Privacy Policy

Pacecar ("Pacecar," "We," "Us," or "Our") operates the website at https://pacecar.sh and the Pacecar GitHub App and related services (the "Services").

Owner contact email: hello@pacecar.sh

When You sign in with GitHub and install Pacecar on Your organization, We may collect:

• Account and identity data — GitHub username, user ID, organization and installation identifiers, and related profile information needed to authenticate You and associate the Services with Your GitHub account.
• Service and usage data — GitHub webhook and API metadata (for example, repository and pull request identifiers, event types, and timestamps), billing and usage events for reviews that ran, and technical logs such as IP address and request metadata used to operate and secure the Services.
• Customer Content — pull request diffs, related PR metadata, review findings, and the context needed to run reviews, post and update review comments, bill for usage, and evaluate and improve review quality.
• Payment information — payment method and related billing details, processed by a third-party payment processor such as Stripe. We typically receive payment status and limited billing identifiers rather than full card numbers.

Users are responsible for ensuring they have authority to provide any third-party Personal Data or Customer Content. Withholding data required to operate the Services may limit or prevent functionality.

1. Methods of processing. We implement industry-standard security measures designed to protect data from unauthorized access, disclosure, modification, or destruction. Processing follows organizational procedures aligned with the purposes in this Privacy Policy. Trusted service providers (for example, hosting, payment, and inference providers) may process data on Our behalf as processors, bound by confidentiality and access limited to what is needed to provide the Services. An updated list of processors is published at https://pacecar.sh/subprocessors. For a plain-language overview of the review data path, see Security & privacy.
2. Legal bases. Where applicable law requires a legal basis, We process Personal Data based on: (1) consent, where You have provided it for a specific purpose; (2) contractual necessity, to provide the Services and manage billing; (3) legal obligations; and (4) legitimate interests, such as securing the Services, preventing abuse, and evaluating and improving review quality. You may contact Us to ask which basis applies to a specific processing activity.
3. Place. We primarily process data on infrastructure located in the United States. Depending on Your location and the providers We use, data may be transferred to or processed in other regions. Contact Us if You have questions about processing location.
4. Retention. We retain Personal Data and Customer Content only as long as needed for the purposes collected — including providing the Services, billing, security, and evaluating review quality — or longer where required by law. Upon termination of the agreement or upon Your request, We will delete relevant user data within 30 days using industry-standard methods, subject to backup and security protocols. To request deletion, email hello@pacecar.sh. Uninstalling the Pacecar GitHub App stops new reviews and revokes Pacecar's access to Your organization through that integration.

We process data to:

• Authenticate Users, manage Accounts, and operate the GitHub App integration
• Fetch pull request diffs, run AI reviews, and post or update review comments
• Meter usage, bill for reviews, and process payments
• Secure, debug, and maintain the Services, including system logs
• Evaluate and improve the Pacecar product using stored review artifacts (for example, precision/recall, prompt and checklist iteration) — without training foundation models on Customer Content from private repositories
• Comply with law and enforce Our Terms of Service

1. Pacecar uses AI Features to generate review Output. We do not use inference providers that train on Customer Content. That is separate from what Pacecar retains on Our systems after a review runs.
2. We do not use Customer Content from private repositories to train, fine-tune, or otherwise improve foundation models — Ours or a provider's. We may use publicly available code (including code in public repositories) and other permitted data for that purpose. We retain review artifacts (findings, related PR metadata, and diff context needed to judge the review) on Pacecar systems so We can measure quality, debug bad comments, and improve the Pacecar product (including prompts and checklists).
3. Output may be inaccurate or incomplete. You remain responsible for decisions based on review Output. More detail is on Security & privacy.

Personal Data and Customer Content may be processed using the following categories of third-party services. The current list of subprocessors is at https://pacecar.sh/subprocessors. Each provider processes data under its own privacy terms for the purposes described below.

Depending on Your jurisdiction, You may have rights to:

• Withdraw consent where processing is based on consent
• Object to processing based on legitimate interests
• Access a copy of Your Personal Data
• Rectify inaccurate or incomplete Personal Data
• Restrict processing in certain circumstances
• Request erasure of Personal Data
• Receive Personal Data in a portable, machine-readable format where applicable
• Lodge a complaint with a competent data protection authority
• Restrict data flow from GitHub by uninstalling or suspending the Pacecar GitHub App (which may limit or stop Service functionality)

To exercise these rights, contact hello@pacecar.sh. Some jurisdictions limit these rights. We do not process Personal Data for interest-based advertising.

1. Legal action. Personal Data may be used for legal purposes in connection with improper use of the Services or as required by public authorities.
2. System logs and maintenance. The Services and third-party providers may collect system logs and related technical data (such as IP address) for operation and maintenance.
3. Do Not Track. The Services do not currently respond to "Do Not Track" browser signals. Third-party services may have their own policies.
4. Sensitive data. Do not upload Sensitive Personal Information to the Services. See Our Terms of Service for definitions and restrictions.
5. Changes. We may update this Privacy Policy by posting a revised version on this page. For material changes that significantly affect how We process Personal Data, We will provide notice via the Pacecar Website or the email associated with Your Account where practicable. Continued use after the effective date constitutes acceptance of the updated policy.

• Personal Data — any information that can directly or indirectly identify a natural person.
• Customer Content — data You make available through the Services, including pull request diffs and related materials, as defined in the Terms of Service.
• User — an individual who uses the Services; where applicable, synonymous with the data subject.
• Data Controller — Pacecar, which determines the purposes and means of processing Personal Data for the Services.
• Service / Services — the Pacecar website, GitHub App, dashboards, and related AI code-review offerings.