GitHub App Privacy

01Who is responsible

The controller is Yusuf Seyrek, an individual trading as AISWEC, based in Türkiye, as in the Privacy Policy. This page covers the aiswec GitHub App (github.com/apps/aiswec) and the workflows it runs, which are open source at github.com/aiswec/agent. Suite, the web app, and aiswec.com are covered by the Privacy Policy, whose sections on transfers abroad and your rights apply here too.

02Two ways to run it

• Hosted: AISWEC's App, installed on your repositories, as Suite or GitHub Marketplace sets it up. Section 04 says what reaches us.
• Self-hosted: a GitHub App of your own, or none, set up from the open source repository. AISWEC's server receives nothing from your runs, and section 04 does not apply.

03What runs in your repository

The App's work is done by workflows that run on GitHub's runners, under your repository, when a maintainer starts one. A run reads what its task needs: the issue and its comments, a pull request and its reviews, the files of the repository it opens, and files a maintainer attached. It sends them to the model provider your settings name: Anthropic, with your own Claude subscription, or OpenRouter, with AISWEC credits. It writes back to GitHub as aiswec[bot]: comments, labels, a branch, commits and a pull request. In a private repository the run's log shows the model's full transcript; in a public one it does not. AISWEC's server is not on that path and receives none of it.

04What reaches AISWEC

• A run's token request. Each run sends aiswec.com the signed token GitHub gives its job, which names the repository, the workflow and the run. We check it and answer with a GitHub token for that one repository, valid for an hour. Our server log keeps one line for each request: the repository, the stage and the run number.
• Our back office. AISWEC's operator can see, for every repository the App is installed on, its name, whether AISWEC is set up there, the engine and model its settings name, and the record of its runs (when, which stage, how it ended, how long it took, which model and how many tokens). It is read from GitHub when the page is opened, held in memory for minutes, and never written to our disk.
• GitHub Marketplace. If your account takes the App's plan on Marketplace, GitHub tells us when it is taken, changed or cancelled: the account's name, id and type, the plan, and who acted for it. We keep that in our billing log.
• Nothing else. The App's webhook is off, so GitHub sends us no events from your repositories.

05What the App may do in GitHub

When you install it, the App asks for Actions, Contents, Issues, Pull requests and Workflows (read and write), Metadata (read), and Administration and Secrets (read and write). The last two are for Suite alone, acting as you, to make a project from AISWEC's template and to write the keys you give it into a repository's secrets. A run's token never holds them: it covers one repository, carries at most the first six, and lasts an hour.

06Who else handles it

• GitHub, Inc. (USA): everything the App reads and writes lives in your repository there.
• The model provider your settings name: Anthropic, or OpenRouter and the providers it routes to.
• Hetzner Online GmbH (Germany): our server, in Helsinki, Finland, for the token requests and the log.

07How long we keep it

• A run's token request: one line in our server log, 90 days.
• Marketplace plan events: in our billing log, as long as tax and commercial law requires, up to 10 years.
• What the App writes in your repository is yours, and stays until you delete it.

08Removing the App

Uninstall it from your GitHub settings (Applications, Installed GitHub Apps), or from your organization's. From that moment runs get no token, and the App reads nothing. What it wrote stays in your repository, and our log lines age out within 90 days.

09Contact

Yusuf Seyrek, trading as AISWEC, Türkiye. hello@aiswec.com

Effective 14 October 2026.