Privacy Policy

This Privacy Policy explains how Disruptica LLC (“Evermach,” “we,” “us,” or “our”) collects, uses, and shares personal information in connection with the Evermach website, dashboard, embeddable widget, AI agents that analyze and change code, MCP server, APIs, and related services (the “Service”).

We act in two different roles. For people who create accounts with us and visitors to our website, we are the business responsible for their personal information. For content that Customers and their End Users submit through the Service, including messages sent through a widget that a Customer has installed in its own product, we act as a service provider that processes that information on the Customer’s behalf and under the Customer’s instructions. If you are an End User, please direct privacy questions to the business whose product you were using; see Section 10.

If a Customer runs a self-hosted deployment of Evermach, content processed in that deployment stays in the Customer’s own environment and is governed by the Customer’s separate agreement with us.

• Account and contact information — such as your name, email address, organization name, and password, which you provide when you register or contact us. If you sign in with Google, we receive your name, email address, and profile image from Google.
• Billing and usage information — subscription, transaction, and Credit usage details. Card payments are handled by Stripe; we do not store full payment card numbers.
• Usage, device, and log data — such as IP address, browser and device information, pages viewed, actions taken, and timestamps.
• Cookies and similar technologies — used to keep you signed in and to understand and improve the Service (see Section 6).
• Customer Content — messages, attachments, and Requests; repository content (such as code, file names, and commit information) accessed through GitHub; design materials such as Figma files, screenshots, and PDFs; the business context and compliance frameworks you add to a project; and the website addresses you ask us to monitor.
• End User information — what End Users type and upload in a widget, any identifiers the Customer passes to the widget, and, if the Customer requires it, the email address an End User verifies with a one-time code.
• Integration credentials — the access tokens that services such as Jira and Figma issue when you connect them, which we store encrypted. For GitHub, we use short-lived tokens limited to the repositories you choose.

• provide, maintain, secure, and improve the Service;
• turn conversations into Requests and analyze them against your codebase, design, business context, and compliance frameworks;
• when your team starts a build, write code, review it, and open pull requests in your repositories;
• scan your dependencies for known vulnerabilities and monitor the website addresses you configure;
• process subscriptions, Credits, billing, and payments;
• provide customer support and respond to your requests;
• send service, security, and administrative communications, and (where permitted) product updates;
• monitor usage, prevent fraud and abuse, and address technical and security issues; and
• comply with legal obligations and enforce our terms.

To provide AI features, we send relevant Customer Content (for example, conversation text, Requests, code, and design materials) to our AI providers, Anthropic and OpenAI. They process it to return results under API terms that do not allow them to train their models on it. We do not use Customer Content or AI-generated output to train AI models either.

Builds run in isolated, temporary sandboxes with read-only access to your repository. The sandboxes are discarded when each build finishes, and only the resulting changes are pushed, as a pull request, to your repository. AI output may be inaccurate and should be reviewed before you rely on it.

We do not sell your personal information. We share information only as described below:

• Service providers (sub-processors). We use the vendors listed below to operate the Service. They may process information only to provide services to us.
• At your direction. When you connect integrations, open pull requests, or push Requests, we share data with those services (for example, GitHub, Jira, or Figma) as you instruct. When you connect an AI client, such as ChatGPT or Claude, through our MCP server, we share the data that client requests with your authorization.
• Legal and safety. We may disclose information to comply with law, enforce our agreements, or protect the rights, safety, and security of Evermach, our users, or others.
• Business transfers. Information may be transferred as part of a merger, acquisition, financing, or sale of assets, subject to this Policy.

We use two categories of cookies and similar technologies:

• Essential cookies — required to keep you signed in and to operate core features. These cannot be turned off through the Service.
• Analytics cookies — we use Google Analytics to understand how the Service is used so we can improve it. Google Analytics may set cookies and collect your IP address and usage data. You can learn more in Google’s Privacy Policy and opt out using the Google Analytics Opt-out Browser Add-on.

We do not use cookies to sell your information or to share it for cross-context behavioral advertising. You can control cookies through your browser settings, and where applicable, through the notice shown on our site.

We retain personal information for as long as your account is active or as needed to provide the Service, and afterward as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. We delete or de-identify information when it is no longer needed. Account holders can request deletion from Account → Profile; a confirmation link is sent to their verified email address. Account deletion removes the account identity and records governed by the configured database relationships, subject to legal retention requirements. Copies embedded in retained operational content may require separate review. Build sandboxes are discarded when each build finishes. Widget end users do not have a self-service control; they should ask the business operating the widget, whose administrators can permanently erase that person’s chats, requests, comments, attachments, ratings and audit history from the project, matched by the email the widget collected. Visitors who gave no email cannot be identified and are not covered.

We use commercially reasonable technical and organizational measures to protect personal information, including encryption in transit, encrypted storage of integration credentials, role-based access, and isolated sandboxes for builds. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. Production database, disk, snapshot, and backup encryption are deployment controls and must be verified with the hosting operator; this application does not claim that local development storage or backups are encrypted. Deletion from the live service does not immediately remove copies in retained backups, provider logs, email, integrations, or AI-provider systems; those copies expire or are handled under the applicable provider and retention processes.

Depending on where you live, you may have the following rights with respect to personal information we hold as a business. California residents have these rights under the CCPA, as amended by the CPRA:

• Know and access the categories and specific pieces of personal information we have collected about you;
• Delete personal information we collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of the “sale” or “sharing” of personal information — note that we do not sell personal information or share it for cross-context behavioral advertising; and
• Limit the use of sensitive personal information — we do not use sensitive personal information for purposes that require an opt-out.

We will not discriminate against you for exercising these rights. If you cannot use the account deletion control, make a verified request by emailing us at [email protected]. We will verify your request (and an authorized agent’s authority, if applicable) before responding. If you are an End User who submitted information through a widget, please contact the business that operates that product; we will assist that business as its service provider.

When you use a Evermach widget installed in another company’s product, that company decides what information to collect and how it is used, and it is responsible for its own privacy practices. We process that information on its behalf. Requests to access, correct, or delete such information should be directed to that company.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, please contact us and we will take appropriate steps to delete it.

The Service may contain links to third-party websites or services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their privacy practices.

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the “Last updated” date above. Material changes may be communicated through additional notice where appropriate.

If you have questions about this Privacy Policy or your personal information, contact us at [email protected], or by mail to: