← Label2Prod

Privacy Policy

Last updated 29 September 2026

This policy explains what Label2Prod collects, why, where it goes and how long we keep it. Label2Prod is run by [Company legal name], [Registered address, country]. Write to [privacy@your-domain] with any question or request about your data.

Two kinds of data

Your sign-in details (name, email, profile picture, sign-in sessions). We decide how these are used, so for them we are the controller.

Your organisation’s content (Jira issues, code, the fixes Label2Prod writes). We process it only on your organisation’s instructions, to provide Label2Prod, so for it we are the processor and your organisation is the controller.

What we collect

• Profile: your name, email address and profile picture, from the sign-in provider you choose (GitHub, GitLab, Atlassian) or the email you give us.
• Sign-in sessions: a session token, its expiry, and the IP address and browser that signed in, so we can keep your account secure.
• Connections: which Jira site and projects, and which GitHub or GitLab repositories, your organisation connects, and the access tokens for them.
• Your Anthropic API key.
• Issue content: the text, comments and attachments of the Jira issues you label forLabel2Prod.
• Code: the repository Label2Prod works on, copied into a sandbox for each attempt, and the change it writes.
• Fix history: each fix’s timeline, results, the change it proposed, and what it cost on your Anthropic account.

What we use it for

Only to run Label2Prod for your organisation: to sign you in, work on the issues you label, report back in Jira and your code host, show you each fix’s progress and cost, count fixes against your plan, keep the service secure, and contact you about your account. We use it because we need it to provide the service you signed up for, and, for security, because we have a legitimate interest in keeping accounts safe.

We do not use your code or issues to train AI models. We do not sell your data, show you ads, or use analytics or tracking tools.

Who else receives it

• Anthropic runs each fix, on your Anthropic account with your own key, and receives the issue content and the code needed for it. It processes them in its US and global regions, under your organisation’s own agreement with Anthropic.
• Fly.io hosts the Label2Prod application, in Frankfurt, Germany.
• Neon hosts our database, in Frankfurt, Germany.
• Resend sends sign-in emails, when you sign in by email.
• Atlassian, GitHub and GitLab receive what Label2Prod writes back to them (Jira comments, branches, pull or merge requests), and sign you in if you choose them.

We will list any new provider here before it receives your data. Where data leaves the European Economic Area, we rely on the safeguards the law requires, such as the European Commission’s standard contractual clauses.

How we protect it

• The tokens that give Label2Prod access to your Jira, code host and Anthropic account are encrypted with AES-256-GCM, and only the part of Label2Prod that calls those services can decrypt them.
• Each organisation’s data is kept apart in the database by row-level security.
• The sandbox that works on your code holds none of your keys or tokens and cannot push to your repository.
• All traffic is encrypted in transit.

How long we keep it

• Sandbox copies of your code are deleted when each attempt ends.
• Access tokens are deleted when you disconnect the connection; an Anthropic key is deleted when you replace it.
• Sign-in sessions end when they expire or you sign out.
• Profile, connections and fix history are kept while your organisation’s account exists, so you can see past fixes.

Ask us at [privacy@your-domain] to delete your account and we will delete its data within 30 days. Copies in our database provider’s backups expire on their own shortly after. Content already written to your Jira or code host stays there, under your control.

Cookies

We use only the cookies needed to sign you in and keep you signed in. No advertising or analytics cookies.

Your rights

You can ask to see, correct, export or delete your personal data, or object to how we use it, by writing to [privacy@your-domain]. We answer within one month. If the data belongs to your organisation’s content, we will work with your organisation to answer. You can also complain to your data protection authority.

Changes

If we change this policy in a way that matters, we will tell you before it takes effect. The date at the top shows the latest version.