# Privacy policy

# Privacy policy

**Effective October 15, 2026**

inline is operated by Pendral Inc., a subsidiary of Evry Healthcare, Inc. This policy describes how we collect, use and share information about you ("Information" or "Personal Information") when you use inline (the "Services"). As used here, "we," "us" and "our" refer to Pendral Inc.

Our Services are intended for a United States audience. Any information you provide, including any personal information, will be transferred to and processed by a computer server located within the United States. By using the Services, you consent to our collection, use, disclosure, and storage of information as described in this Privacy Policy.

## What we collect

- **Account information.** Your name, email address and profile picture from Microsoft sign-in, or the email address you use for an emailed sign-in link. If you link a GitHub account, its GitHub user ID and username.
- **Repository data.** Through the [GitHub connection](./connect-github.html) your organization grants, inline reads the source code, pull requests, diffs, issues, CI results and security alerts of the repositories you enable.
- **What inline produces.** Reviews and their findings, walkthroughs, repository memory, code-graph indexes, plans, and the code changes (patches) behind fix pull requests.
- **Agent run records.** For every AI run, inline keeps a record of the prompts, model responses, tool calls and their results. These contain fragments of your source code.
- **Runtime error reports.** If you use [observability](./observability.html), the error reports your applications send, including stack traces and any context your application attaches.
- **Connected services and uploads.** If you use [cloud monitoring](./cloud.html), configuration, health and cost information about the cloud resources you connect. If you use [compliance](./compliance.html), the agreements you upload.
- **Security and activity logs.** Sign-in and sign-out events, sessions, and access activity, including IP address and browser user agent.
- **Cookies.** inline uses cookies to sign you in and keep you signed in.

## How we use it

We use this information to provide inline's features to you, to authenticate you, to communicate with you about your account and the alerts you configure, to secure the service and investigate misuse, to provide product support, to comply with applicable laws, regulations, and legal process, and to protect our rights and the rights of others.

## How we share it

We do not rent or sell your Personal Information in personally identifiable form to anyone. We will only share your Information with third parties as outlined in this Policy and as otherwise permitted by law or as permitted with your consent.

We use the following service providers to run inline. Each receives what it needs to perform its function for us:

| Provider | What it does for inline | What it receives |
| --- | --- | --- |
| Microsoft Azure | Hosting, database, file storage and key management | All of the information above |
| Microsoft | Sign-in, and sending emails such as sign-in links, invitations and alerts | Your name and email address; email content |
| GitHub | The repositories inline reviews | Reviews, comments, checks and pull requests inline posts |
| Anthropic | AI models that review code and run inline's agents, under a zero data retention arrangement: prompts and responses are not stored by Anthropic after the response is returned | Prompts containing source code, diffs and findings |
| Daytona | Isolated environments that build and run your code | A copy of the repository being worked on |
| Nango | Manages the GitHub authorization when an admin connects GitHub through OAuth | GitHub access tokens for that connection |
| Exa | Web search when an agent looks something up | Search queries and the addresses of pages it reads. We do not send personal information to Exa |

inline's database, file storage and caches are hosted in Microsoft Azure's South Central US region.

If you configure notification destinations, such as a Microsoft Teams channel, inline sends alert content there.

We may share Information in response to a court order, subpoena, search warrant, or to comply with law or regulation. We may also share Information within Pendral, including among affiliates, or with our parent company, or subsidiaries. If we (or our assets) are acquired, or if we go out of business, enter bankruptcy, or go through some other change of control, Personal Information could be one of the assets transferred to or acquired by a third party.

## How long we keep it

- **Runtime error reports** are deleted after 30 days by default, or after the retention period set for the project.
- **Reviews, findings, code changes and agent run records** are retained for the life of your account unless you request deletion.
- **Account information and security logs** are retained for the life of your account unless you request deletion.

We will retain and use your information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

## Your choices

- You can see and revoke inline's access to your repositories from GitHub at any time.
- **Settings → Privacy → Private by default** hides the plans, pre-PR reviews and agent runs you create from other members of your workspace, except workspace Owners.
- To access, correct or delete your information, contact us at the address below.

## Protecting your information

We maintain administrative, technical, and physical safeguards designed to protect the Information that you provide on our Services. These safeguards vary based on the sensitivity of the Information that is being collected, used, and stored. We cannot guarantee the security of our Services, nor can we guarantee the security of the Information you transmit to us over the Internet, including your use of email.

## Children

We will not intentionally collect any personal information (as that term is defined in the Children's Online Privacy Protection Act) from children under the age of 13 through our Services without receiving parental consent. If you think that we have collected such personal information from a child under the age of 13 through our Services, please contact us immediately.

## Changes to this policy

We may change this Policy at any time. If we do so, such change will appear on this page. Your continued access to or use of the Services constitutes your consent to these changes to this Policy.

## Contact us

Contact us regarding this Policy or related privacy practices. If you believe we or any company associated with us has misused your Information, please contact us immediately.

Pendral Inc.<br>
contact@pendral.io<br>
1-855-579-3879<br>
PO Box 571208<br>
Dallas, TX 75357