Lorem ipsum dolor sit amet, consectetur adipiscing elit. Plain-language summary first. Formal document below. Engineering teams care about this; we've tried to match the level of specificity they expect.
Pipeline run metadata (workflow name, job names, statuses, durations, commit SHAs, branch names). Test results (test names, pass/fail/flake, error snippets up to 512 KB). Cost metadata from your CI provider's usage API. User email, name, and organisation.
Source code. Files from your repository. PR bodies, PR descriptions, or issue contents. Credentials, secrets, environment variables. Anything from repositories you haven't explicitly connected.
Sed ut perspiciatis unde omnis iste. AWS S3 and RDS in eu-west-2 (London), encrypted at rest with AES-256. Enterprise customers on self-hosted keep data entirely within their own infrastructure.
Payments: Stripe. Hosting: AWS. Transactional email: Postmark. Error monitoring: Sentry (self-hosted). Each with access only to the data required for its role.
Export all your workspace data as JSON any time from Settings → Data. Delete your workspace from Settings → Danger zone. Deletion propagates in 24 hours; backups purged in 30 days.
One first-party session cookie. No third-party trackers on this website or in the app.
Full sub-processor list at cinnamonsftltd.com/subprocessors (updated whenever we add or change one). Enterprise customers receive 30-day notice on changes.
Data questions or DPA requests: hello@cinnamonsftltd.com. Response within 48 hours from a human.