Privacy Policy
Last updated: 19 October 2026
This policy explains what personal data CICaDo collects when you use the hosted service at app.cicado.dev and this website, why, and what choices you have. "We" and "CICaDo" mean the operator of the Service.
What we collect
- Account data from your sign-in provider (GitHub during the beta): your user name, user ID, name, email address and avatar.
- Organisation and repository data: the source-host organisations and repositories you connect, members and roles, and repository events your source host sends us (such as pushes and pull requests, including commit authors and messages).
- Your Content: workflow files, the source code your jobs check out, job logs, artifacts and secrets you store. Secrets are encrypted at rest and masked in logs.
- Slack data: if you connect Slack, the workspace and channel IDs and the Slack user IDs of people who approve or run commands.
- Billing data: plan, invoices and billing contact. Card details are collected and held by Stripe; we never see or store full card numbers.
- Usage and technical data: build minutes and other usage for billing, and server logs including IP addresses and browser type, for security and troubleshooting.
- Messages you send us, such as waitlist requests and support email.
How we use it
- To provide the Service: run your jobs, report results to the tools you connect, and show you logs and artifacts.
- To bill you and enforce plan limits.
- To keep the Service secure: detect abuse, investigate incidents, and keep an audit record of actions in your organisation.
- To contact you about your account, the beta, billing, security and changes to the Service.
We do not sell personal data, do not use Your Content to train machine learning models, and do not use advertising trackers. Our legal bases (for people in the EU and UK) are performing our contract with you, our legitimate interest in running a secure service, and complying with the law.
Cookies
The app uses one essential cookie to keep you signed in. This website sets no cookies and uses no analytics.
Who we share it with
We share data only with service providers that help us run the Service, under contracts that protect it:
- Amazon Web Services: hosting, databases, storage and hosted runners (United States);
- GitHub: sign-in and source-host integration;
- Stripe: payments, invoices and tax;
- Slack: messages and approvals, only if you connect it;
- other source hosts, chat tools or clouds you choose to connect, only for the data needed to integrate with them;
- Mailgun: sending and receiving email.
We may also disclose data if the law requires it, to protect people or the Service, or as part of a sale or merger of the business, in which case this policy continues to apply.
Where it is stored
Data is stored in the United States. Where data about people in the EU or UK is transferred, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.
How long we keep it
- Logs and artifacts: for your plan's retention period (7, 30 or 90 days, or as agreed), then deleted.
- Account, organisation and audit data: while your organisation exists. After you delete it, we delete this data within 30 days, except backups, which expire within a further 35 days.
- Billing records: as long as tax and accounting law requires.
- Server logs: up to 90 days.
Your rights
You can ask for a copy of your personal data, ask us to correct or delete it, or object to how we use it. Email support@cicadoci.com with "Privacy request" in the subject; we reply within 30 days. You may also complain to your local data protection authority. California residents have the rights the CCPA gives them; we do not sell or share personal information for advertising.
Security
Data is encrypted in transit and at rest. Every job runs in its own isolated virtual machine that is destroyed afterwards. Access to production systems is limited to staff who need it and is recorded.
Children
The Service is not meant for anyone under 18, and we do not knowingly collect their data.
Changes
We will post changes here and email organisation owners about material changes before they take effect.