IR Labs Privacy Policy

IR Labs is committed to protecting your privacy. This Privacy Policy describes our practices regarding the types of Personal Data and other information we collect from users of our website (www.irlabs.ai) and our “Services” (meaning IR Labs products, including Agentic SQA, and related services). It is incorporated into and considered part of any agreement governing use of our Services or website. Our Services are provided by Integrated Research, Inc., a Colorado corporation operating as IR Labs, a subsidiary of Integrated Research Limited.

Information we collect

IR Labs collects data from you when you visit our website, when you send us information or communications, and when you install and use our Services.

Personal Data. “Personal Data” is any information relating to an identified or identifiable natural person, such as a name, email address, identification number, location data or online identifier. We collect only Personal Data that is necessary, relevant and limited to the Services we provide, including information you provide or permit us to collect. Like most internet services, we automatically gather data about you or your device browser, including IP address, cookies and the pages you request, stored in log files each time you visit our website or access your account.

Anonymous Data. Our servers collect “Anonymous Data” such as browser type, operating system, domain name and date/time stamps. Anonymous Data has all Personal Data references removed such that it cannot be reverse engineered or attributed to an individual.

Customer Data. “Customer Data” means content and data you or your users submit to or make available through the Services, including source code, repositories, pull-request diffs, logs, tickets, test artifacts, build outputs and related metadata, and analysis artifacts generated by or transmitted from locally installed components of the Services (such as verification verdicts, compile commands and build metadata and, where applicable, intermediate compiler representations). Customer Data is processed to provide, secure, support and improve the Services and to develop and train our detection models, as described below.

Usage Data. “Usage Data” means telemetry about how the Services are used (feature usage, performance and diagnostics, including telemetry from locally installed components such as our command-line tool).

Billing information. Plan, seats and transaction records. Payment-card details are collected and processed by our payment processor (Stripe); we do not store full card numbers.

Information from integrations. When you connect a third-party service (e.g., a Git provider such as GitHub), we receive repository identifiers, permission scopes, webhooks and related metadata you authorize.

Information from children. We do not direct or target our Services to, nor intentionally collect Personal Data from, children under the age of 16. If we learn that a child under 16 has created an account, we may disable it or seek parental consent.

Personal health and sensitive information. Our Services are not intended for, and you must not use them to process, Personal Health Information as defined by HIPAA, or any sensitive Personal Data (e.g., racial or ethnic origin, health, political opinions, religion or criminal background).

How your code is processed

To perform an analysis, we access the relevant repository content in an isolated compute environment for the analysis. We store pull-request diffs and analysis inputs and outputs, and may store additional repository content, in order to provide, secure, support and improve the Services and to develop and train our detection models. Analysis is performed using one or more third-party model providers (currently OpenAI) accessed over their APIs; data sent to a provider is handled under that provider’s terms. We do not automatically scan for or redact secrets, credentials or personal data — please avoid exposing such material in connected repositories.

Locally installed components (command-line tool). Some analyses run on your machine through our command-line tool (“CLI”) rather than in our environment. In that case, verification runs locally against your code and toolchain, and the CLI transmits results and related metadata to us — such as verification verdicts, compile commands and build metadata — and authenticates to your account so runs, quotas and support can be attributed to your workspace. When you invoke the CLI against local changes, the corresponding code may be committed and pushed to a connected repository — including a service-created working branch that we create and later remove — so that our systems access it through your source-code host in the same way as other analyses, rather than by direct upload from your machine. The CLI may also collect diagnostics and, where you choose to use it, feedback you submit through the tool.

How we use your information

We use Personal Data to pursue our lawful business interests, generally to respond to your requests, to market our Services, and to provide the Services. Specifically, we use information to: create and secure your account; identify you as a user; operate, administer, maintain and secure the website and Services; perform analyses and generate Outputs; process payments and manage subscriptions; provide support; send administrative, security and transactional messages; send promotional communications and surveys (which you can opt out of); support regulatory requirements such as tax calculation and reporting; and respond to legal or regulatory inquiries. We use Anonymous Data and Usage Data to test, analyze and improve our Services.

How we use Customer Data to improve and train our models

We use Customer Data — including source code, pull-request diffs and repository content processed by the Services — to operate, secure and support the Services, and to develop, evaluate, train and improve IR Labs’ detection models, datasets and the Services. We may retain diffs and related analysis data for these purposes. This is a core part of how the Services improve over time. We do not sell Customer Data or Personal Data.

Where Customer Data contains Personal Data, we handle it as follows. Personal Data collected to register, authenticate, bill or support your account is used to provide the Services and is not used to develop or train our models. Before Customer Data is used for model development or improvement, we remove or exclude direct identifiers available to us in structured form, such as commit author name and email fields. Customer Data may still incidentally contain Personal Data embedded in content, such as names appearing in code comments or log files; we do not use such data to identify individuals, and because we do not scan repository content for personal information, you should avoid exposing personal information in connected repositories.

How we share your information

We share information with service providers (subprocessors) that help us run the Services, under contracts limiting their use of the data. Current subprocessors include:

• Amazon Web Services (AWS) — infrastructure, compute and storage
• OpenAI — model inference (additional model providers may be used as the Services evolve)
• Stripe — payment processing
• WorkOS — authentication and identity
• Cloudflare — content delivery, DNS and security
• Honeycomb — observability and telemetry
• Resend — transactional email
• Google — workspace email/support communications and website analytics

Regardless of your choices, IR Labs may disclose Personal Data and Anonymous Data in good faith to: investigate or prevent illegal activity, fraud or violations of our agreements, or to comply with law, legal process or government requests; respond to an emergency to prevent death or serious bodily injury; or protect the rights, security, integrity or property of IR Labs or users. If IR Labs is involved in a merger, acquisition or sale of assets, you will be notified of any change in ownership or use of your Personal Data. We do not sell, trade or share the Personal Data collected from our Services to third parties other than as outlined in this policy.

Storage and processing

Information may be stored and processed in the United States, United Kingdom, European Union, Singapore, Australia, or any other country in which IR Labs or its subsidiaries, affiliates or service providers maintain facilities.

EU data transfers. Transfer of Personal Data from an EU country or organization to a non-EU country falls under the EU General Data Protection Regulation. To support compliance, IR Labs requires execution of a Data Processing Addendum and Standard Contractual Clauses before any such transfer.

Data processed for our customers. IR Labs processes certain information under the direction of its customers and may have no direct relationship with the individuals whose Personal Data it processes. If you submit Personal Data relating to other individuals, you represent that you have authority to do so and to permit us to use it in accordance with this policy. It is the customer’s responsibility to ensure the information they provide can be legally collected, transmitted to us, and used by us.

Data access and retention

IR Labs retains Personal Data and Customer Data for as long as needed to provide the Services and to comply with our legal and regulatory obligations. You may request deletion of your Personal Data, but we may be required (by law or otherwise) to retain certain information for a specified time, in which case we will comply with your deletion request only after fulfilling those requirements. Certain data associated with your account may remain in an aggregated or anonymized form that does not identify you, and, consistent with the section above on model training, data already used to develop or train our models may persist in that form. When we delete account information, it is removed from the active database but may remain in archives.

How we protect your information

We use appropriate technical and organizational measures to protect data online and offline, including processing each analysis in an isolated environment, restricting network egress from that environment to a limited allowlist, and encrypting Personal Data in transit and at rest (and Anonymous Data in transit). We require a password to access your account. Since no data transmitted over the internet can be 100% secure, we cannot guarantee the security of any information you transmit, and we do not currently hold formal security certifications. We work with trusted vendors and hosting partners and, where possible, obtain confidentiality agreements consistent with this policy. In the event Personal Data is compromised, IR Labs will notify you in compliance with applicable laws. Questions about security: [email protected].

Your choices

You may opt out of promotional emails at any time via the unsubscribe instructions or by contacting [email protected]; transactional and relationship messages (account, security, terms updates) are not optional. Depending on your location, you may have rights to access, correct, delete, port or restrict processing of your Personal Data, or to object to processing; contact [email protected] to exercise them. You may withdraw previously given consent, which will not affect the lawfulness of prior processing. If you are an end user of an application that uses our Services, direct access and deletion requests to that application provider.

Questions, concerns or complaints

Contact the IR Labs team at [email protected], postal address for Integrated Research, Inc. at: 6400 S Fiddlers Green Cir Suite 300, Greenwood Village, CO 80111, USA, ATTN: Legal. You may also have the right to submit a complaint to your local data protection authority.

Changes to this Privacy Policy

We may change this Privacy Policy from time to time. We will post an updated policy at irlabs.ai/privacy, effective as of the date of posting. Your continued use following changes means you accept the revised policy; for material changes we will make reasonable efforts to notify you.