Privacy Policy

Effective Date: 2026-08-01

Last Updated: 2026-08-01

1. Introduction and B2B Scope

Zeeq Labs, Inc. ("Zeeq," "we," "us") provides a business-to-business developer platform: a hosted MCP server, a shared indexed knowledge base, AI-assisted code review integrated with GitHub, dynamic skills, and usage telemetry, used across coding-agent harnesses such as Claude Code, Cursor, Codex, OpenCode, and GitHub Copilot.

This Privacy Policy explains how we handle information in connection with the Service. Zeeq is not a consumer product. We do not sell to individuals, and we do not build profiles of individuals for our own commercial purposes.

Most of the information we handle belongs to our business customers. When an engineering organization uses Zeeq, that organization decides what repositories, documents, and other content to connect, who may access the Service, and which AI model provider to use. We process that content on the organization's behalf and in accordance with its instructions and our Terms of Service. If you are an individual whose information appears in that content — for example, as a commit author, pull-request participant, or the subject of an internal document — your organization, not Zeeq, controls that content, and you should direct requests to it. See Section 10.

Capitalized terms not defined here have the meanings given in the Terms of Service.

2. Scope: What This Policy Covers and Does Not Cover

This policy covers:

• the zeeq.ai website and documentation;
• the hosted Zeeq application at app.zeeq.ai, including account creation and authentication;
• Zeeq-hosted MCP server endpoints;
• the Zeeq GitHub App as operated by Zeeq; and
• the telemetry, knowledge-base, and code-review services we operate.

This policy does not cover:

• Purely self-hosted deployments of the Zeeq open-source application that do not connect to any Zeeq-hosted component. See Section 13.
• Third-party coding harnesses (Claude Code, Cursor, Codex, OpenCode, GitHub Copilot, and similar). Those tools are operated by third parties under their own privacy policies. What they collect on your device, and what they transmit to their own servers, is outside our control and outside this policy.
• Self-Managed Providers. If your organization configures its own AI model provider using its own credentials, that provider's privacy policy governs its processing of the content we transmit to it at your organization's instruction. See Section 5.4.
• GitHub, Google, and other third parties in respect of their own processing, including the identity data they hold and the OAuth consent screens they present.

3. Information We Collect

3.1 Account and authentication information

When an Authorized User signs in through Google or GitHub OAuth, we receive basic profile information from that provider — typically name, email address, provider account identifier, avatar URL, and the organization or repository access associated with the granted scopes. We also store the organization/workspace an Authorized User belongs to and their role within it.

We do not receive your Google or GitHub password.

3.2 Customer Content

We receive and process the content your organization connects to or submits through the Service. In practice this arrives through three paths:

• Knowledge library ingest. When your organization connects a repository as a library source, we perform a shallow, filtered clone that retrieves only Markdown documentation files (.md, .mdc, .mdx). We do not download the rest of the repository's file contents or its history through this path. The working copy is deleted after each sync; the parsed documents are retained.
• Code review. Pull request contents and diffs submitted through the GitHub App, and diffs uploaded directly by a coding agent through our MCP endpoint. This is the path through which source code reaches us.
• Agent sessions. Prompts, instructions, and telemetry emitted by your coding harness when it calls our MCP tools.

This content may contain personal information — most commonly names, email addresses, and identifiers of developers appearing in commit metadata, code comments, documentation, or test fixtures.

We process Customer Content on behalf of, and at the direction of, the customer organization. We do not use it to build a profile of any individual.

3.3 Credentials and tokens

To operate the integrations your organization enables, we store:

• GitHub App installation tokens and related integration credentials; and
• API keys or credentials your organization supplies for a Self-Managed Provider.

Credential plaintext is never persisted. API keys your organization supplies are encrypted before storage using Google Cloud KMS, with the key-encryption key held in Google Cloud and access governed by IAM; keys can be rotated or disabled. Plaintext is not logged, traced, stored in our database, or returned through our API — including in masked or truncated form. Decrypted values are held briefly in server memory to serve active requests.

3.4 Usage and telemetry data

We collect operational telemetry about use of the Service, including tool and endpoint calls, model requests, token consumption and associated cost by model and by user, latency and error data, code-review runs and findings, and feature usage. This telemetry powers the usage and cost dashboards we provide back to your organization's administrators, and it supports our own operations, security, billing, and product work.

3.5 Technical and log data

We collect standard technical data when you interact with the Service: IP address, browser and device characteristics, request headers, timestamps, and server logs.

3.6 Communications

If you contact us — by email, through a form on our site, or otherwise — we retain the content of that communication and your contact details.

3.7 Sensitive categories

We do not seek, and ask that you do not submit, sensitive categories of personal information. This includes government identifiers, financial account or payment card data, health information, precise geolocation, biometric data, and information revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life, or sexual orientation. The Service is not designed to handle such information, and submitting it — including embedded in source code, fixtures, or documentation — is outside the intended use of the Service. See also Section 8(i) of the Terms of Service.

4. How We Use Information

We use the information described above to:

• provide and operate the Service — authenticate users, index content into the knowledge base, run code review, serve MCP requests, and return Output;
• produce your telemetry and cost reporting — the dashboards that show your organization its own tool calls, token usage, cost by model and user, and review findings;
• support and troubleshoot — respond to requests, diagnose errors, and restore service;
• secure the Service — detect and prevent abuse, unauthorized access, and security incidents, and enforce usage limits and our acceptable-use terms;
• improve the Service, subject to the limits in Section 5;
• communicate with you — service, security, and administrative messages; and product or marketing messages, from which you may opt out at any time;
• bill, if and when the Service becomes a paid product; and
• comply with law and enforce our agreements.

5. AI Processing, Model Providers, and Training

This section is the substantive core of this policy. It mirrors Section 5 of our Terms of Service and is intended to be read as a commitment, not a description of current practice we might change quietly.

5.1 How your content flows

When your organization uses the Service:

• Content connected to your organization is indexed, which includes generating vector embeddings so that relevant material can be retrieved later. Embeddings and index contents are scoped to your organization.
• When a code review, query, or agent request runs, relevant Customer Content and context are transmitted to the AI model provider configured for your organization — either a Self-Managed Provider using your organization's own credentials, or a default provider we select if your organization has not configured one.
• The provider returns Output, which we deliver to your organization and store as part of the Service record (review findings, retrieved results, and associated telemetry).

Embedding generation may be performed by a provider we select, regardless of which model provider your organization has configured for other processing.

5.2 We do not train on your content

We do not use identifiable Customer Content to train, fine-tune, or otherwise develop or improve any AI or machine-learning model — not our own models, and not a third party's. We contract with our model providers so that content transmitted through the Service is not used to train or fine-tune their models, other than as necessary to generate Output for your organization.

5.3 No cross-customer use

Content belonging to one organization is never used to generate Output for another organization, and never informs Output delivered to another organization. Indexes, embeddings, memories, world-model representations, and other derived data structures are scoped to the organization from which the underlying content originated.

One exception, by design. If your organization connects a publicly accessible repository as a library source, that content is ingested into a shared index available to every organization that subscribes to the same public source. This applies only to repositories you designate as public sources. It never applies to private repositories, code review content, or agent session data. If a repository you designated as public later becomes private upstream, we may not detect the change automatically — tell us at hello@zeeq.ai and we will remove it.

5.3a Derived data and the world model

We generate derived data structures from your content in order to operate the Service: indexes, chunks, embeddings, content hashes, and — as the feature rolls out — extracted memories and world-model representations built incrementally from your pull requests. These are scoped to your organization, treated as your confidential information, never shared with another organization, and deleted along with your content after the post-termination export window. Building an organization-scoped semantic model of your codebase is not model training, and it does not change the commitment in Section 5.2: nothing derived from your content is used to train or fine-tune any AI model, and nothing derived from your content is exposed to any other organization.

5.4 Self-Managed Providers

If your organization configures its own model provider, that provider's terms and privacy policy govern its handling of the content we transmit to it. Your organization is responsible for choosing that provider and for the data terms it has with it — including whether that provider trains on submitted content. Our commitments in Sections 5.2 and 5.3 describe our processing; they do not extend to a Self-Managed Provider's independent practices.

5.5 Aggregated and Anonymized Data

We may create and use Aggregated Data and Anonymized Data to operate, analyze, secure, improve, and benchmark the Service and to develop new features.

• Aggregated Data is data combined across customers such that no individual customer, user, or content is identifiable from it.
• Anonymized Data is data from which all direct and indirect identifiers have been removed or irreversibly altered, so that it can no longer reasonably be attributed to, or used to re-identify, any customer, user, or content, whether alone or in combination with other information reasonably available to us.

We will not attempt to re-identify individuals or customers from this data, and we will not permit any third party to do so. We will not disclose Aggregated or Anonymized Data in a form that identifies a customer.

5.6 Changes to this posture

We will not use Customer Content in a way inconsistent with this Section 5 unless we change this policy and our Terms of Service with at least 30 days' prior notice, giving your organization the opportunity to terminate first. We will not make this change silently.

6. We Do Not Sell Your Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising or targeted advertising. We have not done so. We do not run advertising on the Service, and we do not permit third parties to collect information through the Service for their own advertising purposes.

7. How We Share Information

7.1 Sub-processors

We use a small number of service providers to operate the Service. They may process information only on our instructions and under contractual confidentiality and security obligations.

7.2 Other sharing

We share information:

• at your organization's direction, including with a Self-Managed Provider it configures;
• with professional advisors (counsel, accountants) under confidentiality obligations;
• when required by law — in response to a subpoena, court order, or other lawful request. Where legally permitted, we will notify the affected organization before disclosing, and we will disclose only what is required;
• to protect rights and safety — to investigate suspected fraud, security incidents, or violations of our Terms, or to protect the rights, property, or safety of Zeeq, our customers, or others; and
• in a corporate transaction — in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality obligations and to this policy continuing to apply to the transferred information until it is changed with notice.

We do not otherwise disclose Customer Content or personal information to third parties.

8. Retention

Content in routine backups is deleted in the ordinary course of our backup rotation, which may extend beyond the periods above.

9. Security

We take security seriously and apply technical and organizational measures appropriate to our size and stage, including encryption of data in transit and at rest, access controls and least-privilege access to production systems, authentication through established identity providers, tenant isolation, and logging of administrative access.

We do not currently hold SOC 2, ISO 27001, or any comparable third-party security certification. We say so plainly rather than implying otherwise. Organizations with strict security or compliance requirements should consider self-hosting our open-source application, which we document as an option for exactly this reason.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting Customer Content, we will notify the affected organization's administrators without undue delay.

Report suspected vulnerabilities to hello@zeeq.ai. We will not pursue good-faith security research reported to us through that channel, provided it does not access other customers' data, degrade the Service, or exfiltrate content.

10. Your Rights and Choices

10.1 Account information

Authorized Users may access and update their account information in the Service, or contact hello@zeeq.ai to request access, correction, or deletion of their account information.

10.2 Customer Content — requests go to the organization

Where we process personal information contained in Customer Content, we do so on behalf of the customer organization. If you want to access, correct, or delete personal information contained in an organization's code, repositories, or documents, direct your request to that organization. We will refer such requests to the relevant organization and will assist it in responding, as required by our agreement with it. We generally will not unilaterally alter or delete an organization's content in response to a request from an individual.

10.3 Marketing communications

You may opt out of product and marketing emails using the unsubscribe link in those messages or by contacting hello@zeeq.ai. We will still send service, security, and administrative messages.

10.4 Deleting an organization

An organization administrator may terminate the organization's account, which triggers the export window and deletion process in Section 8 and Section 16.5 of the Terms of Service.

10.5 California and other U.S. state rights

Residents of certain U.S. states have rights to know, access, correct, delete, and obtain a portable copy of personal information, and to be free from discrimination for exercising those rights. As stated in Section 6, we do not sell personal information or share it for cross-context behavioral advertising, so there is no opt-out to offer. To exercise a right, contact hello@zeeq.ai. We may need to verify your identity, and where the information sits in a customer organization's content, Section 10.2 applies. You may designate an authorized agent to act for you.

11. Europe, the United Kingdom, and Switzerland

If GDPR or UK GDPR applies to our processing:

• Roles. We act as a processor with respect to Customer Content, processing it on the instructions of the customer organization, which acts as controller. We act as a controller with respect to account information, usage and telemetry data, technical data, and communications with us.
• Legal bases (where we act as controller): performance of a contract (providing the Service and account administration); legitimate interests (security, abuse prevention, product improvement within the limits of Section 5, and business operations); consent (marketing communications, where required); and legal obligation.
• Your rights include access, rectification, erasure, restriction, objection, portability, and withdrawal of consent where processing is consent-based. Contact hello@zeeq.ai. Where the information sits in a customer organization's content, Section 10.2 applies.
• Complaints. You may lodge a complaint with your local supervisory authority or, in the UK, the Information Commissioner's Office.

12. International Transfers

We process and store information in Google Cloud region(s) us-central1. If you access the Service from outside that region, your information will be transferred to and processed there. Where a transfer mechanism is required by applicable law, we rely on EU Standard Contractual Clauses / UK IDTA.

13. Self-Hosted Deployments

Our core application is open source and available under AGPL-3.0 at github.com/zeeq-ai/zeeq-app. You may run it on your own infrastructure.

If you deploy the open-source application on your own infrastructure and it does not connect to any Zeeq-hosted component, we do not receive your data and this Privacy Policy does not apply to that deployment. The application does not transmit usage data, telemetry, content, or analytics to Zeeq by default. If a future release includes any telemetry reporting to Zeeq, it will be opt-in, documented, and disclosed in the repository and in this policy.

Hybrid deployments. If a self-hosted instance connects to any Zeeq-hosted component — a hosted MCP endpoint, model routing, knowledge-base service, telemetry service, or the Zeeq-operated GitHub App — this policy applies to the extent of that connection: to the data transmitted to us and the processing we perform on it. The rest of your deployment remains yours.

Your relationship with the open-source software itself is governed by AGPL-3.0, not by our Terms of Service. See Section 9 of the Terms of Service.

14. Children's Privacy

The Service is a business tool intended for use by organizations and their personnel. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If we learn that we have collected such information, we will delete it. Contact hello@zeeq.ai if you believe a child has provided us information.

15. Cookies and Similar Technologies

We use cookies and similar technologies that are strictly necessary to operate the Service — maintaining your authenticated session, remembering your organization context, and protecting against security threats. These cannot be disabled without breaking the Service.

You may block or delete cookies through your browser settings; blocking strictly necessary cookies will prevent you from signing in. We do not respond to browser "Do Not Track" signals, as there is no common standard for them. We honor Global Privacy Control signals where required by law.

16. Changes to This Policy

We may update this policy. For changes that materially and adversely affect how we handle information — including any change to Section 5 — we will provide at least 30 days' prior notice by email to organization administrators or by prominent notice in the Service before the change takes effect. Other changes take effect when posted with an updated "Last Updated" date. We maintain prior versions at https://github.com/zeeq-ai/zeeq-landing.

17. Contact Us

Privacy questions and requests: hello@zeeq.aiLegal notices: hello@zeeq.aiSecurity reports: hello@zeeq.ai

Zeeq Labs, Inc.
19 Greene Dr,
Princeton Junction, NJ 08550