Privacy Policy

DevLyTicks is an engineering analytics platform operated by the legal entity identified in our legal notice (hereafter "DevLyTicks", "we", "us"). We act as the data controller for your account data, our website data, and the engineering analytics we process to provide the service.

Contact: [email protected].

Account and profile data

When you sign up (or connect a provider identity such as GitHub, GitLab, Bitbucket or Microsoft), we process your name, email address, avatar, preferred language, organization membership and authentication metadata.

Repository and activity data

When your organization connects a repository, we sync and process repository data through read-only access tokens: commits, pull requests, issues, branches, releases, CI workflow runs, deployments, and contributor metadata (name, commit email, timestamps) as published by the repository itself. This data is used to produce analytics at the organization and team level. Team workload indicators are aggregated and anonymized: individual contributors are never scored, ranked or identified on those analytics screens.

Billing data

Payments are processed by Stripe. We process billing contacts, invoices, plan and subscription status, and applied discounts. Stripe processes your payment card data as an independent controller under its own privacy policy.

Website and product usage data (with your consent)

With your consent collected through our cookie banner, we use PostHog (hosted in the EU) and possibly Google Analytics to understand how visitors use our site: pages visited, feature usage, error reports and anonymized session recordings. Without consent, only strictly necessary cookies are set.

Email addresses collected on the marketing site

When you submit your email for early access or the newsletter, we process it to create your pre-filled account or send you the requested content. Unsubscription is available in every email and in your account settings.

AI features

The AI chat feature (where available) sends your question and relevant engineering context to an external large language model provider solely to generate a response. We use EU-hosted providers where possible and do not use your data to train models.

• Performance of the contract (Art. 6(1)(b)): creating and managing your account, syncing repositories, generating analytics and reports, providing support, billing subscriptions.
• Legitimate interests (Art. 6(1)(f)): securing the platform, preventing fraud and abuse, improving the product through aggregated usage statistics, contacting you about service-critical changes. For data of contributors who are not users of the service (for example open-source contributors whose public commit metadata appears in connected repositories), our legitimate interest in analyzing repository activity is balanced against the interests of these contributors; such data is only used for aggregate analytics and is never used to build marketing profiles of those persons.
• Consent (Art. 6(1)(a)): non-essential cookies and analytics (PostHog, Google Analytics), newsletter when separate from the service.
• Legal obligation (Art. 6(1)(c)): invoice retention, tax and accounting requirements.

• Account and organization data: kept while your account is active, then deleted per your deletion request.
• Source repository analytics: kept per your plan limits (Free plan: 30 days; Pro: 365 days; Enterprise: custom).
• Invoices and billing records: 10 years (French accounting law).
• Analytics consent choice: 12 months (maximum CNIL guidance period).
• Security logs: up to 12 months.

We host all primary data in the European Union (Hetzner, Germany — ISO 27001 certified). We use the following sub-processors, each bound by data processing terms:

• Hetzner (Germany) — infrastructure hosting.
• Stripe (EU) — payment processing.
• PostHog Cloud EU — product analytics (consent-gated).
• Email service provider — transactional emails and newsletters.
• LLM providers — AI chat responses (feature-dependent).
• Source providers (GitHub, GitLab, Bitbucket, Azure) — data you choose to connect.

We do not transfer your personal data outside the EU without appropriate safeguards. Our Data Processing Agreement (DPA) covers these processors and applies automatically to all customers; a countersigned version is available on request.

Under the GDPR you have the following rights, which you can exercise by contacting us at [email protected] or directly in the dashboard under Account → Danger Zone:

• Right of access — obtain a copy of your data.
• Right to rectification — correct inaccurate data.
• Right to erasure — delete your account and connected data.
• Right to data portability — receive a machine-readable export.
• Right to restriction — restrict processing during a dispute.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — at any time, for consent-based processing.
• Right not to be subject to purely automated decisions — our team-level analytics produce aggregate indicators, not automated decisions about identifiable individuals.

We reply within one month. If you are not satisfied, you may lodge a complaint with your national supervisory authority; in France, the CNIL (www.cnil.fr).

Strictly necessary cookies (authentication, session, theme, security tokens) are set without consent as they are required for the service to function. Audience measurement and product analytics cookies require your consent, collected through the banner shown at your first visit; refusal is as easy as acceptance and does not restrict access to the website. You can change your choice at any time by clearing the "cookie-consent" entry in your browser storage for devlyticks.com.

We encrypt data in transit (TLS) and at rest, use strong authentication (including two-factor authentication), isolate production networks, keep dependencies patched, and restrict internal access to production data (including support sessions, which are announced with an in-app banner).

We may update this policy to reflect product or legal changes. Material changes are notified by email or in-product notice before they take effect.

Questions, DPA requests or rights exercises: [email protected].
Legal contact: [email protected].