Privacy Policy

Semfora is a cloud service that analyzes the source code in repositories you connect. To do that, we clone your code into an isolated, short-lived analysis environment, compute structural metrics from it, and delete the copy when the analysis finishes. What we keep is the derived output (symbol and module names, counts, and scores), not your code. Certain AI features you invoke may send relevant excerpts of your code to our AI inference provider to generate a response; those excerpts are not stored. We also collect the account, billing, and usage information described below. We do not sell personal data, and we do not use your code to train AI models.

This policy is published by Semfora, Inc., an Ohio corporation with offices at 875 N High Street, Suite 450, Columbus, OH 43215 ("Semfora", "we", "us"). Semfora is the data controller for the personal data described here. The policy covers the semfora.ai website and the Semfora cloud service, including analysis runs, dashboards, integrations, and AI features. Questions or requests can be sent to contact@semfora.ai.

Earlier versions of this policy described locally-run Semfora tools that never transmitted code. Those products have been discontinued; this policy describes the current cloud service.

When you connect a repository through our GitHub App and an analysis runs, we clone that repository into an isolated, ephemeral compute environment provisioned for that single run. The Semfora analysis engine runs against the clone to produce structural metrics. The cloned copy of your code is deleted when the run completes, including when it fails. We do not keep your source code at rest on our systems.

What we retain from each run is derived analysis data: symbol, module, and file names; counts, scores, and graph metrics; commit SHAs, branch names, and pull request titles. We also retain a compact structural index derived from your code (names and relationships, not source text) to speed up subsequent runs; only the most recent versions per repository are kept.

Analysis results and stored AI outputs are constrained by design to names, numbers, and generated prose; they do not contain source text, snippets, or diffs.

Most AI features in Semfora (change summaries, dashboards, chat about your metrics) operate on metadata only: metric names and numbers, file paths, commit subjects, and similar. No source code is sent to a model for these features.

Some AI features read portions of your source code inside the analysis environment and transmit relevant excerpts to our AI inference provider in order to generate the response: the AI code review that runs when a pull request is analyzed, and features you explicitly invoke such as bug localization, repository Q&A, error diagnosis, and code audits. These excerpts are processed to produce the result and are not stored by Semfora; the stored output is a prose summary without code. The pull-request review runs automatically on analyzed pull requests and can be turned off per account or per organization in Settings; the other code-reading features run only when you or an authorized member of your organization initiates them.

All AI requests go through OpenRouter with two restrictions enforced on every request we send: zero-data-retention routing (only providers that do not store prompts or responses at rest, per OpenRouter's ZDR policy) and no-training routing (providers that train on inputs are excluded). OpenRouter itself does not retain our prompts; see OpenRouter's privacy policy. We do not use your source code to train AI models. We record token counts and cost for each AI action for billing and abuse prevention.

You can turn AI features off entirely: each user can disable them for their own account in Settings, and organization owners and admins can disable them for every member from the Team page. The organization switch always wins. While AI features are disabled, every AI endpoint is blocked and analysis runs skip their AI passes; nothing is sent to an AI model. Features that depend on AI processing (the Copilot chat, the AI code review on pull requests, change and pull-request summaries, plain-English labels and narratives on dashboards, AI-generated dashboards, code audits, and error clustering and diagnosis) are unavailable while disabled; the core analysis, metrics, and history all continue to work, and we are progressively adding manual alternatives for information those features normally supply. The AI code review also has its own on/off switch, separate from the global AI toggle.

Account data: we authenticate through Clerk, our identity provider. We receive and store your account identifier and email address, and display information such as your name. Passwords and OAuth credentials are held by Clerk, not by us.

Beta and signup data: if you apply for access, we store the details you submit: email, name, role, company name, team size, and how you plan to use Semfora.

Organization data: if you belong to a Semfora organization, we store your email, role, and membership status so we can enforce seats and access.

Billing data: payments are processed by Stripe via Clerk Billing. We never receive or store card numbers. We keep your plan, seat counts, invoice amounts, payment processor reference IDs, and usage records (analysis compute and AI usage) needed to bill you accurately.

Support and correspondence: if you email us, we keep the correspondence so we can help you.

GitHub: we store your installation and repository metadata (repository names, default branches, visibility, sizes) and process webhook events to trigger analyses. Commit messages and author names may be processed transiently to generate change summaries but are not stored; we retain commit SHAs, branch names, and pull request titles.

Sentry: if you connect a Sentry account, we store the access credentials you authorize (server-side only, never sent to your browser) and error issue data: titles, error types, counts, status, release identifiers, and a bounded list of stack frame locations (file, function, line). We do not store raw event payloads, request bodies, headers, breadcrumbs, or variable values.

Linear: if you connect Linear, we store the access credentials you authorize and references to work items (identifiers and titles).

You can disconnect any integration at any time, which stops further collection from it.

We use PostHog for product analytics to understand how the site and product are used. Analytics events are associated with your account identifier and email; we do not send the content of your prompts, code, or AI responses to analytics.

We use Sentry to monitor errors in our own application. Error reports may include browser and request context such as your IP address, the page URL, and stack traces of our code. We scrub repository access tokens from error reports.

Like most services, our hosting providers keep standard request logs (IP address, user agent, pages requested) for security and reliability.

We use cookies and similar storage for authentication (Clerk session cookies) and analytics (PostHog). We do not use third-party advertising cookies.

We use the data described above to provide and operate the service (run analyses, render dashboards, power integrations and AI features you invoke); to authenticate you and enforce access controls; to bill you and enforce plan limits; to secure the service and prevent abuse; to fix bugs and improve the product; and to communicate with you about your account, invitations, and product updates. Every marketing email includes a way to opt out, and unsubscribing is immediate.

We do not sell or rent personal data, and we do not share your source code or analysis results with anyone except the service providers that process data on our behalf to run Semfora:

Cloudflare (application hosting, caching, and object storage); Trigger.dev (isolated analysis compute where your code is cloned and deleted per run); Prisma (managed Postgres database); Clerk (authentication, organizations, and billing); Stripe (payment processing); OpenRouter (AI inference for the features described above); PostHog (product analytics); Sentry (error monitoring for our own application); GitHub (repository access via the app you install); Linear (work-item sync, only if you connect the integration); Upstash (rate limiting).

Each provider processes data only as needed to perform its function. A current list of these providers (what each one processes, the AI models we use, and links to their own privacy terms) is maintained on our subprocessors page. Business customers who need a data processing agreement (DPA) can request ours at contact@semfora.ai. We may also disclose data if required by law, to protect our rights or users' safety, or as part of a merger, acquisition, or sale of assets, in which case this policy continues to apply to your data.

Cloned source code: deleted automatically at the end of every analysis run.

Analysis data (metrics, history, derived indexes, AI outputs): retained while the repository stays connected. Disconnecting a repository, or uninstalling the GitHub App, deletes the repository's runs, metrics, history, and derived data.

Integration credentials: deleted when you disconnect the integration.

Account, signup, and billing data: retained while your account is active, and as needed afterward to meet legal, tax, and accounting obligations.

To delete your account and associated personal data, email contact@semfora.ai from the address on your account. We will confirm deletion within 30 days, except for records we are legally required to keep.

At a glance: cloned source code, end of each run. Analysis data and AI outputs, while the repository stays connected. Integration credentials, until you disconnect the integration. Account, signup, and support data, while your account is active, then deleted on request. Billing and payment records, up to seven years, as required for tax and accounting.

All data is encrypted in transit. Source code is processed in isolated, per-run environments and never persisted by Semfora; when an AI feature reads code, the relevant excerpts go only to zero-data-retention inference providers for the duration of the request, and nothing code-bearing is stored. Access to your data is scoped to your account and organization; no code path returns another tenant's data. Integration credentials are stored server-side and are never sent to the browser. Internal callbacks between our systems are cryptographically signed and verified. No system is perfectly secure, but we design the service so that the most sensitive thing you give us, your code, is held for the shortest possible time.

If we learn of a security breach affecting your personal data or your code, we will notify affected customers without undue delay, consistent with applicable law, and tell you what happened, what data was involved, and what we're doing about it. Security researchers can find our disclosure policy on the security page.

Semfora is operated from the United States, and our service providers process data in the United States and other locations where they operate. By using the service you understand that your data will be processed in these locations. Where required, we rely on our providers' standard contractual safeguards for international transfers.

Depending on where you live, you may have rights to access, correct, export, restrict, or delete your personal data, and to object to certain processing. You can exercise these rights by emailing contact@semfora.ai; we will respond within the timeframe required by applicable law (and in any case within 30 days for deletion requests). We do not discriminate against you for exercising your rights. If you are in the EEA or UK, you also have the right to lodge a complaint with your local supervisory authority.

California residents: we do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined by the CCPA/CPRA, so there is nothing to opt out of. The categories of personal information we collect are identifiers (name, email, account IDs), commercial information (plan and payment records), internet activity (product usage and request logs), and professional information (role, company, team size, if you provide them), collected for the purposes described in this policy and retained per the schedule above. You (or an authorized agent) can exercise your rights to know, correct, and delete by emailing contact@semfora.ai; we verify requests against the email on your account.

Semfora is a business tool and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.

If this policy changes in a way that matters, we'll note it here with a new effective date before the change takes effect, and for material changes we'll notify account holders by email.

Questions about privacy? Email contact@semfora.ai and we'll get back to you.