Privacy Policy

1Who we are

y5s ("y5s", "we", "us", "our") provides an AI-powered codebase knowledge platform that indexes source repositories and business requirements into a queryable knowledge base, and provides related features such as natural-language Q&A, diagram generation, merge-request review, and editor integrations (the "Service").

This Privacy Policy explains what information we collect, why we collect it, how we handle it, and the choices you have. It applies to our websites, applications, APIs, the y5s VS Code extension, and the y5s MCP server.

If you use the Service on behalf of an organization, that organization controls its workspace and the content in it, and this policy applies to our processing on the organization's behalf.

2Information we collect

Account information. When you sign in, we receive your name, email address, and authentication identifiers from our identity provider. We do not receive or store your password.

Waitlist information. If you join the waitlist, we collect the email address you submit, solely to contact you about early access and product availability.

Organization data. Organization name, team membership, roles, and group configuration that you or your administrators create in the Service.

Git provider credentials. When you connect GitLab, GitHub, or Bitbucket, we store the read-only access token you authorize, encrypted at rest. We never request write access to your repositories.

Content you create in the Service. Questions you ask, chat sessions, prompts you generate, knowledge documents you add (ADRs, glossary entries, requirements, process diagrams), team memories you capture, and review results produced for your merge requests.

Derived index data. Vector embeddings and associated metadata (such as file paths, symbol names, and chunk positions) generated from your repositories during indexing. Embeddings are mathematical representations; they are not a copy of your source code.

Usage and technical data. Log data, device and browser information, IP address, and product analytics (for example, which features are used and how often), used to operate, secure, and improve the Service.

3What we deliberately do not store: your source code

The Service is built on an ephemeral processing model. When indexing runs, your repository is cloned into an isolated, temporary workspace that exists only for the duration of the indexing job. When the job finishes — whether it succeeds or fails — that workspace is destroyed.

What persists after indexing: vector embeddings and index metadata. What does not persist: your repository contents. We do not retain copies of your source code on our systems after an indexing job completes.

Merge-request review processes the diff of a change in memory for the duration of the review and stores only the resulting review findings, not the diff itself beyond what is quoted in the findings.

4How we use information

• To provide, operate, and maintain the Service, including indexing, answering queries, and reviewing merge requests;
• To authenticate you and enforce organization-level access controls and tenant isolation;
• To communicate with you about the Service, including waitlist updates, security notices, and support;
• To monitor, secure, and debug the Service, and to prevent abuse;
• To understand aggregate usage and improve the product;
• To comply with legal obligations.

We do not sell your personal information, and we do not use your repository content, embeddings, queries, or knowledge base content to train our own or third-party machine-learning models.

5AI processing and subprocessors

To generate answers, embeddings, diagrams, and reviews, the Service sends relevant excerpts of your indexed content and your queries to third-party large-language-model and embedding providers acting as our subprocessors. These providers process the data to return a response and are contractually bound to confidentiality and to not training their models on your data.

We also use subprocessors for cloud hosting and infrastructure, and for transactional email delivery. A current list of subprocessors is available on request.

6How we share information

• With subprocessors described above, only to the extent necessary to provide the Service;
• Within your organization: your queries, sessions, memories, and knowledge contributions may be visible to other members of your organization according to its settings;
• With Git providers you connect, to read repository data you have authorized;
• If required by law, regulation, or valid legal process, after reviewing the request and, where lawful, notifying you;
• In connection with a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your information.

We never share or sell personal information to advertisers or data brokers.

7Data retention

Waitlist emails are kept until we launch publicly or you ask to be removed, whichever comes first.

Account and organization data are kept for as long as your account or organization is active, and deleted within 30 days of a verified deletion request or account closure.

Embeddings and index metadata are kept until you delete the related project or organization, at which point they are permanently deleted.

Git provider tokens are deleted immediately when you disconnect the integration or delete the project.

Operational logs are retained for a limited period (no longer than 90 days) for security and debugging, then deleted or anonymized.

8Security

• Ephemeral processing: repository contents exist only in temporary, isolated workspaces during indexing;
• Tenant isolation: each organization's data is logically separated, and cross-organization access is prevented at the architecture level;
• Read-only access: we request and store only read-only Git tokens, encrypted at rest;
• Encryption in transit (TLS) for all communication with the Service;
• Access controls and audit logging on our production systems.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by applicable law.

9Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at info@y5s.tech. We will respond within 30 days. If you are in the EEA or UK, you also have the right to lodge a complaint with your supervisory authority.

10International transfers

Our infrastructure and subprocessors may be located in countries other than your own. Where personal data is transferred internationally, we rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms recognized by applicable law.

Enterprise customers may choose the self-hosted deployment option, in which case repository data and the knowledge base never leave the customer's own infrastructure.

11Cookies

We use strictly necessary cookies and similar storage to keep you signed in and to secure the Service. We do not use third-party advertising cookies. If we introduce optional analytics cookies in the future, we will ask for your consent where required.

12Children

The Service is intended for business use and is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

13Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or through the Service before the changes take effect. The effective date at the top of this page shows when this policy was last revised.

14Contact

For privacy questions or requests: info@y5s.tech.