Privacy Policy
Last updated: September 2026
Who we are
Gittan is operated by Bloomer AB (org. nr 559490-9498), Gothenburg, Sweden. We are the data controller for personal data processed through gittan.eu.
Contact: privacy@gittan.eu
What we collect
| Data | Source | Purpose |
|---|---|---|
| Name, email | Your identity provider (OIDC) | Account identity, notifications |
| Organization & team membership | OIDC group claims or manual invite | Access control |
| Git push metadata | Your git operations | Pipeline execution, audit log |
| Pipeline run data | CI/CD execution | Build results, team metrics, billing |
| Billing information | Stripe (payment processor) | Subscription management |
We do not read, analyze, or train models on your source code. Your repositories are accessed only to execute git operations and run pipelines.
Legal basis (GDPR Art. 6)
- Contract — processing necessary to provide the service you signed up for
- Legitimate interest — security logging, abuse prevention, service improvement
- Legal obligation — financial records retention (Swedish Bokföringslagen)
Where your data lives
All data is stored and processed in the EU (Scaleway, Paris and Amsterdam). Your source code, pipeline data, and account information never leave the EU. Payment processing is handled by Stripe (EU entity, data processed in EU).
Data retention
- Account data: retained while your account is active, deleted within 30 days of account closure
- Pipeline logs: retained for 90 days
- Audit logs: retained for 12 months
- Billing records: retained for 7 years (Swedish accounting law)
Third parties
- Scaleway (EU) — infrastructure hosting
- Stripe (EU) — payment processing
We do not sell, share, or provide your data to advertisers, analytics companies, or any other third parties.
Cookies
We use a single session cookie for authentication. No tracking cookies, no analytics scripts, no third-party cookies.
Your rights
Under GDPR, you have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data
- Erasure — request deletion of your account and data
- Portability — receive your data in a standard format
- Restriction — limit how we process your data
- Objection — object to processing based on legitimate interest
To exercise any of these rights, email privacy@gittan.eu. We respond within 30 days.
You also have the right to file a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se.
Questions? Email privacy@gittan.eu.