Privacy

Last updated October 7, 2026

TOTEM (RCS Nanterre 881 263 503, 1 avenue Galois, 92340 Bourg-la-Reine, France) is the data controller for Yarrow. Contact: contact@yarrow.run.

What we collect, and why

• Account: your GitHub username, name and avatar, or your email. To sign you in and run the service (contract).
• Sponsor profile: the name, tagline, description and website you choose to show publicly, and the number of clicks on your website link (not who clicked).
• Payments: amounts, VAT, status and Stripe references. Card details stay with Stripe. Kept 10 years, as French accounting law requires (legal obligation).
• Projects: repository names, the tickets you choose, run results and pull request links. Your code is read during a run in an isolated sandbox and is not stored by us afterwards.
• Security: technical logs kept briefly to protect the service against abuse (legitimate interest).

Who processes it

Cloudflare (hosting), Supabase (database and sign-in, servers in Ireland), Stripe (payments), GitHub (repositories), Resend (sign-in emails), and Anthropic and OpenAI (the AI models, through their commercial APIs). Some are based in the United States; transfers rely on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. We do not sell your data.

Cookies

Only the cookies needed to keep you signed in and to finish a sign-in or a GitHub connection. No analytics, no advertising.

How long

Account data is kept while your account exists. Ask us to delete it at any time; payment records stay as long as the law requires.

Your rights

You can access, correct, delete or export your data, and object to or restrict its use, by writing to contact@yarrow.run. You may also complain to the CNIL (cnil.fr).