Data processing agreement

You, the organization that uses Release Butler, are the data controller. Bottelet Ventures ApS, a company registered in Denmark, is the data processor.

Where this agreement and the terms of service disagree about personal data, this agreement applies.

We process personal data to provide Release Butler: to read your repositories, draft release notes, take screenshots of your app, publish release notes and send release emails to your list.

We process it for as long as you use Release Butler, and after that until it is deleted as this agreement describes.

Processing means collecting, storing, organizing, reading, sending and deleting data, only as far as that purpose needs.

Depending on how you use Release Butler, we process data about these people:

• Email recipients: their email address, their name if you give it, how they were added, which releases were sent to them and when, and whether they unsubscribed.
• Widget readers: the ID you send for them and any name, email address or other details you choose to pass along, with the releases they opened and when, and how they interacted with the widget: which releases and entries they viewed, scroll depth, time on screen, clicks and how they closed it, tied to that ID. The working record behind each opening is deleted after 30 days; the per-release summary is kept until your organization is deleted.
• People in your repositories: the GitHub usernames of pull request authors, and any personal data in pull request titles and descriptions or in code the AI reads.
• People in your app: whatever your test account can see on the screens we photograph, and that test account's sign-in details.

We do not ask for special categories of personal data. Please keep them out of your lists, reader details, repositories and test data.

As your processor, we:

• process the data only on your documented instructions, which are our terms, this agreement and what you do in the app, unless the law requires otherwise, in which case we tell you first where we are allowed to;
• make sure everyone who can access the data is bound by confidentiality;
• keep the data secure with the measures described below;
• help you answer requests from the people the data is about, for example by letting you remove recipients and export readers;
• help you with security, breach notifications, impact assessments and consultations with authorities, as far as our role allows;
• tell you if we believe an instruction breaks data protection law.

You allow us to use these subprocessors:

• Anthropic, United States: writes release drafts and reads parts of your repository to find the screen a change is on.
• Typesafe: judges whether a change can be seen on screen and picks what the screenshot browser clicks.
• OpenAI, United States: writes text the screenshot browser types into a field, when a step needs it.
• Resend, United States: delivers release emails and account emails.
• Paddle: sells our plans as merchant of record. It receives the owner's email address and the organization's name, not the data of your users.
• Cloudflare, United States: stores screenshots, logos and database backups, through Laravel Forge's object storage.
• Laravel Holdings Inc. (Laravel Forge), United States: provides and manages our servers, which run on DigitalOcean infrastructure in Frankfurt, Germany.

Each subprocessor is bound to data protection terms that protect the data at least as well as this agreement. We tell organization owners by email at least 30 days before we add or replace a subprocessor, and update this page. If you object on reasonable grounds, you can end the agreement before the change applies.

Our servers and database are in Frankfurt, Germany. Some subprocessors are outside the EU and EEA. Transfers to them rely on an adequacy decision, such as the EU-US Data Privacy Framework for certified providers, or on the EU's standard contractual clauses.

Our measures include:

• all traffic uses HTTPS, and browsers are told to use nothing else;
• passwords are stored only as hashes, and two-factor authentication and passkeys are available on every account;
• GitHub access tokens, test sign-in details, the token for your list's address and two-factor secrets are stored encrypted;
• an organization's data is shown only to its own members;
• our GitHub App has read-only access, and its tokens expire after an hour;
• our servers are in the EU, and the database is backed up every night to separate private storage.

If we become aware of a personal data breach that affects your data, we tell you without undue delay.

We tell you what happened, which data and people are affected, the likely consequences and what we are doing about it, as far as we know at the time, so you can meet your own duty to notify.

When your organization is deleted, we delete the personal data we hold for you. It leaves our database backups as they expire, within about 80 days.

Before that, you can remove recipients yourself and export your widget readers as a CSV file. Write to privacy@releasebutler.com if you need a copy of other data.

We give you the information you need to show that we keep this agreement. If that is not enough, you may audit us yourself or through an independent auditor bound by confidentiality, once a year, with 30 days' notice and at your own cost, unless a data protection authority requires more.

This agreement is part of our terms of service, is governed by Danish law and lasts as long as we process personal data for you. Write to privacy@releasebutler.com with any question about it.