1. Overview
Bool AI ("Bool AI", "we", "us", or "our") is an automated code review service that integrates with GitHub via the GitHub Marketplace. This Privacy Policy explains what information we collect when you install and use Bool AI, how we use it, and your rights regarding that information.
By installing Bool AI from the GitHub Marketplace, you agree to the practices described in this Policy.
Key point: Bool AI reviews only pull request diffs and surrounding file context. We do not store your source code beyond what is required to produce a review, and we do not train AI models on your code.
2. Data We Collect
2.1 Account Information
- GitHub organisation or user login (slug)
- Organisation name and installation ID provided by the GitHub App installation flow
- GitHub Marketplace plan name and billing cycle (provided by GitHub on subscription events)
2.2 Repository Data
- Repository names and full names (e.g.
org/repo) for repositories you grant Bool AI access to
- Whether code review is enabled or disabled per repository
2.3 Pull Request Data
- PR number, title, author login, and head commit SHA
- Pull request diff (changed lines) and surrounding file context needed to generate a review
- PR review comments posted by Bool AI are visible to anyone with repository access
2.4 Usage & Telemetry
- Number of input and output tokens consumed per review and per agent (used for billing and quota tracking)
- Per-agent execution duration, token estimates, and cost estimates (stored in agent execution logs)
- Which agents ran for each review and their individual statuses (Code Review, Refactor, Test Engineer, Documentation)
- Review job status and timestamps
- Error messages when a review fails
2.5 Webhook Events
- GitHub webhook delivery IDs and event types received from GitHub
- GitHub Marketplace purchase event metadata (plan changes, cancellations)
3. How We Use Your Data
- Delivering reviews: Pull request diffs and context are sent to the configured AI provider (Anthropic Claude or Groq) to run four specialized agents — Code Review, Refactoring, Test Case Generation, and Documentation — each generating inline suggestion blocks on the pull request.
- Service operation: Account and repository data is used to authenticate GitHub App installations and route webhook events correctly.
- Usage tracking: Token counts are aggregated per organisation to enforce plan limits and display usage on the admin dashboard.
- Billing: Subscription status received from GitHub Marketplace is stored to determine your active plan and monthly review quota.
- Improving reliability: Error messages and job status history help us diagnose and fix service issues.
We do not use your source code or pull request content to train AI models, build datasets, or for any purpose other than generating the requested code review.
4. Data Sharing
We share data only as necessary to operate the service:
- Anthropic (Claude API): Pull request diffs and file context are transmitted to Anthropic's API to generate review comments. Anthropic's Privacy Policy governs their handling of this data. API customers' data is not used by Anthropic to train models.
- Groq: When the Groq provider is active, diffs are transmitted to Groq's API. Groq's Privacy Policy applies.
- GitHub: Review comments are posted back to GitHub via the GitHub API. GitHub's Privacy Statement governs data on their platform.
- Hetzner Cloud: Our backend runs on Hetzner Cloud (Germany). Hetzner's Privacy Policy applies to the hosting infrastructure.
We do not sell, rent, or share your data with any other third parties.
5. Data Retention
- Review jobs: Job records (PR metadata, status, timestamps) are retained indefinitely for audit purposes. Pull request diff content is not stored — it is fetched at review time and not persisted.
- LLM usage logs: Token counts are retained indefinitely for billing and quota tracking.
- Subscription data: Retained for the life of the subscription and for at least 12 months after cancellation for tax and audit purposes.
- Account & repository data: Retained while the GitHub App remains installed. You may request deletion at any time (see Your Rights).
6. Security
- All API calls are authenticated with API keys stored as environment secrets, never in source code.
- GitHub webhook payloads are verified with HMAC-SHA256 before processing.
- Data is transmitted over TLS (HTTPS) at all times.
- Database access is restricted to the application server; no public database port is exposed.
- GitHub App private keys are stored as encrypted secrets in CI/CD and mounted read-only into the container.
Despite these measures, no system is perfectly secure. If you discover a vulnerability, please report it to security@sophoris.in.
7. Your Rights
Depending on your jurisdiction (including the EU, UK, and California), you may have rights to:
- Access the personal data we hold about your organisation
- Request correction of inaccurate data
- Request deletion of your account and associated data
- Object to or restrict certain processing
- Data portability
To exercise these rights, contact privacy@sophoris.in. We will respond within 30 days. Note that some data may be retained for legal or audit obligations even after a deletion request.
To remove Bool AI's access to your repositories entirely, uninstall the GitHub App from your GitHub organisation settings.
8. AI Processing Disclosure
Bool AI uses large language models (LLMs) to analyse pull request diffs and generate code review comments. This constitutes automated decision-making as defined under the EU AI Act and similar regulations.
- Human oversight: All outputs are advisory. Engineers review and act on comments, suggestions, test cases, and documentation at their own discretion. Bool AI never approves, merges, or rejects pull requests automatically.
- No training on your data: Your code is not used to train or fine-tune AI models. It is processed transiently by the AI provider's inference API.
- Accuracy: AI-generated comments, refactoring suggestions, test cases, and Javadoc may contain errors. Always apply professional judgement before applying any suggestion.
- Test validation: Generated JUnit 5 test cases are compile-validated in-memory before posting. However, compilation success does not guarantee logical correctness.
- Providers: Anthropic Claude and Groq Llama 3.3 70B. The active provider is configurable per deployment. Both providers' data handling policies are linked in Section 9.
9. Third-Party Services
Bool AI integrates with the following external services. Their privacy policies govern their own data handling:
10. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of Bool AI after changes are posted constitutes acceptance of the revised Policy.
For material changes, we will notify you via a GitHub issue or the contact email associated with your organisation where possible.
Bool AI