Optional managed AI review
When an organisation owner enables managed AI review, selected repository code, diffs and review context are sent to Nebius using Pillion’s provider account. Nebius is a subprocessor for this optional service. Public serverless inference has no EU-only residency promise from Pillion; the selected endpoint and provider agreement determine processing location. Bring-your-own-key reviews use the customer’s chosen provider and agreement.
Who is responsible
Pillion Ltd, 483 Green Lanes, London, England, N13 4BS, United Kingdom, is the controller for personal data we process for our own purposes. If Pillion processes data in your content on behalf of your organisation, the organisation is the controller and our DPA applies.
Data we collect
- Account data: name, email address, verification status, passkeys, SSH keys, organisation membership, and authentication records.
- Customer content includes native source history, changes, agent tasks, checkpoints, saved conversations, selected prompts, tool results, and review evidence. It also includes issues, pull requests, comments, attachments, workflow logs, artefacts, and audit records.
- Service data: IP address, user agent, request timing, security events, and error and delivery metadata needed to operate and protect the service.
- Commercial data: organisation, seat, invoice, and payment transaction data. Full card numbers are entered into Paddle’s hosted checkout and are not stored by Pillion.
- Communications: messages and attachments sent to support, security, legal, or abuse contacts.
- Access requests: email address, intended use, current Git host, account type, repository plans, and CI runner preference from the waitlist form.
Why we use it
We use personal data to provide the service, authenticate users, secure the platform, enforce repository permissions and quotas, send transactional mail, respond to support and legal requests, process organisation billing, comply with law, and maintain operational records. We use the legal basis that applies to the activity: contract, legal obligation, legitimate interests, or consent where required.
Pillion does not sell personal data, place third-party advertising in the authenticated product, or use customer content to train models.
Sharing and transfers
We share data with providers in the subprocessor list for their stated roles. Paddle receives billing contact, purchase and payment information as our authorised reseller and Merchant of Record. It acts as an independent controller for that data under its privacy notice. Paddle may process billing data internationally; this processing is outside Pillion’s core source and collaboration data residency commitment. Repository contents are not sent to Paddle for billing. Paddle privacy notice. Customer-enabled integrations, identity providers and attached runners receive data as configured.
Agent conversations and processing
The connector records supported messages and tool results from your approved repositories. Automatic upload waits for pushed work. You can also save selected local history explicitly.
Uploaded conversations remain private to their creator. Sharing publishes selected events at a fixed revision to current repository collaborators. Later events remain private. A public pull request does not make these conversations public.
Pillion stores saved source and agent context within its core data residency boundary. Your harness and chosen model providers control their own processing. Core storage residency does not make external inference EU-only.
Retention and deletion
We retain account and transaction records while needed for service, legal, security, accounting, and dispute obligations. Customer content remains until an authorised deletion, account closure, or its retention deadline. Configured retention applies to checkpoints, artefacts, caches, and backups. Contact info@pillion.dev for a request or export question.
Checkpoints expire at their recorded deadlines. Deleting a conversation clears its content from the thread, published ranges, and descendant forks. Minimal records prevent retries from restoring deleted content. Server deletion does not remove local recorder queues or downloaded exports. Backups follow their configured retention.
Source exports use Git-compatible formats. Private conversations and other agent metadata require separate exports with current authorisation. A source export does not include private agent context.
We keep waitlist access requests for up to one year. A new request from the same address updates the existing request. We use requests to plan onboarding and contact applicants about access. We do not use them for a newsletter.
Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection. If Pillion processes your data for a customer, contact that customer first; Pillion will assist the customer as required by the DPA. You may also complain to the UK Information Commissioner’s Office or your local data-protection authority.
Cookies and changes
The marketing site uses only cookies and storage strictly needed for operation. The checkout page loads Paddle’s payment service; its privacy notice explains the cookies and data used for payment and fraud prevention. The authenticated product has no third-party advertising or analytics. We may update this policy and will publish the new effective date and material changes on the site or status page. Privacy and data-protection requests go to info@pillion.dev. You may complain to the UK Information Commissioner’s Office or your local data-protection authority.