Privacy Policy — preloop

Owner and Data Controller

GetVariant LLC, a Delaware limited liability company.

For the content your workflows send us (code, logs, artifacts, caches, secrets and the rest), your organization decides what goes in and we process it on your behalf as a Data Processor. For your account, billing, and our website, GetVariant LLC decides how the data is used and acts as Data Controller. This policy explains both.

Types of data collected

GetVariant LLC ("preloop") collects the following types of Personal Data when you create an account, install the preloop GitHub App, run workflows, or use this website:

Account and identity data: name, email address, GitHub identity, the organizations you belong to, and your role in each.
GitHub data: when you install the preloop GitHub App, details of the installation, the repositories you grant access to, and the webhook events GitHub sends about them — pushes, pull requests, check runs, and related metadata — used to run and report your workflows and for billing.
Your content: what your workflows and our CLI send us to run your jobs — source code and working trees (including uncommitted files when you run plp ci from your machine), workflow files, job logs, artifacts, caches, test results, and signed run records.
Secrets: values you store for your workflows. They are encrypted with keys held in a key management service and are only released to the jobs you allow.
Usage and billing data: how much you run, for how long, on what machine sizes, storage consumed, and what it costs. Stripe processes your payment details; we do not store full card numbers.
Website and product analytics: pages visited, features used, and basic device information, collected with PostHog.
Messages: what you send us when you contact us for help.
System logs: IP addresses, request times, user agents, and similar technical records collected automatically for operation and maintenance.

You are responsible for ensuring you have consent to provide any third-party Personal Data. Withholding data marked as required may make some features unavailable.

Mode and place of processing the Data

Methods of processing

preloop implements industry-standard security measures to protect your data from unauthorized access, disclosure, modification, or destruction. Every job runs in its own isolated environment that is destroyed when the job ends. Data is encrypted in transit and at rest, and access inside preloop is limited by role and logged. Our security page has the details.

Data processing follows procedures aligned with the purposes in this policy. In addition to preloop's internal teams, your data may be accessed by trusted third-party service providers appointed as Data Processors — our payment processor, hosting providers, and analytics tools. These parties are bound by confidentiality and are only given the access needed to provide their service to us. The current list is published on our subprocessors page.

Legal basis of processing

preloop processes Personal Data on the following legal grounds:

Contractual necessity: to run your jobs, provide the service, and bill you for it — including processing code, logs, artifacts, and GitHub webhook events.
Legal obligations: to comply with applicable law — for example, retaining billing records as tax law requires and responding to lawful requests from authorities.
Legitimate interests: to keep the service secure, prevent abuse, investigate problems, and improve performance — for example, the audit log and system logs.
Consent: for website and product analytics, where required, and for contacting you about features you have asked about. You can withdraw consent at any time.

preloop does not use Personal Data or your content to train Artificial Intelligence (AI) or Machine Learning (ML) models. Where preloop features use third-party AI services — for example, agents that watch your CI and propose changes — the data those services process is not used to train or improve their models. These features can be disabled at the organization level.

You may contact us to clarify which legal basis applies to a given processing activity, or whether providing particular data is a statutory or contractual requirement.

Place

preloop stores and processes data in the United States, on servers we operate ourselves. If you use preloop from elsewhere, your data will be transferred to the United States. Subprocessors that handle your data, and their processing locations, are listed on the subprocessors page.

Retention

We keep Personal Data only as long as it is useful to you, needed to perform the contract, or required by law.

Data	How long
Code submitted from your machine	Deleted when the run finishes; your organization can keep it longer if needed
Job environments	Destroyed when the job ends; a failed job kept for debugging is held for 30 minutes
Logs	30 days by default; your organization can set 1 to 90 days
Artifacts	30 days by default; your organization can set 1 to 90 days
Caches	Removed after 7 days without use, or sooner when the 10 GB storage limit is reached
Test results and reuse data	90 days
Run records	While your organization exists
Secrets	Until you delete them
Audit log	90 days
GitHub webhook events	30 days
Account data	While your account is active, then 30 days after it is closed
Billing records	7 years, as tax law requires

Backups follow the same rules: deleted data leaves our backups within 30 days.

When your organization closes, you have 30 days to export your content. After that, we delete all relevant data within 30 days using industry-standard methods, except billing records we must keep. Once a retention period has expired, the rights of access, erasure, rectification, and portability can no longer be exercised for that data.

Detailed information on the processing of Personal Data

Personal Data is collected for the following purposes and using the following services:

Handling payments

preloop processes payments by card or other means through an external payment provider. In general, you provide payment details directly to the provider; preloop receives only confirmation that a payment succeeded, plus billing contact details and purchase history.

Stripe (Stripe Inc.) — payment processing and invoicing. Personal Data processed: email address, payment information, purchase history, usage data. Place of processing: United States.

Registration and authentication

By registering or authenticating, you allow preloop to identify you and give you access to its services. Third parties provide the underlying authentication and repository access; preloop can access data held by those services for identification purposes.

GitHub OAuth and the preloop GitHub App (GitHub Inc.) — sign-in, organization membership, repository access, and the webhook events that trigger runs. Personal Data processed: various types of data as specified in GitHub's privacy policy, plus repository and event metadata granted by the installation. Place of processing: United States.

Analytics

PostHog (PostHog Inc.) — website and product analytics. Personal Data processed: pages visited, features used, usage events, basic device information, IP address. Place of processing: United States.

Traffic optimization and distribution

Cloudflare (Cloudflare Inc.) — hosting and delivery of this website. Because Cloudflare filters traffic between your browser and the site, it sees standard web request data. Personal Data processed: various types of data as specified in Cloudflare's privacy policy, including IP address and request data. Place of processing: global network.

Infrastructure and connectivity

Amazon Web Services (Amazon Web Services, Inc.) — key management and encrypted secret storage. Personal Data processed: encrypted secret values; our databases encrypt at rest using managed keys. Place of processing: United States.

Tailscale (Tailscale Inc.) — secure network connections to our servers, including delivery of GitHub webhook events to preloop. Personal Data processed: network traffic metadata and the payloads it carries. Place of processing: United States.

Information on opting out of interest-based advertising

preloop does not use your data for advertising. In addition to any opt-out features in the services listed above, you may follow the instructions provided by YourOnlineChoices (EU), the Network Advertising Initiative (US), the Digital Advertising Alliance (US), DAAC (Canada), or DDAI (Japan), which let you set tracking preferences across most advertising tools, or use your device's advertising settings.

Further information about the processing of Personal Data

The rights of users

You have the following rights regarding your Personal Data:

Withdraw consent at any time, where processing is based on consent.
Object to processing based on our legitimate interests.
Access: request confirmation that your data is being processed and obtain a copy of it.
Rectification: correct inaccurate or incomplete Personal Data.
Restriction: limit processing so we store your data without further use.
Erasure: request deletion of your Personal Data where applicable.
Portability: receive your data in a structured, commonly used, machine-readable format and transfer it to another controller.
Lodge a complaint with your competent data protection authority.
Restrict data flow from GitHub by uninstalling or suspending the preloop GitHub App. This stops new events reaching preloop but also stops preloop from running your workflows.
Disable AI-powered features at the organization level, which stops your data being processed by third-party AI services and may limit some service capabilities.

To exercise any of these rights, email [email protected]. We will answer within 30 days and will not treat you differently for asking. For content an organization controls, the organization decides; we will pass requests about it to them.

Details about the right to object to processing

Where we process Personal Data on the basis of legitimate interests — such as security, abuse prevention, and service improvement — you may object by giving a reason related to your situation, and we will assess the request. preloop does not process Personal Data for direct marketing, so no objection is needed for that.

Additional information about data collection and processing

Legal action

Your Personal Data may be used for legal purposes in court or in the stages leading to possible legal action arising from improper use of the service. You acknowledge that we may be required to reveal Personal Data on request of public authorities.

System logs and maintenance

For operation and maintenance, preloop and the third-party services it uses may collect files that record interactions with the service (system logs) and may use Personal Data such as the IP address for this purpose.

How "Do Not Track" requests are handled

This service does not support "Do Not Track" requests. Whether the third-party services it uses honor them is described in their own privacy policies.

Changes to this privacy policy

We may modify this policy at any time. Changes are posted on this page and the effective data updated. For significant changes that materially affect how we process your Personal Data, we will notify you by the email address associated with your account before they take effect. We encourage you to review this page regularly.

Definitions and legal references

Personal Data (or Data): any information that can directly or indirectly identify a natural person — including email addresses, personal identification numbers, and online identifiers.

Usage Data: information collected automatically through the service — IP addresses, URIs, request times and methods, response codes, browser and operating system details, and time spent on pages.

User: the individual using the service; synonymous with Data Subject unless otherwise specified.

Data Subject: the natural person to whom the Personal Data pertains.

Data Processor: a person or body that processes Personal Data on behalf of the Data Controller, as described in this policy — including the subprocessors we list.

Data Controller (or Owner): GetVariant LLC, the entity that determines the purposes and means of processing Personal Data.

Service: the hosted CI for GitHub Actions workflows provided by preloop, including the website, CLI, API, runners, caches, and related tooling.

Legal information: this Privacy Policy is prepared in accordance with applicable legislation including Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation). It relates exclusively to preloop unless stated otherwise.

Contact

Questions about privacy, or a request about your data: [email protected].