Privacy Policy
Effective October 30, 2026 · Sodasoft LLC
How PullTrail collects, uses and protects personal data, and the choices you have.
1. Who is responsible
Sodasoft LLC, a Wyoming limited liability company, operates PullTrail and is the controller of the personal data described here. Contact us about privacy at support@pulltrail.com.
This policy covers the website, the web application, the GitHub App and the emails of the Service. It does not cover GitHub, open source projects or other third-party services, which have their own policies.
2. What we collect
- Account data: email address and, if you connect GitHub, your GitHub user id, login, name, avatar and other public profile fields. Provided by you or by GitHub when you connect.
- Connected GitHub data: issues, pull requests, comments, reviews and code of repositories you install the GitHub App on or work on through the Service, read from GitHub when a page or job needs them. GitHub access tokens are stored encrypted.
- Network data about other people: the GitHub login and public profile fields (such as name, company, location, website and the public email or social links they published) of people who took part in issues and pull requests with you in the last 12 months, and the count and dates of those interactions. See section 4.
- Content you create: preferences, career goals, drafts, edits, approvals, notes, schedules and the history of your contributions.
- Billing data: plan, subscription status, invoices and credit history. Card details are collected and stored by Stripe; we never see or store full card numbers.
- Usage and security data: sign-in times, the browser user agent of your sessions, IP addresses used to limit sign-in requests, AI job records (task, model, cost and status) and an audit trail of important actions.
- Support communications: what you send us by email.
We do not collect special categories of personal data, and we ask you not to put them in notes or other content.
3. How we use it and our legal bases
Where the GDPR or similar laws apply, we rely on these legal bases:
- Performing our contract with you: creating your account, signing you in, finding opportunities, running the AI and sandbox jobs you start, publishing what you approve, tracking outcomes, showing your track record and network, billing and support.
- Legitimate interests: keeping the Service secure and preventing abuse and fraud; showing you the people you worked with from public GitHub activity; understanding and improving the Service with aggregated data. We balance these interests against your rights, and you can object at any time (section 10).
- Legal obligations: keeping tax and accounting records and responding to lawful requests.
- Consent: where the law requires it, for example optional emails. You can withdraw consent at any time without affecting earlier processing.
We do not sell personal data, share it for cross-context behavioral advertising, show ads, or use it to train AI models. We do not make decisions based solely on automated processing that produce legal or similarly significant effects; scores and suggestions in the Service are only recommendations for you.
4. People in your network
The Network feature lists people you actually worked with on GitHub. We build it from public GitHub activity on issues and pull requests you took part in, using only public profile fields, under our and your legitimate interest in keeping a record of professional collaboration. We never collect their private email addresses and never contact them for you.
If you are on someone's network and want to be removed, or want to exercise another right, email support@pulltrail.com with your GitHub login. We will remove you from every network where you appear and keep you out of them.
5. AI processing
When you or an automation you set up start a job, the relevant code, issue text and instructions are sent through Vercel AI Gateway to an AI model provider to produce the result. Providers process this data to deliver the result and, under their terms for business customers, do not use it to train their models. Coding-agent jobs run in an isolated sandbox that does not receive your GitHub tokens.
7. International transfers
We and our providers process data in the United States. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable) or on the EU-US Data Privacy Framework where a provider is certified, together with additional safeguards such as encryption. You can ask us for a copy of the relevant safeguards.
8. How long we keep it
- Account data, your content and your network: while your account exists.
- Agent and sandbox outputs, logs and file contents of approvals: 30 days, after which only summaries remain.
- Expired sessions: 30 days. Sign-in links: 7 days after they expire. Copies of sent emails: 90 days.
- Security audit trail: 2 years.
- Billing records, credit history and AI usage records: as long as tax and accounting law requires, up to 10 years.
When you delete your account, we delete your account data, content, network, GitHub connection and tokens within days. Records we must keep by law are kept without your email address and deleted at the end of their period. Backups expire on their own schedule.
9. Security
We use encryption in transit (TLS) and at rest, encrypt GitHub tokens with a separate key, isolate AI jobs in sandboxes without access to your tokens, require approval before anything is published, protect administrative access with multi-factor authentication, limit access to personal data to people who need it, and keep an audit trail. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as the law requires.
10. Your rights
Depending on where you live, you may have the right to access your personal data, receive it in a portable format, correct it, delete it, restrict or object to its processing, and withdraw consent. You can export your data and delete your account yourself in Settings at any time.
California and other US states. Residents of California and other states with privacy laws have the right to know what we collect and how we use and disclose it, to access, correct and delete it, and not to be discriminated against for using these rights. We do not sell or share personal information as those laws define it, and we do not use sensitive personal information to infer characteristics. You may use an authorized agent; we may ask you to confirm your identity and the agent's authority. If we deny a request, you may appeal by replying to our answer.
To use any right, email support@pulltrail.com from the email of your account. We answer within 30 days, or sooner where the law requires. If you are in the EEA, the UK or Switzerland, you also have the right to complain to your data protection authority.
12. Emails
We send sign-in links, billing and security messages, and the notifications you choose in Settings. You can turn off optional notifications at any time. We do not send marketing emails without your consent.
13. Children
PullTrail is not directed to anyone under 18, and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
14. Changes to this policy
We will notify you by email or in the Service before a material change takes effect. The "Effective" date above shows the current version.
15. Contact
Sodasoft LLC, operator of PullTrail. Privacy questions and requests: support@pulltrail.com. See also our Terms of Service.