1. Who we are
ETOILEE PTE. LTD. operates HeyDeer. Our registered address is 60 Paya Lebar Road, #04-016, Paya Lebar Square, Singapore 409051. This policy explains how we handle information when you visit our site, use code reviews or fixes, contact us or apply for a role.
For privacy questions and requests, contact hey@heydeer.ai with “Privacy” in the subject. When reviewing repositories for an organisation, we process that repository content to provide the requested service. Your organisation controls which repositories, instructions and integrations it authorises.
2. Information we process
Account and workspace information: GitHub identity and account identifiers, your GitHub account’s verified email address, workspace memberships, installation details, settings and credentials required to connect your authorised repositories.
Review and fix information: source code and Git history needed for the task; pull request details, file paths and commit identifiers; instructions, repository checks, selected findings, generated changes, results, history, execution status and usage records. Saved findings, generated changes and configuration snapshots can contain source code.
Billing and service information: subscription and transaction references, credit balances, usage, payment status, support messages and operational records needed to run and troubleshoot the service. Payment card details are handled by our payment provider rather than submitted to HeyDeer’s own payment form.
Recruitment information: the resume, portfolio, professional links and messages you choose to send when applying for a role. Please do not send identity documents, bank details or confidential code from a current or former employer with an initial application.
3. Source code, review history and AI training
HeyDeer does not maintain a permanent repository mirror for reviews or fixes. Repository clones run in temporary, non-persistent sandbox environments with a time limit, in Vercel’s US regions (Washington, D.C., Cleveland, San Francisco or Portland). Cleanup stops the task’s environment; if cleanup cannot complete, the environment’s time limit provides a fallback.
Review and fix results and history are retained separately so you can revisit findings and generated changes. They may include source code. Saved instructions, repository-check snapshots, file paths and other task metadata may also contain repository-derived information. “Temporary source processing” therefore does not mean that every piece of source-derived content is immediately deleted.
HeyDeer does not use your source code, instructions or review and fix results to train its own AI models. We process that content to carry out reviews and requested fixes and provide the service.
Reviews and fixes use OpenAI, Anthropic, Kimi and GLM models. HeyDeer reaches Kimi and GLM models through AWS Bedrock, OpenRouter and Vercel AI Gateway, and OpenAI and Anthropic models directly or through those providers. These providers receive code and task context to process reviews and fixes. Optional services you connect through connectors have their own data policies.
4. How we use information
We use information to authenticate users, connect authorised repositories, run and publish reviews and requested fixes, preserve their results and history, manage subscriptions and credits, respond to support requests and maintain the service. Operational and usage information helps us diagnose failures, prevent abuse and understand service performance.
We may send marketing emails to your GitHub account’s verified email address, such as suggestions for the next step in setting up HeyDeer. Every marketing email links to unsubscribe, which takes effect for all of them. Unsubscribing does not stop service emails about your workspaces, such as billing notices.
We use application materials to assess suitability for a role and communicate with applicants. We also process information when necessary to meet legal obligations, handle disputes and protect the service and its users.
6. Retention and deletion
Temporary repository environments and retained workspace records have different lifecycles. Review and fix history, settings and account information remain available to support your workspace. Billing, security and support records may need to be retained for business or legal purposes. We do not currently publish a single fixed retention period covering all records, logs and backups.
To request deletion of your account and personal data, email hey@heydeer.ai. You can submit a request without signing in or obtaining permission from a workspace administrator. Include your GitHub username if known; do not send passwords, access tokens, source code or identity documents. If we reasonably doubt your identity, we ask only for information needed to verify it. Authority over a shared workspace is checked separately from your right to request deletion of your own account.
We assess personal data in shared workspace records separately; closing one account does not automatically delete the organisation’s workspace or other people’s records. Where applicable law permits or requires retention, such as for accounting obligations or legal claims, we explain the records retained, the reason and the applicable retention period or criteria. A general business preference is not a blanket exception to erasure. Backups and records held by service providers are included in our handling of the request.
Sending a deletion request does not itself cancel workspace subscription renewals. Current workspace admins manage renewals through workspace billing. If your personal card is still being charged after you leave a workspace, contact us at /contact#billing so we can verify the charge and help resolve the payment method. Cancellation is not required before requesting account deletion.
Uninstalling the GitHub App removes future repository access but does not itself delete saved review or fix history. An active review or fix may still have its temporary copy. Comments, commits and pull requests already published to GitHub remain subject to that repository’s controls; external providers and connected services apply their own retention rules.
8. Your choices and privacy requests
Choose individual repositories during GitHub App installation, configure your review instructions and optional connections, and remove repositories or uninstall the app through GitHub to revoke future access. Automatic reviews can be managed in workspace settings.
Depending on applicable law, you may request access to or correction of personal information, withdraw consent where processing relies on it, or request deletion or other available rights. Send requests to hey@heydeer.ai. We may ask for information needed to verify the request, and will respond in accordance with applicable law. Withdrawing necessary permissions may prevent us from providing parts of the service.
If your organisation controls the workspace, you may also need to contact its administrator. You can raise a concern with the relevant data protection authority, including Singapore’s Personal Data Protection Commission where applicable.
9. GDPR & Data Protection
Where the EU General Data Protection Regulation (GDPR) applies, you may have rights to access, correct or erase your personal data, restrict or object to its processing, and receive certain data in a portable format, subject to the conditions and exceptions in the law. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. You may also lodge a complaint with a competent data protection authority.
To make a privacy request or ask about our data handling, email hey@heydeer.ai with “Privacy” in the subject. Describe the request and the account or workspace it concerns; do not include passwords, access tokens or repository source code. If the request concerns personal data we process on behalf of your organisation, contact its workspace administrator as well so the appropriate controller can address the request.
For GDPR requests, we respond without undue delay and within one month of receipt. Where necessary because of complexity or the number of requests, the law allows an extension of up to two further months; we notify you within the first month and explain the reason. Requests are normally handled free of charge. If we cannot act on all or part of your request, we explain why and how you may complain to a supervisory authority or seek a judicial remedy.
10. Updates and contact
We may update this policy when our practices or service change. We will display the updated date and communicate material changes through the service or an available account contact. For privacy, deletion or security questions, email hey@heydeer.ai.