Privacy Policy

Effective date: July 30, 2026

1. Introduction

Previewops ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect when you use the Previewops service (the "Service"), how we use it, and the choices you have.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

We collect the following categories of information:

• GitHub account data — When you authenticate via GitHub OAuth, we receive your GitHub username, display name, email address (if public), avatar URL, and the list of organisations you are a member of. This is used solely to identify your account and authorise access to the Service.
• GitHub App installation data — When you install the Previewops GitHub App on an organisation or user account, GitHub provides us with the installation ID and the organisation name. We store this to associate deployments with the correct account.
• Pull request and repository metadata — To deploy preview environments, we process pull request numbers, branch names, commit SHAs, repository clone URLs, and PR author usernames. We do not access or store the full content of your source code beyond what is necessary to build and deploy a container image during an active deployment.
• Billing information — Subscription and payment data is handled by Stripe. We store only the Stripe customer ID and subscription identifiers. We never store full card numbers or payment credentials.
• BYOC cloud credentials — If you supply your own cloud provider credentials (Bring Your Own Cloud), they are encrypted using a service-managed key before being stored. Credentials are decrypted in memory only at the moment a deployment operation requires them and are never written to logs, disk files, or external services in plaintext.
• Usage data — We record counts of deployments and QA runs per billing period to enforce plan caps and calculate any applicable overage charges.
• Log data — Our servers generate structured logs containing IP addresses, HTTP request paths, response codes, and timestamps. These logs are used for security monitoring, debugging, and abuse prevention. Logs are retained for a limited period and are not sold or shared with third parties.

3. How We Use Your Information

We use the information we collect to:

• Authenticate you and authorise access to the Service.
• Build and deploy preview environments on your behalf.
• Calculate and bill for usage in accordance with your subscription plan.
• Send transactional communications (deployment status, billing receipts, support responses).
• Detect and prevent abuse, fraud, and security threats.
• Improve the Service through aggregated, anonymised usage analysis.

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

4. Data Storage and Security

Your data is stored on Google Cloud Platform infrastructure. We apply industry-standard security controls including encrypted storage at rest, encrypted transport (TLS 1.2+), and role-based access controls that limit who on our team can access production data.

BYOC credentials are protected by envelope encryption: credentials are encrypted with a data encryption key, which is itself encrypted with a key managed by Google Cloud KMS. Plaintext credentials exist only in-process memory during deployment operations and are immediately discarded afterwards.

Despite these measures, no system is perfectly secure. We encourage you to use strong, scoped cloud credentials and to rotate them regularly. Please report any suspected security issues to hello@previewops.io.

5. Third-Party Services

The Service interacts with the following third-party services, each governed by their own privacy policies:

• GitHub (Privacy Statement) — Used for authentication and webhook delivery. Your use of GitHub is subject to GitHub's terms.
• Stripe (Privacy Policy) — Used for subscription billing and payment processing. Card data is handled entirely by Stripe; we do not receive or store it.
• Google Cloud Platform (Privacy Notice) — Used for compute, database, storage, and key management infrastructure. Data is processed within GCP data centres.
• Resend — Used to send transactional email notifications. Email addresses used for transactional messages are not shared beyond what is necessary for delivery.
• PostHog (Privacy Policy) — Used for product and website analytics. On our public marketing pages (home, pricing, docs, about, terms, privacy, contact, sign-in), PostHog collects page URL, referrer, approximate location, and device/browser information to help us understand site traffic. Session recording and surveys are disabled. Data is processed in PostHog's US region.

6. Cookies and Sessions

We use a single server-side session cookie (po_sid) to maintain your authenticated session after GitHub OAuth login. This cookie is:

• Marked HttpOnly and Secure — it cannot be read by client-side JavaScript and is only sent over HTTPS.
• Scoped to the Previewops domain and not accessible to third-party scripts.
• Set to expire after 8 hours of inactivity, or immediately when you log out.

We do not use advertising cookies or cross-site tracking cookies. On our public marketing pages, we use a first-party analytics cookie (PostHog) to measure aggregate site traffic — this cookie is not set on authenticated dashboard pages, and no session recording occurs anywhere on the Service. We rely on legitimate interest as the basis for this aggregate audience measurement, so no cookie consent banner is shown; you may block this cookie using your browser's privacy settings without affecting your ability to use the Service.

7. Data Retention

We retain your account data for as long as your account remains active. The following retention rules apply:

• Authenticated sessions — Session cookies and their server-side records expire after 8 hours. Expired session records are automatically purged from our database.
• Preview environment records — Metadata about completed deployments is retained for up to 30 days after the pull request closes, and up to 90 days for inactive Free / BYOC accounts.
• Inactive accounts (Free / BYOC plans) — Accounts that have had no deployment activity for 90 days may be automatically deleted along with associated data. You will receive advance notice before deletion occurs.
• Billing records — Stripe retains payment and invoice history according to their own retention policies.
• Application logs — Retained for up to 90 days for operational and security purposes, then automatically deleted.

Upon account deletion, we will remove your personal data from our active systems within a reasonable period. Backups may retain data for a further period as part of standard disaster recovery practices.

8. Your Rights

If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with data protection legislation, you have the following rights regarding your personal data:

• Right to access (Art. 15 GDPR) — You can export a copy of the data we hold about you at any time by visiting Account Data Export while logged in.
• Right to erasure (Art. 17 GDPR) — You can delete your account membership and all associated sessions from the Dashboard settings, or by sending a DELETE request to /control/account while authenticated. Note: if you are the sole admin of an installation, you must first promote another member to admin or uninstall the GitHub App.
• Right to rectification (Art. 16 GDPR) — Most of your data (display name, email) is sourced from your GitHub profile. To correct it, update your GitHub account directly; changes will be reflected on your next login.
• Right to restrict processing / object (Arts. 18–21 GDPR) — To request restriction or object to processing, please contact us at hello@previewops.io. We will respond within 30 days.
• Right to lodge a complaint — You have the right to lodge a complaint with your local supervisory authority (e.g. the ICO in the UK, or the relevant DPA in your EU member state).

You can also delete your installation entirely at any time by uninstalling the Previewops GitHub App, which triggers removal of the installation and all associated data.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the effective date above and, where appropriate, sending an email notification. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

10. Contact

If you have questions or concerns about this Privacy Policy or how we handle your data, please contact us at hello@previewops.io or via the contact form.