Privacy Policy

1. Introduction

BitPR ("we," "our," or "us") operates Claude PR Review ("the App"), an AI-powered code review application for Bitbucket built on Atlassian Forge infrastructure. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you install and use our App through the Atlassian Marketplace.

By installing or using the App, you agree to the terms of this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not install or use the App.

2. Information We Collect

We collect and process the following categories of information:

a. Bitbucket Account Information

When you authenticate with the App via Bitbucket OAuth, we receive your Bitbucket display name, username, email address, account ID, and workspace membership details. This information is provided by Atlassian through their authentication APIs.

b. Code Review Data

When the App performs pull request reviews, it processes pull request content, code diffs, comments, and associated metadata within the Atlassian Forge environment. This data is processed in real time to deliver the review service and is not permanently stored outside the Atlassian platform.

c. Billing Information

If you subscribe to a paid plan, payment processing is handled entirely by Stripe. We do not directly collect or store your credit card numbers or bank account details. We receive limited billing information from Stripe, such as subscription status, plan type, and payment confirmation.

d. Usage Data

We may collect anonymized usage data such as the number of pull requests reviewed, feature usage patterns, and error logs to improve the App's performance and reliability.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, operate, and maintain the App and its features
• To authenticate your identity and manage your account
• To process pull request reviews using AI-powered analysis
• To process subscriptions and manage billing through Stripe
• To communicate with you about service updates, security alerts, or support matters
• To monitor and improve the performance, security, and reliability of the App
• To comply with legal obligations and enforce our Terms of Service

4. Data Processing on Atlassian Forge

Claude PR Review is built on Atlassian Forge, which means the App runs within Atlassian's cloud infrastructure. Code review data is processed within the Atlassian Forge environment and is subject to Atlassian's own security and data handling practices. We do not transfer or store your Bitbucket code or pull request data on our own servers.

For more information about how Atlassian handles data, please refer to Atlassian's Privacy Policy.

5. Third-Party Services

We use the following third-party services to operate the App:

• Atlassian (Forge Infrastructure) — Hosts and runs the App within Atlassian's cloud environment. Subject to Atlassian's Privacy Policy.
• Anthropic (Claude AI) — Provides AI-powered code analysis for pull request reviews. Code snippets are sent to Anthropic's API for analysis. Subject to Anthropic's Privacy Policy.
• Stripe — Handles payment processing for subscriptions. Subject to Stripe's Privacy Policy.

We do not sell, trade, or otherwise share your personal information with third parties for their marketing purposes.

6. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Account information is retained while your account remains active. If you uninstall the App, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal, accounting, or compliance purposes.

Code review data processed through the Atlassian Forge environment is transient and is not permanently stored by us after the review is completed.

7. Data Security

We implement commercially reasonable technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL
• Running within Atlassian Forge's secure, sandboxed environment
• Secure OAuth-based authentication through Bitbucket
• Regular review of our data handling practices

While we strive to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data under applicable data protection laws, including the General Data Protection Regulation (GDPR):

• Right of Access — You have the right to request a copy of the personal data we hold about you.
• Right to Rectification — You have the right to request correction of any inaccurate or incomplete personal data.
• Right to Erasure — You have the right to request deletion of your personal data, subject to certain legal exceptions.
• Right to Restrict Processing — You have the right to request that we limit the processing of your personal data in certain circumstances.
• Right to Data Portability — You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object — You have the right to object to the processing of your personal data for certain purposes.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country. By using the App, you consent to the transfer of your information to these countries.

Where required by applicable law, we ensure that appropriate safeguards are in place for international data transfers, including standard contractual clauses or other legally approved transfer mechanisms.

10. Children's Privacy

The App is not intended for use by individuals under the age of 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Effective Date" at the top of this page and, where appropriate, through the Atlassian Marketplace listing or by email.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: