mergepls.
Legal

Privacy Policy

Last updated May 16, 2026

What we collect

  • Account data: your GitHub user id, login, display name, email address, and avatar URL — provided by GitHub OAuth when you sign in.
  • Repository metadata: the full name, owner, visibility, and installation id of repos you connect.
  • Pull request data: for each PR processed, the title, body, commit list, file list, diff, and the description we generated.
  • Billing data: a Lemon Squeezy customer id and subscription id. We do not store credit card numbers.
  • Operational logs:webhook deliveries, errors, and aggregate usage counts.

How we use it

  • To run the Service: read PRs, generate descriptions, post them back to GitHub.
  • To enforce plan limits and prevent abuse.
  • To send transactional email about your account (welcome, quota, billing).
  • To debug failures and improve reliability.

Sub-processors

  • Anthropic — generates the pull request descriptions. Your PR content is sent to Anthropic for inference. Anthropic does not train on this data per the Claude API zero-retention policy when in effect.
  • Crunchy Bridge — hosts our Postgres database.
  • Vercel — hosts the web application.
  • Lemon Squeezy — handles payments and billing.
  • Resend — sends transactional email.
  • GitHub — source of repository data and identity.

Retention

Account data is retained until you delete your account. PR events are retained for as long as your account is active so we can show usage history; if you delete your account, all rows are removed within 30 days.

Your rights

You can request export or deletion of your data at any time. The fastest path is the Delete account button on the dashboard (Settings → Account), which removes all your data from our database. You can also email support@mergepls.app.

Security

Database connections are encrypted (TLS) with verified certificates. Webhook payloads are HMAC-verified. Secrets are stored in Vercel environment variables and never exposed to clients.

Cookies

We use one essential session cookie (next-auth.session-token) to keep you signed in. We do not set advertising or third-party tracking cookies.

Contact

Privacy questions can be sent to support@mergepls.app. See also our Terms of Service.