This policy covers the hosted Nipa Lab service at nipalab.com and this website. If you self-host Nipa, your server operator is responsible for your data and this policy does not apply.

Who we are

Nipa Lab is in early access and is operated by Muchamad Arifin Dwi Prastya, an individual developer, Desa/Kec. Purwosari, Kab. Bojonegoro, East Java, Indonesia, who is the controller of your personal data ("we" in this policy). For anything about your data, write to support@nipalab.com.

What we collect and why

Account data: your name, email address, profile photo URL, notification preferences, and a password hash if you set a password. We need this to create and run your account (performance of our contract with you). An email address is required to register.
Sign-in data: linked Google or GitHub identities, the public half of any SSH keys you register, and session tokens. Used to sign you in (contract).
Your repositories and collaboration data: file contents, commit metadata, branches, tags, merge requests, reviews, comments, file locks, organization and group memberships, permissions and webhooks you configure. Used to provide the service (contract).
Invitations: when someone invites you to an organization, we store your email address to send and match the invitation, even before you have an account (legitimate interest of the inviting organization in adding its members).
Notifications: the emails we send you about your account, merge requests and reviews, and their delivery status (contract).
Billing data: if you buy a paid plan, your subscription, seat and storage quantities, discount code, and billing events. Payment details are collected by Paddle, not by us (contract, and legal obligations on tax and accounting records).
Security and operational data: server logs with IP addresses, user agents and request paths, rate-limit counters, and an audit log of administrative actions (who changed permissions, members, tokens or billing, from which IP address). Used to keep the service secure, prevent abuse and fix problems (our legitimate interest in operating a secure service).

We do not make decisions about you based solely on automated processing.

What we do not do

We do not sell your data or use your repositories for advertising or to train AI models.
The marketing site uses no analytics and no tracking cookies. It is served through Netlify and our own edge proxy, which may log request metadata such as IP addresses.
AI features in the Nipa client (commit message and merge request generation) send content to an AI provider you configure yourself, from your own machine. We do not receive or forward that content.

Cookies

The app uses an HttpOnly cookie to keep you signed in and a short-lived cookie that binds a social sign-in to the browser that started it. Both are strictly necessary and need no consent. When you open checkout, Paddle loads its own script, which sets cookies needed for payment and fraud prevention; see the Paddle privacy notice.

Who receives your data

People you work with: members of the organizations and projects you belong to see your name, email address and your contributions. Project admins can configure webhooks that send event data, including the acting user's name and email address, to systems they choose.
Paddle (Paddle.com Market Ltd) is our reseller and merchant of record for paid plans. It processes your billing and payment details as an independent controller under its own privacy notice, and tells us your subscription status.
Service providers who process data on our behalf under data processing agreements: hosting and object storage, email delivery, log and monitoring, and website hosting (Netlify). If you sign in with Google or GitHub, those providers learn that you used them to sign in. A current list of our providers is available on request.
Authorities, when the law requires us to disclose data.

International transfers

Some of our providers process data outside the European Economic Area. When they do, we rely on an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses. You can ask us for a copy of the safeguards.

How long we keep it

Account, sign-in and repository data: while your account exists, then deleted or anonymized within 30 days of account deletion. Commits and comments you made in shared projects stay part of their history, attributed to a deleted user.
Notification emails: 30 days after delivery.
Server logs: 30 days.
Audit log entries: 12 months.
Billing records: as long as tax and accounting law requires.
Invitations and sign-in links: until they are used or expire.

Your rights

Under the GDPR you have the right to access your data, correct it, have it erased, restrict or object to its processing, and receive it in a portable format. You can correct your name, email and notification preferences in your profile, and export your repositories at any time with the Nipa client. For everything else, including account deletion and a copy of your personal data, write to support@nipalab.com. We answer within one month.

You can also complain to your data protection supervisory authority.

Customer content

When you store other people's personal data in your repositories, you decide what is stored and why, and we process it on your behalf as described in our terms of service.

Children

The service is not meant for anyone under 16. We do not knowingly collect data from them.

Security

Data is encrypted in transit. Report vulnerabilities to security@nipalab.com. If a breach puts your rights at high risk, we will tell you without undue delay.

Changes

We post updates on this page. For material changes we will email account holders at least 30 days before they take effect.

Privacy policy