Privacy Policy

1. Introduction

This Privacy Policy explains how Zibby Labs ("Teamy," "we," "our," or "us") collects, uses, discloses, and protects your personal information when you use our AI-powered software testing and development platform and related services (the "Service"). We are committed to protecting your privacy and handling your data responsibly.

By using the Service, you agree to the collection and use of information in accordance with this policy and our Terms of Service. If you do not agree with our policies, please do not use the Service.

2. Information We Collect

Information You Provide Directly

• Account Information: Name, email address, and authentication credentials when you sign in through OAuth providers (Google, Microsoft, Facebook, Apple)
• Profile Information: Profile details, preferences, and team/organization information you provide
• Project Data: Project configurations, ticket information, test cases, workflow definitions, and other content you create or import through the Service
• Integration Credentials: API tokens and connection details for third-party services you connect (e.g. Jira, GitHub, GitLab)
• Source Code and Repositories: Code repositories, branches, and pull requests you authorize us to access for implementation and analysis features
• Payment Information: Billing details provided through our payment processor (Stripe); we do not directly store your full credit card number
• Support Communications: Information you provide when contacting support or submitting feedback

Information Collected Automatically

• Usage Data: Features used, actions taken, session duration, test execution logs, and interaction patterns within the Service
• Device Information: Device type, operating system, browser type, screen resolution, and unique device identifiers
• Log Data: Server logs, error reports, API request logs, and performance metrics
• IP Address: Used for security, fraud prevention, and approximate geographic location

Information from Third-Party Services

• OAuth Providers: Basic profile information from your sign-in provider (name, email, profile picture)
• Google Workspace (Docs / Drive): If you connect Google, the content of Google Drive files you explicitly select and (optionally) the Google Docs you point Teamy at — used only to power the feature you request. See "Google User Data & Limited Use" below.
• Project Management Tools: Ticket data, sprint information, and project metadata from connected tools like Jira or Linear
• Source Control Platforms: Repository metadata, code content, pull request information, and commit history from platforms like GitHub, GitLab, or Bitbucket
• Slack: If you install the Teamy app into a Slack workspace, the messages addressed to it and the related workspace data described in "Slack App and Slack Workspace Data" below

3. How We Use Your Information

Core Service Delivery

• AI Analysis: Process your tickets, code, and project data to generate test cases, code implementations, and analysis reports
• Test Execution: Run automated tests against your applications and generate execution reports
• Workflow Automation: Execute configured workflows and integrations on your behalf
• Account Management: Create and maintain your account, manage team access, and process your subscription
• Notifications: Send service updates, execution results, and security alerts

Service Improvement

• Product Development: Analyze usage patterns to improve features and user experience
• AI Model Improvement: Use aggregated and anonymized usage metrics (such as which features are used and how often) to improve how our agents are built and prompted. We never use your content — your code, your messages, your Slack or chat data, or your connected-service data — to train language models, and neither do our AI providers
• Performance Optimization: Monitor and improve Service reliability and performance
• Security: Detect, prevent, and respond to fraud, abuse, and security incidents

Legal and Business

• Compliance: Comply with applicable laws, regulations, and legal processes
• Business Operations: Conduct analytics, billing, and business planning

4. AI Processing and Your Data

Our Service uses artificial intelligence to analyze your project data and generate outputs. Here is how we handle AI processing:

• Ticket Analysis: Your ticket descriptions and acceptance criteria are processed by AI models to generate test cases and analysis
• Code Generation: Source code and project context are processed to generate implementations and pull requests
• Test Generation: Application context and requirements are used to create and execute automated tests
• Third-Party AI Providers: We use Anthropic, OpenAI, and other AI service providers to power certain features; data sent to these providers is subject to their respective data processing agreements
• Data Isolation: Your project data is logically isolated from other customers' data
• No Training on Your Data: We do not use your proprietary code or project data to train general-purpose AI models shared with other customers

5. Slack App and Slack Workspace Data

If you install the Teamy app into a Slack workspace, or connect Slack from your Teamy Project Settings, Teamy processes data from that workspace as described in this section. This section applies in addition to the rest of this policy and describes all Slack data Teamy receives — including data we receive but do not use.

Slack Data We Receive

• Messages Addressed to Teamy: An @mention of the Teamy app in a channel, a direct message to it, or a reply in a thread it is already participating in. Messages that are not addressed to Teamy are ignored and are not processed.
• Message Metadata: The workspace/team ID, channel ID, thread timestamp, and the Slack user ID of the sender.
• Sender Email Address: The sender's workspace-verified email address, read at request time from Slack (users.info) solely to match the sender to their existing Teamy account. It is used only for that lookup and is not stored.
• Images and Files You Send: When you send an image or file to Teamy, the file is downloaded to answer that request. We retain only a pointer to it (its kind, the provider, and a reference to the message) — never the file bytes.
• Workspace Directory Metadata: Lists of public and private channels the app can see, workspace user profiles, and user groups, read on demand only to fulfil a request you make. These results are not retained.
• OAuth Bot Token: The token issued when the app is installed, stored encrypted.

What We Store, and For How Long

• Conversation History: Your message text and Teamy's reply text, per turn, keyed by thread. Retained for 90 days, enforced by an automatic time-to-live. Tool results, and the surrounding channel or thread messages Teamy reads for context, are not stored.
• Attachment Pointers: Stored alongside the conversation history under the same 90-day retention. No file bytes are stored.
• Duplicate-Delivery Markers: Retained for 24 hours so a message re-delivered by Slack is not answered twice.
• Thread-Participation Markers: Retained for 90 days so Teamy knows it may continue a thread it is already part of.
• Monthly Active-User Metering: One record per distinct Slack user per month, containing the workspace ID, the sender's Slack user ID, the month, and message counts. Used for billing and product metrics.
• Remembered Facts: A conservative heuristic extracts durable facts from conversations (for example a stated preference or a project name) and stores them per user so Teamy can recall them in later conversations. By default these have no expiry — unlike the items above they are not deleted on a timer, and they are kept until you ask us to delete them as described below.

How Slack Data Is Used

• Generating Replies: The content of messages addressed to Teamy is sent to the large language model provider that powers the assistant — by default Anthropic (Claude) — to generate a reply. Which provider is used depends on the model credential the customer supplies.
• No LLM Training: Slack data is not used to train language models. Our AI providers process it under data processing terms and do not train on it.

Deletion and Control

• Removing the App: Removing the Teamy app from your Slack workspace, or disconnecting Slack in your Teamy Project Settings, stops all further processing and deletes the stored bot token.
• Access, Export, and Deletion: You can request access to, an export of, or deletion of your Slack-derived data — including remembered facts — by emailing support@teamy.town. We process deletion requests within 30 days, subject to any legal retention requirements.

6. Information Sharing and Disclosure

We Share Information With:

• Your Team Members: Other users within your organization or projects who have been granted access
• Service Providers: Cloud infrastructure providers (AWS), analytics platforms, and other vendors that help us operate the Service, subject to data processing agreements
• AI Service Providers: Anthropic, OpenAI, and other AI platforms that process data to provide AI-powered features, under strict data processing terms
• Integrated Services: Third-party tools you connect (Jira, GitHub, etc.) to the extent necessary for the integration to function
• Payment Processor: Stripe processes your payment information in accordance with PCI DSS standards
• Legal Requirements: Law enforcement, government agencies, or other parties when required by law, court order, or to protect our rights and safety
• Business Transfers: In connection with mergers, acquisitions, bankruptcy, or asset sales, with appropriate notice to you

We Do Not:

• Sell your personal information to third parties
• Share your proprietary code or project data for marketing or advertising purposes
• Use your data to train AI models that benefit other customers
• Provide your data to advertisers

7. Data Security

We implement industry-standard technical and organizational security measures to protect your information:

• Encryption: All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Access Controls: Role-based access controls, multi-factor authentication support, and least-privilege access for our team
• Infrastructure Security: Hosted on AWS with enterprise-grade security controls, including network isolation, firewalls, and DDoS protection
• Monitoring: Continuous security monitoring, logging, and anomaly detection
• Incident Response: Documented incident response procedures and breach notification processes

No method of transmission over the internet or electronic storage is 100% secure. While we implement robust security measures, we cannot guarantee absolute security of your data.

8. Data Retention

We retain your information as follows:

• Account Data: Retained for the duration of your account and up to 30 days after account deletion
• Project Data: Retained while your account is active; available for export upon request before deletion
• Execution Logs: Test execution data and logs are retained in accordance with your subscription plan
• Slack Assistant Data: Per-item retention periods for Slack conversation history, attachment pointers, delivery and thread markers, metering records, and remembered facts are set out in Section 5 ("Slack App and Slack Workspace Data") above
• Usage Analytics: Aggregated and anonymized analytics data may be retained indefinitely for service improvement
• Legal Requirements: Certain data may be retained longer when required by applicable laws or regulations

You can request deletion of your account and associated data at any time by contacting us at support@teamy.town. We will process deletion requests within 30 days, subject to any legal retention requirements.

9. Your Privacy Rights

You Have the Right To:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of your personal information, subject to legal retention obligations
• Data Portability: Request your data in a structured, commonly used, machine-readable format
• Restriction: Request limitation of processing of your personal information in certain circumstances
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time where consent is the legal basis for processing

How to Exercise Your Rights

To exercise any of these rights, contact us at support@teamy.town or through your account settings. We will respond to verified requests within 30 days. We may need to verify your identity before processing certain requests.

10. Third-Party Services

The Service integrates with various third-party platforms. When you connect these services, their privacy policies also apply to the data they process:

• Google: Google Privacy Policy
• Microsoft: Microsoft Privacy Statement
• Atlassian (Jira): Atlassian Privacy Policy
• GitHub: GitHub Privacy Statement
• Slack: Slack Privacy Policy
• Anthropic: Anthropic Privacy Policy
• OpenAI: OpenAI Privacy Policy
• Stripe: Stripe Privacy Policy

Google User Data & Limited Use

When you sign in with Google or connect Google Workspace features, Teamy accesses a limited set of Google user data, strictly to provide the features you request:

• Sign-in (email & profile): Your name, email address, and profile picture (scopes userinfo.email, userinfo.profile) — used only to create and authenticate your account.
• Google Drive & Docs files you select: Files you explicitly create through Teamy, or open by picking them in the Google Picker (scope drive.file) — used only to read or write those specific documents for the feature you invoked. Teamy has no access to any Drive/Docs file you have not created or picked; we do not access your other Drive files.

Limited Use. Teamy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use Google user data for advertising, we do not sell it, and we do not use it to train generalized or shared AI models. Humans do not read your Google data except with your consent, for security or abuse investigations, to comply with applicable law, or where strictly necessary to provide the feature you requested (and where feasible, on aggregated or anonymized data). You can revoke Teamy's access at any time from your Google Account permissions or by disconnecting the integration inside Teamy, and you may request deletion of the associated data as described in "Data Retention" and "Your Privacy Rights" above.

11. Cookies and Tracking

We use cookies and similar technologies for:

• Essential Cookies: Required for authentication, session management, and core Service functionality
• Preference Cookies: Remember your settings and preferences
• Analytics Cookies: Help us understand how the Service is used so we can improve it

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the Service.

12. International Data Transfers

Our Service is hosted on AWS infrastructure primarily in the Asia-Pacific (Sydney) region. Your information may be transferred to and processed in countries other than your country of residence, including Australia and the United States (for certain AI processing). We ensure appropriate safeguards are in place for international transfers, including:

• Standard Contractual Clauses approved by relevant regulatory authorities
• Data processing agreements with all sub-processors
• Compliance with applicable data transfer frameworks

13. Children's Privacy

The Service is designed for professional use and is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take prompt steps to delete such information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the revised policy on this page with an updated "Last Updated" date
• Sending an email notification to the address associated with your account
• Displaying a prominent notice within the Service

Changes become effective when posted unless otherwise stated. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

15. Region-Specific Disclosures

Australian Privacy Act

We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Australian residents may lodge a complaint with us or with the Office of the Australian Information Commissioner (OAIC) if they believe their privacy has been breached.

European Union Residents (GDPR)

EU/EEA residents have additional rights under the General Data Protection Regulation (GDPR). Our lawful bases for processing include consent, contract performance, legitimate interests, and legal compliance. You may lodge a complaint with your local Data Protection Authority.

California Residents (CCPA/CPRA)

California residents have rights under the California Consumer Privacy Act and the California Privacy Rights Act, including the right to know, delete, correct, and opt-out of the sale or sharing of personal information. We do not sell your personal information.

16. Contact Us

If you have any questions about this Privacy Policy, our privacy practices, or wish to exercise your privacy rights, please contact us: