Privacy Policy

At Blame ("we", "us", or "our"), privacy and data protection are fundamental to our architecture. This Privacy Policy describes how Blame Inc. collects, uses, processes, and protects information when you access our website, platform, APIs, GitHub integrations, and related developer services (collectively, the "Services"). We adhere strictly to zero-code-retention principles. Your source code and AST syntax trees are analyzed in ephemeral memory and are never retained or used to train foundational AI models.

We collect information only to the minimum extent necessary to provide and maintain our Services: · Account & Profile Information: When you create a workspace via GitHub OAuth or email, we collect your name, email address, username, avatar URL, and GitHub user ID. · Billing & Payment Data: Payment transactions are processed directly by our PCI-DSS certified payment processor (Stripe). We do not store complete payment card numbers on our servers. · Telemetry & Usage Metrics: Aggregated metadata such as review generation timestamps, token consumption counts, and API response latencies to ensure platform stability. · Customer Communications: Records of customer support interactions, technical inquiries, and feedback.

Your proprietary source code remains strictly your intellectual property: · Ephemeral In-Memory Execution: Code diffs and AST syntax trees are loaded into transient container RAM solely for the duration of the automated review pass and are discarded immediately afterward. · No Model Training: We maintain legally binding agreements with model inference providers ensuring that your code is never logged, stored, or utilized for model training or fine-tune public AI models. · Zero Data Retention: We do not maintain historical caches or databases of your source files unless explicitly configured by you within your workspace.

We use collected metadata and account data strictly for: · Providing, operating, and improving our code intelligence platform and GitHub integrations. · Managing subscriptions, seat quotas, and credit consumption. · Authenticating users and enforcing workspace Role-Based Access Control (RBAC). · Communicating critical security notices, product updates, and billing receipts. · Complying with legal obligations, audits, and enforcing our Terms of Service.

We implement defense-in-depth security measures including TLS 1.3 encryption in transit and AES-256 encryption at rest for our PostgreSQL database and vector storage. We only share data with vetted third-party subprocessors essential for infrastructure, embedding generation, and AI inference (including AWS, Google Cloud, Together AI, Voyage AI, and LangChain). All inference requests are processed under strict zero-data-retention terms without model training.

Depending on your location, you hold certain statutory data rights under the GDPR, UK GDPR, and CCPA/CPRA, including: · Right of Access: Request a copy of the personal information we hold about you. · Right to Rectification: Request correction of inaccurate personal data. · Right to Erasure ("Right to be Forgotten"): Request permanent deletion of your account and associated metadata. · Right to Data Portability: Receive your account metadata in a machine-readable format. To exercise any of these rights, contact our Data Protection Officer at privacy@getblame.com.

If you have questions, concerns, or requests regarding this Privacy Policy, please contact our privacy team: Blame Inc. Email: privacy@getblame.com Security: security@getblame.com