials and scopes you grant when you connect another service, such as installing our GitHub App on repositories you choose.

Information we collect automatically

• Usage, pages viewed, actions taken, and events needed to operate and secure the Service.
• Technical, IP address, browser and device type, timestamps, and error diagnostics.
• Audit records, a log of security-relevant actions taken in an account. These are append-only: the ability to change or delete a written audit row is revoked at the database level, including for us.
• Cookies and similar technologies, see the cookie policy, which covers our analytics and advertising trackers and how to refuse them.

Customer content

When our customer uses Tore to run their support, we process the content of that support on their behalf. That includes conversations and the contact details of the people in them, knowledge-base articles, feedback posts and votes, error reports forwarded from their monitoring tools, and bug captures.

Bug captures, and how redaction actually works

A bug capture can include a session replay, browser console output, a record of network requests, and details of the device, browser and release the reporter was on. It can also include a screenshot and, where the reporter explicitly agrees to it, a screen recording. This is the most sensitive thing the Service handles, so we describe the mechanism precisely rather than in reassuring generalities.

• In the browser, before anything is sent. The capture tool masks form inputs and text in session replays and screenshots on the reporter’s own device, and the customer chooses what the tool is permitted to record in the first place. A replay or screenshot that does not arrive with a signed statement that this masking ran is rejected and never shown to anyone.
• After it is stored. An upload is written to encrypted storage first, and a background worker then redacts the stored copy. That worker strips secrets, high-entropy strings that look like credentials, email addresses, phone numbers and national identification numbers from console output, network trails and page snapshots. Redaction is not instantaneous and it does not happen before storage. There is a window, normally seconds, in which the unredacted upload exists in our storage.
• What the customer’s team can open. The worker writes a separate redacted copy, and that redacted copy is the only version the Service serves. A capture is not visible in the product until its redaction has completed successfully.
• What happens when redaction fails. Anything that fails, times out, or is of a type we cannot confidently redact is quarantined rather than passed on, and its redacted copy is deleted. If any single item in a capture is quarantined, the session replay and screenshot from that same capture are quarantined with it, on the assumption that whatever leaked into one is likely visible in the others.
• Screen recordings are not redacted. Where a reporter records their screen, we cannot mask a video reliably, so we do not claim to. A recording is accepted only with a recorded consent statement covering screen, microphone and camera, and it is stored and served as recorded.

Redaction of this kind is pattern matching, and pattern matching is never complete. It will miss things. Customers should treat capture configuration, not our redaction, as the primary control, and can delete any capture at any time.

Why we are allowed to use it

Where the UK or EU GDPR applies, we need a lawful basis for each use. Ours are:

We do not rely on vital interests or on the performance of a public task. We do not knowingly process special category data, and we do not ask for it.

What our legitimate interests actually are

Where we rely on legitimate interests, those interests are: running a secure and reliable service, preventing fraud and abuse, understanding which parts of the product work so we can fix the parts that do not, and protecting our legal position. We have weighed those against your rights in each case and do not believe our interests override them. You can object to any processing based on legitimate interests. Ask us for our balancing assessment at privacy@codaslabs.com and we will send it.

Withdrawing consent

Where we rely on your consent, such as advertising and analytics cookies, you can withdraw it at any time and it is as easy to withdraw as it was to give. Withdrawing does not make anything we did beforehand unlawful, and it does not affect processing that rests on a different basis.

Artificial intelligence

Tore sends content to AI models to triage conversations, draft replies, summarize errors and investigate code. The vendors we use are named in the subprocessor list.

We use those vendors through paid business interfaces under terms where your content is not used to train their models. We do not use free or consumer tiers, which generally do permit training. If a vendor changes its terms in a way that would allow training on customer content, we will move off that vendor or tell you before the change takes effect.

We do not use customer content to train models of our own, and we do not sell personal information or share it for cross-context behavioral advertising.

If you connect your own AI provider key, that work runs against your own account with that vendor, under your agreement with them rather than ours.

Automated decision-making and profiling

We do not make decisions about you by automated means that produce legal effects or similarly significant effects, and we do not profile you for that purpose. Article 22 of the UK and EU GDPR, and the equivalent US state provisions on profiling, are about decisions such as refusing credit, refusing employment, or cutting off access to a service. Tore does none of those things.

What the AI in Tore actually does, and what it does not:

• Triage. A model reads an incoming support item and suggests a priority, a category and where it should go. That is a decision about a support ticket, not about a person, and a human can override it.
• Drafting. A model writes a suggested reply. The draft is shown to a person on the customer’s support team, and that person decides whether to send it, edit it, or throw it away. Nothing is sent to a member of the public automatically.
• Investigation and code fixes. A model reads a repository the customer connected and proposes a change as a pull request. A pull request is a proposal. A human on the customer’s team reviews and merges it, and we do not push changes into a customer’s codebase on our own authority.
• Summaries and search. These produce results for a person to read. They are not decisions.

The common thread is that a person approves every output that leaves the product. If we ever build a mode where that is not true, we will change this section and tell account holders before it is switched on, and any such mode would be something a customer opts into rather than something that appears by default.

You can still ask a human to look at anything an AI feature produced about you. Write to privacy@codaslabs.com.

Who else sees it

• Our subprocessors, the providers listed here, each limited to what its job requires and each under a written contract that holds them to terms no weaker than ours.
• Services you connect, if you connect your code host, error tracker, issue tracker or chat tool, information flows to and from those on your instruction. You control the connection and can revoke it, and where the connection is a GitHub App you can uninstall it from GitHub without asking us.
• Our own staff, only where needed to operate the Service or to help a customer who has asked for help. That access is limited and logged.
• Where the law requires it, in response to a valid legal demand. We check that a demand is valid before answering it, we give only what it actually covers, and where we are permitted to tell you, we will.
• A buyer, if the business is sold or merged, information transfers with it, subject to this policy. If a buyer wanted to use it in a materially different way, you would be told first and given a chance to object or leave.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not disclose customer content to anyone for their own purposes.

Where it goes

We are based in the United States and our providers are primarily in the United States. If you are in the United Kingdom, the European Economic Area or Switzerland, that means your information leaves your country. The mechanisms we rely on are:

• From the European Economic Area, the European Commission’s Standard Contractual Clauses, using Module Two (controller to processor) or Module Three (processor to processor) depending on which role we are in for the data concerned.
• From the United Kingdom, the UK International Data Transfer Addendum to those clauses, issued by the Information Commissioner.
• From Switzerland, the same clauses as adapted under Swiss law, with the Swiss Federal Data Protection and Information Commissioner as the competent authority.

Alongside those clauses we apply supplementary measures: encryption in transit and at rest, access limited to named staff, and a commitment to challenge any government access request that we believe is unlawful and to tell the affected customer where we are legally permitted to.

We are not certified under the EU to US Data Privacy Framework and we do not rely on it. The specific modules, options and annexes are set out in our data processing addendum, and you can ask us for a copy of the safeguards we rely on at privacy@codaslabs.com.

How long we keep it

We keep information for as long as it is needed for the purpose it was collected for, and no longer, except where the law makes us keep it. The periods below are what the Service is built to do. Where a customer sets a shorter retention period for their own content, theirs wins.

When an account is closed we delete or irreversibly anonymize its content within 30 days, except where we are required to keep something longer. Deletion runs as a verified pass: it counts the rows and stored files that remain and does not report itself complete while any are left.

Backups are the honest exception. Deleted data can survive in database backups until the restore window it falls inside closes, because a backup cannot be edited without destroying its integrity. We do not restore a backup in order to bring deleted data back. The length of that window is set out in our data processing addendum.

Your rights

Depending on where you live you may have the right to access a copy of your information, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable format, to withdraw consent, and to complain to a regulator. You will not be treated worse for exercising any of them.

How to make a request, and what happens next

Email privacy@codaslabs.com with the words “privacy request” and tell us what you want. We will verify who you are before we act, normally by confirming you control the email address on the account, and we will ask only for what is necessary to do that.

We respond within 30 days where the UK or EU GDPR applies and within 45 days where a US state law sets that period. If a request is complex we may extend once, by up to a further 60 days under the GDPR or 45 days under US state law, and we will tell you why before the first deadline passes. There is no charge unless a request is manifestly unfounded or excessive, and if we intend to charge or to refuse, we will say so and explain.

You may use an authorized agent. We may ask for proof of their authority and may still ask you to confirm your own identity.

If your request concerns content held by one of our customers, we pass it to them rather than acting on it ourselves. That content is theirs to control, we are only their processor for it, and acting unilaterally on their data is exactly what a processor must not do. We will tell you that we have passed it on, and we assist them in answering you.

US state privacy rights

If you live in a US state with a consumer privacy law, you have rights under it. Those states currently include California (CCPA as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. The list keeps growing, so if your state has such a law and is not named here, we will still honor the rights it gives you. Those rights are to:

• Know what we collect about you, why, and who we give it to.
• Get a copy, including a portable copy.
• Correct it.
• Delete it.
• Opt out of the sale of personal information, of sharing it for cross-context behavioral advertising, and of targeted advertising.
• Opt out of profiling that has legal or similarly significant effects. We do not carry out profiling of that kind, as set out above.
• Limit the use of sensitive personal information. We do not seek it and do not use it to infer characteristics about you.
• Not be discriminated against for exercising any of these.

You have the right to appeal if we refuse a request. Virginia, Colorado, Connecticut, Texas, Montana, Oregon and several other states require us to offer this, and we offer it to everyone rather than checking your address first. If we turn a request down, email privacy@codaslabs.com with the words “privacy appeal” within a reasonable time. A different person than the one who made the original decision will review it, and we will reply in writing with our reasoning within 45 days. If we still refuse, we will give you a link or address for complaining to your state attorney general.

We do not sell personal information and we have not sold it in the preceding twelve months. Where you have agreed to advertising cookies on our website, our advertising providers may receive an identifier for your browser so we can show our own ads elsewhere. Some US state laws count that as sharing for cross-context behavioral advertising, so we disclose it plainly rather than argue about the definition. Opt out with the cookie link in our footer. This applies to our marketing website only, never to content inside the product.

We honor the Global Privacy Control signal where your browser sends one, and treat it as an opt-out of both analytics and advertising for that browser. No further action is needed from you.

If you are unhappy with how we handled it

Tell us first and we will try to put it right. You do not have to come to us first, and you can go straight to a regulator.

• United Kingdom. The Information Commissioner’s Office, at ico.org.uk, which also takes complaints by telephone.
• European Economic Area. The supervisory authority where you live, where you work, or where you think the problem happened. Because we are not established in the EU, there is no single lead authority for us, so your own national authority is the right one to approach.
• Switzerland. The Federal Data Protection and Information Commissioner.
• United States. Your state attorney general, and in California also the California Privacy Protection Agency.

Marketing email

If you create an account, we will send you product news and occasional marketing email as well as the messages needed to run your account. Every marketing email carries a one-click unsubscribe, and we act on it immediately. You can also object at any time by writing to privacy@codaslabs.com. Transactional messages, meaning receipts, security alerts and service notices, are not marketing and continue regardless. We keep a record that you unsubscribed, because that record is what prevents us from emailing you again.

Security

Information is encrypted in transit and at rest. Each customer organization’s data is isolated at the database level rather than by application code alone, which means the isolation does not depend on a developer remembering to apply a filter. Access by our staff is limited, logged, and granted only where needed to operate the Service or to help a customer who has asked for help. Our security page sets out what is enforced today, and what we do not claim.

We do not hold a SOC 2 report, an ISO 27001 certificate, or any other third-party security certification, and we have not signed a HIPAA business associate agreement. We would rather say that than let a reader assume otherwise. Tore is not an appropriate place for protected health information.

No system is perfectly secure. If you think you have found a vulnerability, or that an account has been compromised, write to security@codaslabs.com. We will not pursue you for reporting something in good faith.

If there is a breach, this is what we will do

A personal data breach means a security failure that leads to personal information being destroyed, lost, altered, disclosed or accessed without authorization. If one happens:

• Customers get told without undue delay, and in any event within 72 hours of us becoming aware that their data was involved. We do not wait until an investigation is finished to make the first contact, because you may need to act before we have all the answers.
• What that first notice contains: what happened, what categories of information and roughly how many records were involved, what we have done so far, what we advise you to do, and a named contact who can answer questions. If we do not yet know something, we will say so rather than leave it out.
• Regulators. Where we are the controller and the breach is likely to be a risk to people, we notify the relevant supervisory authority within 72 hours, and we notify affected individuals directly where the risk to them is high. Where we are the processor, our customer makes the regulatory notification and we give them what they need to make it on time.
• Afterwards. We follow up with what we found, what we changed, and confirmation of when it was closed out.

The full contractual version of this commitment, including the parts our customers can hold us to, is in the data processing addendum.

Children

Tore is a business tool. It is not directed at children, it is not designed for them, and we do not knowingly collect information from anyone under 16.

We do not knowingly collect personal information from a child under 13 in the United States, which is the threshold the Children’s Online Privacy Protection Act uses, and we do not run age verification because we do not offer the Service to children in the first place. We do not sell or share the personal information of anyone under 16, which some US state laws would require opt-in consent for. We do not use anyone’s information to advertise to children.

A member of the public can, of course, contact a company that uses Tore, and that company controls whatever they say. If you are a parent or guardian and you believe a child has given us information, write to privacy@codaslabs.com. We will delete it, and where the information sits inside a customer’s account we will tell that customer so they can do the same.

Changes to this policy

We will change this policy as the product changes. When we do, we update the date at the top of the page and keep the previous version available on request.

For a material change, we will tell account holders by email or in the product at least 30 days before it takes effect. A material change means one that widens what we collect, what we use it for, or who we give it to. If the change requires your consent, we will ask for it rather than assume it, and the new use will not start until you agree. If you do not want to accept a material change, you can close your account before it takes effect and ask us to delete your data.

Minor changes, such as fixing a typo, clarifying wording or updating a contact address, take effect when posted. We will not use a minor edit to slip in a material one.

Contact

Codas Labs, LLC, North Carolina, United States.
Privacy and data rights: privacy@codaslabs.com
Legal: legal@codaslabs.com
Security reports: security@codaslabs.com
Abuse: abuse@codaslabs.com