IrisIris

Privacy Policy

Last updated: 2026-10-19

Iris is an internal ClickBus engineering intelligence tool, proprietary and for use by authorized ClickBus employees and contractors only. This Privacy Policy applies to Iris — the CLI and the platform you are accessing.

  • Controller: ClickBus
  • Jurisdiction: São Paulo, Brazil
  • Privacy contact: dpo@clickbus.com
  • Data Protection Officer: dpo@clickbus.com

This Privacy Policy describes how the Controller collects, uses, and protects personal data through Iris ("the Service") — both the CLI and the platform.

Access to Iris is restricted to authorized users. The CLI runs entirely on your machine; this policy applies when you connect the CLI to the platform or use the platform directly.

1. Data we collect

The CLI (running locally) does not transmit data to the Controller by default. It reads your Git repository's metadata (commits, diffs, PR information via the GitHub CLI) and produces a local report. Nothing leaves your machine unless you push to the platform via iris push or to your own observability backend via OTEL_EXPORTER_OTLP_ENDPOINT (see docs/TELEMETRY.md).

The platform collects:

  • Authentication data: name, email, GitHub login, and avatar URL — provided by GitHub OAuth when you sign in.
  • Repository metrics: aggregated, anonymized signals produced by the CLI (stabilization rate, churn, PR lifecycle timings, AI-tool detection counts). No source code is uploaded.
  • Org membership: the GitHub organizations you have access to, used to provision the workspace mirror in Iris.
  • Audit log: timestamps and types of administrative actions inside your workspace (member invitations, role changes, repository links).
  • Session cookies: a JWT-based NextAuth session token plus the language preference cookie (iris_lang).

We do not collect IP addresses, fine-grained device fingerprints, marketing pixels, or third-party analytics.

2. How we use the data

  • Authenticate you and authorize access to your workspace.
  • Render dashboards and trend reports across your organization's repositories.
  • Send transactional emails: invitations, ownership transfers, and (when applicable) verification codes — via Resend.
  • Operate the Service, troubleshoot issues, and improve reliability.

We do not sell, rent, or share personal data with third parties for advertising or profiling.

3. Where data is stored

  • Application data: Supabase (Postgres). Row-Level Security policies isolate each organization.
  • Email delivery: Resend (transactional email provider).
  • Hosting: Vercel.
  • Authentication: GitHub Inc. (subject to GitHub's own privacy policy).

Application hosting runs in the São Paulo region (Vercel gru1).

4. Retention

Active workspace data is retained while your account is active. Audit log entries are retained for 12 months by default. You can request deletion at any time (see Section 6).

5. Sub-processors

| Provider | Purpose | |---|---| | Supabase | Database & file storage | | Vercel | Application hosting | | Resend | Transactional email | | GitHub | Authentication (OAuth) |

6. Your rights (LGPD / GDPR)

You have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate data
  • Delete your account and personal data (a "right to be forgotten")
  • Export your data in a portable format
  • Withdraw consent at any time
  • Object to specific processing activities
  • File a complaint with your local supervisory authority (e.g. the Brazilian National Data Protection Authority — ANPD)

To exercise any of these rights, contact the Controller at the privacy address above. We respond within 15 business days as required by LGPD Article 19.

7. Security

  • All traffic is encrypted with TLS 1.2+
  • Database access uses Supabase service-role keys, scoped to the server only
  • Strict Content-Security-Policy and HSTS headers (see platform/next.config.ts)
  • Vulnerability reports follow SECURITY.md

8. Changes to this policy

Material changes are announced via the platform UI and a commit to this file in the Iris repository. The "Last updated" date at the top reflects the most recent revision.

9. Contact

Use the privacy and DPO addresses listed at the top of this document. For vulnerability disclosure, see SECURITY.md.