This Privacy Policy explains what Slatis, Inc. (“Slatis,” “we”) collects when you use slatis.com and the Services, how we use it, and the choices you have. It applies to people who visit our site, join the waitlist, or use the Services as members of an organization.
Your code is yours. We use it only to run the Services for you, we never train models on it, and your agents reach model providers with your organization’s own keys.
1. Information we collect
You give us
- Account details: name, email, avatar, and the identity you sign in with (GitHub, Google or an email link).
- Organization details: name, members, roles and policies.
- Waitlist details: work email and company.
Created in the Services
- Repositories and source code you push or mirror.
- Changes, specifications, approvals and comments.
- Knowledge records and the signed, append-only record of acts, including who performed each one.
- Agent session data: which agent and model ran, what it was asked, what it produced, and its resource usage.
Collected automatically
- Device and log data such as IP address, browser and timestamps.
- Product usage, to understand which features are used and to keep the Services reliable.
2. How we use information
- To provide, secure and support the Services, including verifying changes and keeping the record intact.
- To sign you in, enforce permissions, and prevent abuse and fraud.
- To communicate with you about your account, security and material changes.
- To improve the Services using aggregated, de-identified usage data.
We do not sell personal information, we do not use Customer Content to train machine learning models, and we do not show advertising.
3. Legal basis
Where the GDPR or similar laws apply, we process personal data to perform our contract with you, for our legitimate interests in running and securing the Services, to meet legal obligations, and with your consent where required.
4. Model providers
Agents in your organization call Model Providers with the API keys your organization connects. Content your agents send is processed by those providers under your agreement with them. Slatis does not store subscription credentials and does not route your code to providers you did not configure.
5. Sharing and disclosure
We share information only with sub-processors that help us run the Services, with integrations you enable, when the law requires it, to protect rights and safety, or as part of a merger or acquisition with notice to you.
6. Sub-processors
- DigitalOcean, LLC
- Application servers, managed Postgres and Git repositories (San Francisco)
- Cloudflare, Inc.
- DNS, access control, and object storage (R2) for large files, snapshots and backups
- GitHub, Inc.
- Sign-in and the optional two-way repository mirror
- Google LLC
- Sign-in with Google
- Email delivery provider
- Sign-in links and account notices
We will update this list before adding a sub-processor that handles Customer Content.
7. Data retention
We keep account and organization data while the account is active. Customer Content is kept until you delete it or your organization ends, plus 30 days for export. The signed record is append-only by design; when the law or a person’s request requires removing a personal mention, we rewrite that entry through an explicit, logged process.
8. Data security
Every organization is a separate tenant: each row carries an immutable organization id and row-level security is a second barrier. Data is encrypted in transit and at rest, access to production is restricted and audited, and every act is signed and hash-chained so tampering is detectable.
9. Cookies
We use only the cookies strictly necessary to keep you signed in. We do not use analytics or advertising cookies. Your language and theme preferences are kept in your browser’s local storage, not in cookies, and you can clear them at any time from your browser settings.
10. Your rights
Depending on where you live, you can ask to access, correct, export or delete your personal information, or object to some processing. California residents have the rights of the CCPA/CPRA; we do not sell or share personal information for cross-context behavioral advertising. Write to privacy@slatis.com and we will answer within 30 days.
11. International transfers
We process data in the United States. Where required, we rely on Standard Contractual Clauses or equivalent safeguards for transfers.
12. Children
The Services are not directed to anyone under 18, and we do not knowingly collect their personal information.
13. Changes to this policy
We will post updates here and notify organization owners of material changes at least 30 days before they take effect.
14. Contact
privacy@slatis.com · Slatis, Inc., Delaware, United States.