Privacy policy
This policy explains what personal data Geekbot processes, why, for how long and what rights you have. Geekbot is a service that reviews code, works on tickets and investigates production errors for software teams.
Who we are
The controller of your personal data is Geekcoders s.r.o., IČO 07444290, Hlaváčova 207, 530 02 Pardubice ("Geekcoders", "we").
For anything about your personal data, write to privacy@geekcoders.cz.
Two roles we play
- Controller. We decide how and why we process the data of people who visit this website, request access, sign in to Geekbot or are invited to an organization. This policy covers that data.
- Processor. When your organization connects repositories, trackers, error sources, Slack or documents, we process the content in them only on your organization's instructions. Your organization is the controller of that content. Our terms of service govern that processing, and we sign a data processing agreement with your organization on request. If that content contains your personal data and you want to exercise your rights, contact the organization that uses Geekbot.
What we process and why
| Data | Why | Legal basis |
|---|---|---|
| Access requests: email, name, company, where your code lives, team size, message | To review your request and reply | Steps before entering a contract, and our legitimate interest in answering you (Art. 6(1)(b) and (f) GDPR) |
| Account: name, email address, avatar and account ID from Google, GitHub, GitLab or Microsoft when you sign in | To create your account and sign you in | Performance of a contract (Art. 6(1)(b)) |
| Organization membership: the organizations you belong to, your role and job roles, invitations, identities you link on trackers, forges and Slack | To show you the right organizations and route work to the right people | Performance of a contract (Art. 6(1)(b)) |
| Activity: reviews, runs and conversations you start, comments that mention Geekbot, your settings and notification preferences | To provide the service and show you your work | Performance of a contract (Art. 6(1)(b)) |
| Communication: emails we send you and whether you unsubscribed; push notification subscriptions | To send you invitations, service messages and the news you asked for | Performance of a contract; consent for product news (Art. 6(1)(b) and (a)) |
| Billing: plan, usage in credits and tokens, spending limits your owner sets; billing details (company, registration and VAT numbers, address, billing email), payments, invoices, and for a card subscription the masked card number, its expiry and the record of who agreed to the recurring payment, when and from which IP address | To bill the organization and enforce its limits | Performance of a contract and legal obligations (Art. 6(1)(b) and (c)) |
| Security and logs: IP address, request logs, audit log of configuration changes | To keep the service secure, prevent abuse and investigate incidents | Legitimate interest (Art. 6(1)(f)) |
We do not sell personal data, we do not use it for advertising and we do not train machine learning models on it.
Code and content sent to AI models
To do its work, Geekbot sends code, diffs and other content your organization has connected to the AI model chosen for that project. These requests go through OpenRouter to the provider of the selected model. We restrict every request to providers that process data in the EU, keep no copy of prompts or responses (zero data retention) and do not train on them. Where your organization points an agent at its own model endpoint, requests go there instead and never through OpenRouter.
When a review runs in your own CI pipeline, the code goes from your runner straight to the model provider, never through our servers. Our servers receive the outcome: the verdict, the review as it was posted to the merge or pull request, who opened it, its link and commit, and how long and how many tokens the run took.
Who we share data with
We run Geekbot, its databases and its agents on our own servers in the Czech Republic. We use these service providers (processors) for the rest. Each processes data only on our instructions and under a written agreement.
| Provider | What for | Location |
|---|---|---|
| OpenRouter, Inc. | Routing requests to AI models | USA |
| The provider of the AI model your organization selected (for example Anthropic, OpenAI or Google) | Running the model | EU only |
| GOPAY s.r.o. (payment gateway; a separate controller of the card data you enter on it) | Taking card payments and storing the card for a subscription | Czech Republic |
| Postmark (ActiveCampaign, LLC) | Sending email | USA |
| Amazon Web Services EMEA SARL | Storing uploaded files, recordings and build caches | EU (Frankfurt, Germany) |
Services your organization chooses to connect, such as GitHub, GitLab, Bitbucket, Jira, Linear, Sentry, Slack or Plaud, receive data because your organization asked for it, under their own terms.
We may also disclose data where the law requires it.
Transfers outside the EU
Some providers are in the United States. Where that is the case, we rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
How long we keep it
- Access requests: until we decide on the request, then 12 months so we do not ask you twice.
- Account and membership data: while your account exists. You can leave an organization at any time; to delete your account, write to privacy@geekcoders.cz. When your account or your organization is deleted, we delete this data within 30 days, except where the law requires us to keep it.
- Billing records: for the period required by Czech accounting and tax law (currently up to 10 years). The record of agreement to a recurring payment is kept for at least 12 months after that payment ends.
- Logs: 30 days.
- Audit log: for as long as needed to investigate security incidents and disputes, and at most 5 years.
- Content your organization connects: as long as your organization keeps it in Geekbot, and deleted when your organization deletes it or its account ends.
Cookies and local storage
We use a single cookie, the session cookie that keeps you signed in. It is strictly necessary, so it does not require consent. We store your theme, language and display preferences in your browser's local storage; they never leave your device.
This website uses no analytics, no advertising and no third-party trackers. Fonts are served from our own servers.
Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy of it,
- have inaccurate data corrected,
- have your data erased,
- restrict processing,
- receive your data in a portable format,
- object to processing based on our legitimate interest,
- withdraw consent at any time, for example by unsubscribing from product news, without affecting what we did before.
Write to privacy@geekcoders.cz to exercise any of them. We reply within one month.
You also have the right to lodge a complaint with the supervisory authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, Czech Republic, www.uoou.cz.
Security
Credentials your organization connects are encrypted with AES-256-GCM. Each run of an agent uses its own short-lived key with a spending limit. The agent that reviews code can only read files. Read more on our security page.
Changes
If we change this policy, we will publish the new version here and update the date below. If the change is significant, we will tell organization owners by email before it takes effect.
Last updated: 30 September 2026