Privacy & Cookie Policy

Effective Date: 25 October 2026 · UK GDPR, EU GDPR, UK PECR & US CCPA/CPRA Compliant

1. Personal Data We Collect & GDPR Lawful Bases (Art. 6)

Concord Software Ltd (“Concord”, “we”, “us”) collects only the minimum personal data required to authenticate your GitHub identity, enforce workspace role-based access controls, process per-seat subscriptions, and synchronize documentation:

GitHub Identity & Profile Data: Your GitHub numeric user ID, username, display name, avatar URL, and verified email address provided during GitHub OAuth sign-in or team invitation. [Lawful Basis: GDPR Art. 6(1)(b) — Performance of a Contract]
Repository & Commit Metadata: Markdown file paths, Git commit SHAs, commit messages, and author attribution required to render documentation, compute drift telemetry, and open Pull Requests. [Lawful Basis: GDPR Art. 6(1)(b) — Contract & Art. 6(1)(f) — Legitimate Interests]
Subscription & Billing Identifiers: Stripe Customer ID, Subscription ID, active seat counts, and billing status for paid workspaces. Payment card numbers are processed directly by Stripe (PCI-DSS Level 1) and are never stored on Concord servers. [Lawful Basis: GDPR Art. 6(1)(b) — Contract & Art. 6(1)(c) — Legal/Tax Obligation]
Security & Rate-Limit Telemetry: Ephemeral IP rate-limiting counters and webhook signature verification logs used strictly to prevent brute-force abuse and unauthorized access. [Lawful Basis: GDPR Art. 6(1)(f) — Legitimate Interests in Information Security]

2. Data Retention Schedule

User Account & Workspace Memberships: Retained for the duration of your active account and immediately purged upon self-service account erasure.
Indexed Repository Documents & Asset Cache: Retained only while the repository is connected to an active workspace; immediately deleted via cascading database constraints when a repository is unlinked.
In-Memory Rate-Limit Windows: Automatically expire within 60 seconds.
Statutory Billing & Tax Invoices: Retained by Stripe for 7 years to comply with UK HMRC, EU VAT, and U.S. tax accounting laws (GDPR Art. 6(1)(c)).

3. UK/EU GDPR Rights & Instant Right to Be Forgotten (Art. 15–22)

Under the UK General Data Protection Regulation (UK GDPR), the UK Data Protection Act 2018, and the EU General Data Protection Regulation (Regulation (EU) 2016/679), you have the right to: (a) access your personal data (Art. 15); (b) rectify inaccurate data (Art. 16); (c) erase your personal data — the “Right to be Forgotten” (Art. 17); (d) restrict processing (Art. 18); (e) receive your data in a portable format (Art. 20); and (f) object to processing based on legitimate interests (Art. 21).

Self-Service Account Erasure: Any signed-in user can immediately and permanently delete their account, profile data, workspace memberships, and repository access records directly from Organization & Privacy Settings with zero waiting period, or by emailing [email protected]. Formal data subject requests submitted by email are fulfilled within 30 calendar days.

4. United States Privacy Disclosures (CCPA / CPRA, VCDPA, CPA, CTDPA & TDPSA)

If you are a resident of California (under the California Consumer Privacy Act as amended by the California Privacy Rights Act, Cal. Civ. Code § 1798.100 et seq.), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), or another U.S. state with comprehensive privacy legislation, you have specific statutory rights regarding your personal information:

No Sale or Sharing of Personal Information: Concord does not sell your personal information and does not share your personal information for cross-context behavioral advertising, and has not done so in the preceding 12 months. We honor Global Privacy Control (GPC) browser signals automatically.
Right to Know, Delete & Correct: You have the right to request disclosure of the categories and specific pieces of personal information we collect, the right to correct inaccurate personal information, and the right to delete your personal information at any time via Self-Service Account Erasure or by contacting [email protected].
Right to Non-Discrimination: Concord will never discriminate against you, deny services, or charge different prices for exercising any of your U.S. state privacy rights.

5. Cookie & Local Storage Policy (UK PECR & EU ePrivacy Directive)

Zero Third-Party Tracking or Ad Cookies: In compliance with the UK Privacy and Electronic Communications Regulations (PECR) and the EU ePrivacy Directive (2002/58/EC), Concord does not use advertising trackers, behavioral profiling pixels, or third-party analytics cookies.

We use only strictly necessary first-party cookies and local storage items required to operate the Service:

Name	Category	Duration	Purpose
authjs.session-token / __Secure-authjs.session-token	Strictly Necessary (HTTP-Only)	Session / 30 Days	Maintains your encrypted GitHub OAuth login session.
concord_workspace_id	Strictly Necessary (HTTP-Only)	90 Days	Remembers which organization workspace you currently have active.
concord_cookie_consent	Local Storage	Persistent	Stores your acknowledgment of the essential cookie notice banner.

6. International Data Transfers & Sub-Processors

Where personal data is transferred outside the United Kingdom or the European Economic Area (EEA) to the United States, Concord ensures appropriate safeguards are in place pursuant to Chapter V of the UK/EU GDPR, including certification under the EU–U.S. Data Privacy Framework (DPF), the UK Extension to the EU–U.S. DPF, the European Commission’s Standard Contractual Clauses (SCCs), and the UK International Data Transfer Addendum (IDTA):

GitHub, Inc. (United States): OAuth identity authentication, Git tree synchronization, and Pull Request creation (Safeguard: EU–U.S. DPF, UK Extension & SCCs).
Stripe, Inc. & Stripe Payments UK Ltd (United States / UK / Ireland): PCI-DSS Level 1 compliant subscription billing and tax calculation (Safeguard: EU–U.S. DPF, UK Extension & SCCs).
Resend, Inc. (United States / EU): Transactional workspace invitation emails (Safeguard: SCCs & UK IDTA).

7. Transactional Communications (CAN-SPAM) & Children’s Privacy (COPPA)

CAN-SPAM & PECR Email Compliance: Concord dispatches emails strictly for transactional purposes (such as when an organization administrator invites you to a workspace or regarding critical billing/security events) in compliance with the U.S. CAN-SPAM Act (15 U.S.C. § 7701 et seq.) and UK PECR. We do not send unsolicited third-party marketing emails.

Children’s Privacy: The Service is designed for software engineering teams and is not directed to children under the age of 16 in the UK/EEA or under 13 in the United States (COPPA). If we learn that we have inadvertently collected personal data from a child, we will delete it immediately.

8. Data Controller, DPO & Supervisory Authority Contact

If you have any questions about this Privacy Policy or wish to exercise your statutory rights, please contact our Data Protection Officer at [email protected]. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at https://ico.org.uk (Tel: +44 303 123 1113), with your local EU Data Protection Authority, or with your U.S. State Attorney General.

Data Controller: Concord Software Ltd

Registered Address: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

Privacy & DPO Inquiries: [email protected] · [email protected]