Sign up

Privacy policy

Effective and last updated: 1 November 2026

Who we are

Commitscale is operated by TINY BOT LABS LIMITED, a UK company with company number 14808229. Our registered office is 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Contact support@commitscale.com about your personal data.

This policy covers the Commitscale test-check service, its website, accounts and support. We are responsible for account administration, billing, security and our own communications. When we process a business customer's check content solely on its instructions, we act as its data processor. Contact us to arrange a data processing agreement for that use.

What we keep

  • Your account: your email address, username, passkeys' public keys, sign-in methods and sessions. Check-only keys are stored as hashes, never in full.
  • Your usage: daily usage counts and the IDs, hashes, scores and operational metadata of CScale 1's answers.
  • Your requests: the name, email address and answers you send through our early-access or sales form. Administrators can read and delete them. They do not go in the event log.
  • Support requests: your message, reply address, account and caller details, and any CLI version, operating system or architecture sent with the request. Administrators can read and delete requests. A copy may also be sent to our support inbox.
  • Account activity: the signed event log records actions, handles and names associated with accounts and keys. It cannot be rewritten.
  • Billing: when you pay, Stripe processes your payment details. We keep customer, subscription and invoice references for six years. We do not store full card details.
  • Security: keyed hashes of the networks and mailboxes that sign up, to stop abuse. Sign-up limit records expire after an hour and are removed by a background sweep. Service logs help us diagnose failures and investigate abuse.

What happens to check excerpts

The check runs on your machine or in your CI. It sends excerpts to answer CScale 1's questions, not your full repository. Our model hosting provider, RunPod, may hold requests for at most five minutes, only to serve them. Requests may be processed in RunPod's data centres in Europe and North America. Request contents are not logged or used for training by RunPod. Without Free-plan sharing, we keep IDs, hashes, scores and operational metadata, not the excerpts.

The check removes recognised secrets before sending excerpts, and the server checks them again. Excerpts can still contain personal details or secrets those checks do not recognise.

If you choose to share data

On Free, you can separately choose to share scrubbed excerpts from your checks to improve Commitscale, including training CScale 1. Sharing is off until you choose it. Turning it off deletes the kept excerpts from the service's database and stops further collection. Moving away from Free does the same.

That database deletion does not automatically remove copies previously exported for training or reverse training that has already happened. Contact support@commitscale.com about those copies or personal information associated with earlier training. We assess these requests under applicable data protection law. Withdrawal does not affect the lawfulness of processing carried out before it.

Why we use your data

  • Providing the service: account setup, checks, billing and requested support, to perform our contract with you or take steps you ask for before a contract.
  • Security and service operations: preventing abuse, troubleshooting, keeping necessary audit records and handling business enquiries, for our legitimate interests in operating a reliable service. Where your organisation is our customer, these interests also support administering its users' accounts.
  • Legal obligations: keeping required accounting records and responding to lawful requests.
  • Optional model improvement: sharing excerpts for improvement and training only with your consent.

We do not sell personal data or use it for advertising.

Services that handle data

  • Hetzner Online GmbH: hosts our application and database in Europe.
  • RunPod: hosts CScale 1, and processes its requests in data centres in Europe and North America, holding them for at most five minutes only to serve them, without logging their contents or using them for training.
  • Cloudflare: R2 stores encrypted backups in its EU jurisdiction. Email Routing handles mail addressed to commitscale.com.
  • Robotomail: our own email service, also operated by TINY BOT LABS LIMITED, sends sign-in links, account notices and support messages. Its delivery and storage providers handle the data needed for those messages. Its privacy policy describes these services and email retention.
  • Support email providers: receive and store the messages we exchange with you, including mail forwarded to our support inbox.
  • Stripe: processes payments and manages subscriptions and invoices.
  • Services you choose: a sign-in provider or an agent or CI integration you use receives the information needed for that connection, under its own terms and your settings.

Our operators and authorised service providers may access data when needed to run the service, provide support or investigate a security issue. We may also disclose information where the law requires it or to establish, exercise or defend legal claims.

Data may be processed outside the UK, including in the European and North American locations described above. The countries and transfer arrangements depend on the provider and service. Contact us for information about the safeguards that apply to a particular transfer or a copy of relevant data processing terms.

How long we keep it

Retention depends on the record's purpose, whether your account is active, any unresolved request or dispute, and applicable legal requirements.

  • Check excerpts: the processing window and optional sharing rules above apply.
  • Accounts and usage: kept while needed to provide and administer your account, maintain usage records and investigate misuse.
  • Support, sales and early-access messages: kept while needed to handle the conversation, maintain relevant business records or resolve a dispute. Copies in email and exports need separate handling when data is deleted.
  • Security and audit records: kept where needed to protect the service, investigate incidents or meet legal obligations. The signed event log is append-only.
  • Billing records: kept for six years.
  • Backups: deleted records may remain until copies age out. The backup schedule includes monthly copies for about a year.

Account, usage, request and service-log records do not all have automatic expiry. You can ask us to review, provide or delete your personal data. We explain any information we need to retain and the reason. A request to stop sharing excerpts does not close your account or erase its event history.

Your rights

Depending on the circumstances, you can ask to access, correct, delete, restrict or receive a portable copy of your personal data. You can object to processing based on legitimate interests, and withdraw consent for optional sharing at any time.

Email support@commitscale.com. We may need to verify your identity. We respond within the time required by applicable law, normally one month for UK data protection requests, and explain any lawful extension or refusal. Where your organisation controls the data, we may direct the request to it or help it respond.

You can complain to the UK's Information Commissioner's Office or another data protection authority with jurisdiction.

Cookies

We use cookies for sign-in sessions and, when used, the sign-in provider flow. We do not use advertising or tracking cookies.

Changes

We keep this policy up to date and show the date above. We tell you about material changes by email or a notice in the service. If we propose a new use that needs your consent, we ask for it before that use begins.