Privacy Policy

01Who is responsible

The controller of the personal data processed through aiswec.com, Suite and the aiswec GitHub App (the "veri sorumlusu" under KVKK) is Yusuf Seyrek, an individual trading as AISWEC, based in Türkiye. Write to hello@aiswec.com. The App has a page of its own, GitHub App Privacy, on what it reads in your repository and what reaches us.

This policy applies under the EU and UK General Data Protection Regulations (GDPR) and Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK). The words "we" and "us" mean AISWEC.

02What we collect, and why

Your GitHub account

When you sign in to Suite with the aiswec App, GitHub gives us your numeric GitHub id, your login, your display name and the address of your avatar. We never ask GitHub for your email address. We use them to sign you in and to show who did what. Legal basis: our contract with you (GDPR art. 6(1)(b); KVKK art. 5(2)(c)).

Your sign-in

GitHub gives Suite a token that acts as you, within what you and the App's installation allow. It is sealed (encrypted with AES-256-GCM) into a cookie in your browser. While you use Suite, our server holds the access token in memory to keep your screens current; it is never written to our disk, a restart forgets it, and signing out revokes it at GitHub. A sign-in lasts at most 30 days. Basis: contract.

Your account record and what you did through Suite

• When you were first and last seen, and how many times you signed in.
• One line for each thing you did through Suite: what (for example, "approved a plan"), in which repository and which task or change number, when, and whether it went through.

We use them to run, secure and support the Service, to see how it is used, and to apply plans. Basis: our legitimate interest in operating, securing and improving the Service (GDPR art. 6(1)(f); KVKK art. 5(2)(f)), and our contract with you.

Your logs

So that Logs in Suite can show every run AISWEC made and what started it, we keep, for each run of a stage on a project: when it ran, the stage, how it ended, the model, the tokens and the time it took, the task or change it worked on, what AISWEC wrote in answer, and the words that started it. Those are what you sent AISWEC through Suite (a task's title and text, a reply, your answers to its questions, a review), as you sent them, or the task, comment or review on GitHub that started the run. Anyone who can read the repository in Suite can read its logs, as they can read the same words on GitHub. Basis: our contract with you.

Your repositories

Suite and the App read what is in the repositories AISWEC is installed on (issues, pull requests, comments, files and workflow runs) when they need to: to show it to you, and to run the stages. Suite holds what it reads in memory for minutes, and your browser keeps a copy of your screens for up to 7 days so the app opens quickly. A file you attach to a task or a reply in Suite (an image or a text file) is written to that repository with your own token, on a ref of AISWEC's own, and read back from there with the token of whoever opens it; it passes through our server on the way and is not kept there. Your browser keeps a shown file for a day. We keep no copy of your code on our server, apart from these:

• Previews. When a project turns previews on, the built site of a pull request is downloaded from GitHub and served from our server, at an address under aiswec.com, for up to 14 days.
• Cloud device captures. When a project turns cloud devices on, the screenshots and short video of a change running, until that change is accepted or closed.
• Our back office. AISWEC's operator can see, for every repository the App is installed on, its name, whether AISWEC is set up there, the engine and model its settings name, and the record of its stage runs (when, which stage, how it ended, how long it took, which model and how many tokens). We do not read your code or your conversations, except to show them to you, when you ask us for help and allow it, or when the law requires it.

Basis: our contract with you, and for the back office our legitimate interest in operating, supporting and billing the Service.

Payments

Polar is our merchant of record: you buy from Polar, and Polar takes the payment (through its processor, Stripe) and handles the tax. We never see your card. Polar tells us what was bought: the order and subscription, the amounts and the tax, the status, and the GitHub id we attached to the checkout. When you check out, we pass your IP address to Polar so it can tell which country's tax applies. We keep these records in our billing ledger and log. If your account takes AISWEC's plan on GitHub Marketplace, GitHub tells us when it is taken, changed or cancelled: the account's name, id and type, the plan, and who acted for it. We keep that in the same log. Basis: our contract with you, and our legal obligations to keep tax and commercial records (GDPR art. 6(1)(c); KVKK art. 5(2)(ç)).

Credits

When you buy credits, we create a key for you on AISWEC's OpenRouter account, capped at what you bought, and keep it encrypted on our server so it can be written into the repositories you turn credits on for. We read its usage from OpenRouter to show your balance. When a stage runs on credits, its prompts and the model's answers go from GitHub Actions through OpenRouter to the model's provider, and do not pass through our server. Basis: contract.

Your own keys

When you give Suite your Claude key or an Expo token, it is written straight into the secrets of the repositories you choose, encrypted with GitHub's own sealed-box encryption, and forgotten. We never store it.

Notifications

Suite lists what it tells you on its Notifications page: what each one was about (a task's title and its project, your credits balance, the state of your plan), when, and whether you have read it. We keep each for 90 days, and you choose the kinds on the Account page. Basis: contract.

If you turn browser notifications on, your browser gives us an address and keys for its push service. We keep them until you turn notifications off or sign out, and use them to send you the same notifications through your browser's push service. Basis: your consent, which you withdraw by turning notifications off.

Favourites and icons

The projects you star and the icons you give them, until you change them. Basis: contract.

Analytics and advertising measurement

aiswec.com and Suite use Google Analytics 4 and Google Ads conversion measurement, to see which pages are used and which ads bring people. Suite reports a screen by its kind (for example "a task"), never by its address, so no repository, task or person's name is sent. Besides page views, the events are: signing in, creating a project, creating a task, starting a checkout and completing a purchase, with its amount.

• A banner asks you once, with Accept and Decline side by side, whether Google may set its cookies. Your answer is kept in your browser and holds for aiswec.com and Suite alike. Change it at any time under Cookies at the foot of every page, or on Suite's Account page.
• If you accept, Google sets the cookies listed under cookies, to count visits and to tie a sign-in or a purchase to the ad that brought it.
• If you decline, no cookie is set, the ones Google set are deleted, and Google receives only pings without identifiers.
• Until you answer: in the EEA, the UK, Switzerland and Türkiye, analytics and advertising storage are off, as if you had declined; elsewhere they are on, as if you had accepted.
• Ad personalisation is off everywhere: we build no remarketing audiences.

Google processes this data under its own privacy policy, and our Analytics property keeps it for 14 months at most. Basis: your consent, given in the banner; outside the EEA, the UK, Switzerland and Türkiye, until you answer, our legitimate interest in measuring this website and our ads.

Session recordings

If you accept the cookie banner, aiswec.com and Suite record what their pages show you and what you do there: the screen and how it changed, where you moved, clicked and scrolled, what you typed, and which page came next, so we can see where they are hard to use. In Suite that includes what its screens showed of your projects: names, tasks, plans, replies and code. The recording is made in your browser and sent only to our own server.

• A password field is never recorded, and anything shaped like a key or a token is replaced with asterisks wherever it appears, in your browser and again on our server.
• With each recording we keep your browser and system (for example "Chrome on macOS"), the size of your window, the site or campaign that sent you and, if you are signed in, your GitHub id and login.
• Only AISWEC's operator can watch a recording, and each is deleted after 30 days.

Basis: your consent, given in the banner. Decline under Cookies and recording stops at once.

When you write to us

Your email address and what you write, to answer you. Basis: legitimate interest, or our contract when it is about your account.

Server log

Our server's system log records what Suite does and what goes wrong, which can name a GitHub login, a GitHub id or a repository. It is kept for 90 days. Our web server keeps no access log. Basis: legitimate interest in security and in keeping the Service running.

03What the stages do in your repository

The stage workflows run on GitHub Actions in your repository, under your account. They send the issue, the conversation, the files a maintainer attached and the code they need to the model you chose (your own Claude subscription, with Anthropic, or AISWEC credits, through OpenRouter) and write the results back to GitHub. Our server is not on that path and receives none of it. What a model provider does with a request is set by its terms with whoever pays for it: you, for your Claude subscription; AISWEC, for credits.

04Who else handles your data

We do not sell your personal data. We share it only with these providers, for the purposes above:

• GitHub, Inc. (USA): sign-in, the App, your repositories. You also have your own agreement with GitHub.
• Hetzner Online GmbH (Germany): our server, in Helsinki, Finland.
• Polar Software, Inc. (USA), with its processor Stripe: payments, as merchant of record.
• OpenRouter, Inc. (USA): AISWEC credits, and the model providers it routes requests to.
• Google (Google LLC, USA, and Google Ireland Limited): Analytics, Ads measurement, and the fonts Suite's sign-in screen and the not-found page load from Google Fonts.
• Your browser's push service (Apple, Google, Mozilla or Microsoft): when you turn notifications on.
• Appetize.io (USA): cloud devices, only for a project that turns them on.
• Cloudflare, Inc. (USA): the domain's DNS only; no traffic passes through Cloudflare.

We may also disclose data when the law requires it, to protect the Service and the people who use it, or if the business is transferred, to a new owner bound by this policy.

05Transfers abroad

Our server is in the EU, in Finland. Several of the providers above are in the USA. When data leaves Türkiye, the EEA or the UK, we rely on the safeguards the law provides: adequacy decisions (including the EU-US Data Privacy Framework, for a provider certified under it), standard contractual clauses, or, where neither is available, the exceptions the law allows, such as a transfer needed to perform our contract with you.

06Cookies and storage in your browser

Suite's own, needed for it to work

• __Host-aiswec_session: your sealed sign-in. Up to 30 days.
• __Host-aiswec_oauth_state: protects the round trip to GitHub while you sign in. 10 minutes.
• __Host-aiswec_preview: on a preview's address, lets you open a private preview. 12 hours.

Kept in your browser's storage

A copy of your screens (suite.cache.*, up to 7 days, emptied when you sign out), who was signed in last (suite.me), your theme, the last project you asked in, the count on the app's icon, your answer to the cookie banner (aiswec.consent, and aiswec.consent.recording for recordings), once you accept it the id that ties one visit's recording together (aiswec.replay, in this tab only, until you close it), and two markers that keep a sign-in or a purchase from being counted twice by analytics.

Google's, once you accept

• _ga and _ga_<id>: Analytics, up to 2 years.
• _gcl_au: Ads conversion measurement, 90 days.
• _gcl_aw: the click on an ad that brought you here, 90 days.

Outside the EEA, the UK, Switzerland and Türkiye they are also set until you answer. Decline them under Cookies, or block them in your browser's settings; aiswec.com and Suite work without them.

07How long we keep it

• Your account record: while you use AISWEC, and deleted 24 months after you were last seen, or sooner if you ask.
• What you did through Suite: 12 months.
• Your logs: 12 months from the run or the prompt.
• Billing ledger and log: as long as tax and commercial law requires, up to 10 years.
• Your credits key: until you ask us to close your credits, when it is also deleted at OpenRouter.
• Previews: 14 days. Cloud device captures: until the change is accepted or closed.
• Notification addresses: until you turn notifications off or sign out. What Suite told you: 90 days.
• Server log: 90 days. Analytics: 14 months at most. Session recordings: 30 days.
• Your sign-in token: in our server's memory while you use Suite, and in your browser's cookie for up to 30 days.

08Your rights

Under the GDPR you can ask for access to your data, for its correction or deletion, to restrict its use, and for a copy in a portable form; object to processing based on our legitimate interests; withdraw your consent at any time; and complain to your data protection authority.

Under article 11 of KVKK you can learn whether your data is processed and ask for information about it; learn the purpose and whether it is used for that purpose; know the third parties it is transferred to in Türkiye or abroad; ask for it to be corrected, deleted or destroyed, and for those third parties to be told; object to a result against you reached only by automated analysis; and claim compensation for damage from unlawful processing. If we refuse your application or do not answer it, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

To use any of these rights, write to hello@aiswec.com with your GitHub login. We may ask you to show that the account is yours (for example, with a comment from it), so that your data is not handed to someone else. We answer within 30 days, free of charge.

09Security

Everything travels over TLS. Sign-in tokens are sealed with AES-256-GCM, credits keys are encrypted at rest, your own keys are never stored, secrets reach GitHub in its sealed-box encryption, the back office answers only its operator, and each part of AISWEC asks GitHub for the least it needs. No system is perfectly secure: if a breach affects your data, we will tell you and the authorities as the law requires.

10Children

AISWEC is not for anyone under 18, and we do not knowingly collect their data.

11Changes

We will post changes here with a new effective date, and tell you in Suite or by email before a significant change takes effect.

12Contact

Yusuf Seyrek, trading as AISWEC, Türkiye. hello@aiswec.com

Effective 13 October 2026. Earlier versions: 10 October 2026, before GitHub Marketplace told us about plans taken there; 9 October 2026, before a session recording kept what the screen showed; 8 October 2026, before files could be attached to a task; 7 October 2026, before Suite kept your logs.