VibeCop and Gradus Privacy Policy

Effective date: September 28, 2026
Last updated: September 28, 2026
Version: 2.0

VibeCop and Gradus are services operated by Maiife Private Limited, No. 29, Thatha Muthiappan Street, Sowcarpet, Chennai – 600001, Tamil Nadu, India ("Maiife", "we", "us"). VibeCop — the Architecture Integrity & Product Intelligence service — is available at vibecop.maiife.ai and through the VibeCop CLI, API and MCP server. Gradus — the team Workbench — is available at gradus.maiife.ai and through the Workbench tether for coding agents and editors. The two products share one account system and one database, so this policy covers both. Where something applies to only one of them, we say so.

This policy explains what data we collect, why, where it goes, and what your rights are. VibeCop and Gradus are business products: you use them on behalf of an organization. For your account and billing data, Maiife acts as the data controller. For the source code, repository content and other content your organization connects or submits, Maiife acts as a processor on your organization's behalf.

The maiife.ai website and the Maiife console have their own notices: maiife.ai/privacy and console.maiife.ai/privacy.

What changed in this version

• AI providers. Sections 3 and 4 now name the providers we actually use: OpenRouter, which routes our model requests to Z.AI and DeepInfra, and OpenRouter or Together AI for embeddings. DeepSeek is no longer used.
• Analytics. The previous version said we used no third-party analytics. vibecop.maiife.ai and gradus.maiife.ai use Vercel Web Analytics and Speed Insights, described in Section 1.7.
• Other recipients. We added our email provider, the vulnerability and package databases we query, the providers Gradus uses, and Cloudflare Turnstile for sign-up checks where it is enabled.
• Gradus. This policy now covers Gradus as well as VibeCop.
• Export and deletion. Organizations can now export and delete their data themselves (Section 6).
• Legal bases. Section 2 now states the legal bases we rely on.
• Removed. "Pattern fingerprints", which were never stored, and Google Fonts, which we no longer load from Google.

1. Data we collect

1.1 Account and organization data

When you sign up (email and password, or Google or GitHub sign-in) we collect:

• Email address and display name
• Organization name and slug, team and project memberships, and your role within the organization
• Authentication data managed by our auth provider (Supabase Auth): hashed password, OAuth identity, email verification status

We verify email addresses with a one-time code sent to your email. We never see or store your Google or GitHub password.

To stop automated sign-ups, we count sign-up attempts per network and per email address, storing only one-way hashes of them. Where it is enabled, Cloudflare Turnstile checks that a sign-up comes from a person; Cloudflare receives your IP address and information about your browser for that check.

1.2 Repository and code data (VibeCop)

When your organization connects a GitHub repository — by authorizing our GitHub OAuth app (repo and admin:repo_hook scopes) or, where your organization installs it, the VibeCop GitHub App — we process:

• Repository contents (source files fetched per scan, subject to size limits), pull request diffs, commit metadata, branch names
• Pull request titles, URLs, and the GitHub username of the pull request author

From this we derive and store:

• Review findings: rule name, title, description, severity, file path, and line numbers (not full source files). Findings written by our AI detectors contain model-generated text, which can occasionally quote a line of your code
• AI-generated fix prompts for findings, and a generated summary of the code graph
• A code structure graph: symbol names (classes, functions), file paths, relationships (calls, imports, inheritance), commit SHAs
• Vector embeddings of code excerpts, with a hash of the text each one was made from — not the text itself
• Scan run records: repository name, PR metadata, timestamps, status, error messages

We do not permanently store copies of your repository. Source files are fetched per scan and processed in memory or in temporary working directories; what persists is the derived data above.

1.3 Ask conversations (VibeCop)

When you use the Ask bar to ask questions about your codebase, we store the conversation — your questions and the answers — encrypted at rest, together with vector embeddings of those messages, so that threads persist and search works. You can archive threads yourself; organization admins can permanently delete them.

1.4 Developer tooling events (CLI, hooks and MCP)

If your organization installs the VibeCop CLI or coding-agent hooks, or connects a coding agent over MCP, we receive events from your development sessions. These can include the tool used, session identifiers, the working directory and branch, prompt text, and tool activity such as edited file paths. When you or your agent submit a plan for review, we store its title, a hash of it, and the review report, which can quote from it. For a Feature Factory run we store its title and the task graph built from it — each task's description and the files it expects to touch — and mirror the tasks as issues in your GitHub repository. CLI, hook and MCP access tokens are stored only as SHA-256 hashes.

1.5 Gradus data

Gradus is the team Workbench. If your organization turns it on and developers connect the Workbench tether to their coding agent or editor, we receive and store:

• Presence: who is working, in which repository and branch, from which kind of client, and when the session was last active
• Declared intents: the files a session plans to read or change, used to warn about overlapping work
• Session details reported by the tether, such as duration and token counts per model
• Messages exchanged on the board between team members and agents
• Changes queued for landing — branch and commit references and pull request numbers — which we land through GitHub
• Skills your organization publishes to its registry

Other Gradus features process:

• Requirement refinement (Challenge and PRD generation): the ticket and requirement text you submit. We store the drafts it produces.
• Code translation: the source files you submit for translation. We store them and the translated output, encrypted at rest.
• Projects, tickets and sprints you create, or sync from Linear or Jira when your organization connects them.

1.6 Billing data

If your organization buys a plan or credits, payments are processed by Razorpay. We send Razorpay your email address, name, and organization identifier. We store the resulting references — customer ID, subscription ID, payment IDs, amounts, currency, payment method type (e.g. card, UPI), and payment status — and the payment notifications Razorpay sends us, which can include the payer's email address and phone number. We never receive or store full card numbers or bank credentials.

1.7 Usage, analytics and operational data

• Credit usage records (which scans, Ask requests and other features consumed credits)
• AI call records: the operation, model, token counts, cost, latency and outcome — not the prompt or the response
• Audit records of administrative actions (who changed what, when)
• Server logs, which include IP addresses (used for security, rate limiting and abuse prevention)
• In-product notifications addressed to you
• Web analytics. vibecop.maiife.ai and gradus.maiife.ai use Vercel Web Analytics and Vercel Speed Insights. They record page views, the referring page, device, browser and operating-system type, country, and page-performance measurements (web vitals). They do not use cookies. We use them to understand how the sites are used and to find slow pages.

1.8 Support requests and emails

When you send a support request from inside the app, we email it — with any files you attach and your account email address — to our support inbox. We send verification codes and account emails through our email provider (Section 4).

1.9 What we deliberately do not collect

• No advertising trackers, advertising cookies, or session recording
• No full payment card numbers or bank credentials
• No data from repositories your organization has not explicitly connected

2. How we use data, and our legal bases

For the code and other content your organization connects or submits, we act as a processor: we process it only to provide and secure the service for your organization, and your organization is responsible for the legal basis of that processing.

Under India's Digital Personal Data Protection Act, 2023, we process your personal data on the basis of the consent you give when you create an account and use the service, and on the legitimate uses the Act permits, such as complying with the law.

We do not use your source code or other customer content to train AI models, and we do not sell your data.

3. AI processing

3.1 VibeCop

VibeCop uses third-party AI models for part of its analysis. During scans, when fix prompts and graph summaries are generated, and when you use the Ask bar or graph explanations, we send the relevant material over an encrypted connection to OpenRouter, which forwards each request to a provider that runs the model we use (currently z-ai/glm-5.2). What we send can include source code excerpts and diffs, file paths, the repository name and pull request title, finding details, your Ask questions, and the context retrieved for them. Before a model request leaves our servers, secrets our detectors recognize are redacted.

As measured on September 17, 2026, OpenRouter served about 90% of these requests through Z.AI (People's Republic of China) and about 10% through DeepInfra (United States). If those are unavailable, OpenRouter may use another provider that runs the same model. We can limit which providers OpenRouter may use, and we will update this section when we do.

To power code search and duplicate detection, we also send code excerpts and Ask text to an embedding provider — OpenRouter or Together AI — which returns numeric vectors. For code, we keep the vectors and a hash of the input, not the text. Comments are removed before code is embedded but string literals are not, and embedding requests are not redacted, so a credential written into your source as a string can reach the embedding provider. Keep secrets out of source code — our secret detector flags them.

Turning AI analysis off. An organization owner can turn off automatic AI analysis in Settings → Billing → AI Analysis. With it off, scans stop sending source excerpts to the AI provider, and embeddings, background fix-prompt generation, the scheduled graph summary, and the Ask bar stop. Features a person or their agent starts — code search, plan reviews and Feature Factory runs — still send their text, and the repository files a review compares it against, to the embedding provider. The switch is a privacy control rather than a hard security boundary: if the setting cannot be read because of a system error, automatic jobs run as though it were on.

3.2 Gradus

• Requirement refinement sends ticket and requirement text to Anthropic or OpenAI, depending on the model you choose. PRD section refresh sends ticket content to Anthropic.
• Code translation sends the source files you submit to Anthropic, through the Vercel AI Gateway.
• The Workbench's unattended builder, where it is enabled, checks your repository out into an isolated Vercel Sandbox and sends the task and relevant code to a model through OpenRouter.

These Gradus features do not use VibeCop's secret redaction, so do not include secrets in tickets or in code you submit. Requirement refinement and code translation are not covered by the AI Analysis switch; the unattended builder is.

3.3 Model training and provider retention

Maiife does not use your code, prompts or other customer content to train AI models. The providers named in this section process what we send under their own API terms, which govern how long they keep it and what they may use it for. We do not currently have zero-data-retention arrangements with them, so their standard API data-use terms apply.

4. Who we share data with (subprocessors)

Partikle (embeddings and facts service) is Maiife-operated infrastructure, not a third party.

We will maintain a current subprocessor list at this page. We will give at least 30 days' advance notice of any new subprocessor by email or in-product notification, during which you may object.

5. International transfers

Your data crosses borders. The database is in Singapore (AWS ap-southeast-1). Our APIs run on Railway in the United States, and most of the providers in Section 4 — including OpenRouter, DeepInfra, Together AI, Anthropic, OpenAI and GitHub — process data in the United States. The web apps are served from Vercel's global network, with server functions in Mumbai, India, and Razorpay processes payments in India. While Z.AI remains one of the providers OpenRouter may use, code excerpts and other content sent for AI analysis may be processed in the People's Republic of China. We do not offer a choice of data region. An organization owner can stop the automatic transfers to AI providers by turning off AI analysis (Section 3.1).

By using VibeCop or Gradus you acknowledge these transfers. Where GDPR applies, we work to ensure appropriate safeguards, such as standard contractual clauses, are in place with our subprocessors.

6. Retention and deletion

• Review findings, scan history, and the code graph are retained for the life of your organization's account so that trends (e.g. the Architecture Integrity Index) work over time.
• Ask threads: you can archive threads at any time; organization admins can permanently delete a thread and its messages and embeddings.
• Deleting a codebase permanently deletes its code graph and the scans and findings linked to it. Deleting a project deletes everything in it — its codebases, repositories, tickets, sprints and tasks.
• Organization deletion (self-serve): an organization owner can delete the organization from Settings → Billing in VibeCop. Deletion is scheduled 48 hours ahead by default and can be cancelled until then; the owner can also choose to delete immediately. When it runs, the organization and the data held under it are deleted from our database. A few kinds of records — mainly derived records in our internal facts and embeddings service — are not yet removed automatically; email contact@maiife.ai and we will remove them.
• Organization export (self-serve): organization admins can download the organization's data — members, scans and findings, Ask conversations, and billing records — as JSON from the same page. For data the export does not include, such as Gradus project content, email contact@maiife.ai.
• Requests about you as an individual — a copy of your personal data, or its correction or deletion — go to contact@maiife.ai. We respond within 30 days.
• We may keep records we must retain for legal, tax, or security purposes (e.g. payment records).

7. Security

• All traffic is encrypted in transit (TLS)
• Data at rest is encrypted by our database provider (AES-256, AWS-managed keys)
• GitHub, Slack, Linear and Jira access tokens and webhook secrets are encrypted in our application (AES-256-GCM) before they are stored
• Ask messages, and the files and translations stored for Gradus code translation, are also encrypted in our application (AES-256-GCM)
• CLI, hook and MCP access tokens are stored only as SHA-256 hashes
• Secrets our detectors recognize are redacted before VibeCop sends a request to its AI model provider
• Access is segregated per organization and enforced at the API layer; role-based permissions apply within organizations
• Rate limiting and CORS restrictions protect the API
• You can revoke VibeCop's access to GitHub at any time from your GitHub settings

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify affected organizations and the relevant authorities as required by applicable law.

8. Your rights

Depending on your jurisdiction (including under the GDPR and India's Digital Personal Data Protection Act, 2023), you may have the right to access, correct, export, delete, or restrict processing of your personal data, to object to processing or withdraw consent, and — under the DPDP Act — to nominate someone to exercise these rights for you. Organization export and deletion are self-serve (Section 6). For anything else, including requests about you as an individual, email contact@maiife.ai. We respond within 30 days. If you are in the EU/EEA you may also lodge a complaint with your supervisory authority; if you are in India you may approach the Data Protection Board of India.

Grievance Officer (India, DPDP Act): Sakthivel Chandrasekaran — contact@maiife.ai

Note that most repository and code data belongs to your organization; requests concerning it may need to come from your organization's administrator.

9. Cookies and similar technologies

VibeCop and Gradus use only functional cookies: a per-product sign-in cookie (sb-vibecop-auth-token or sb-gradus-auth-token) that keeps you signed in, and a short-lived cookie used while you sign in with Google or GitHub. They are scoped to the product's own subdomain, marked Secure in production, and SameSite=Lax. If you signed in on maiife.ai, the sign-in cookie that site shares across maiife.ai subdomains is also read.

Vercel Web Analytics and Speed Insights do not use cookies. We keep a few interface preferences in your browser's local storage — such as your color theme, panel layout and, if you tick "Remember me", your email address. They stay on your device.

We set no advertising or analytics cookies, so we do not show a cookie consent banner.

10. Children

VibeCop and Gradus are business tools and are not directed at children. You must be at least 18 years old to create an account.

11. Changes to this policy

We may update this policy as the services evolve. Material changes will be announced in-product or by email, with the effective date updated above; the "What changed" section summarizes the latest revision. Continued use after the effective date constitutes acceptance.

12. Contact

Maiife Private Limited
No. 29, Thatha Muthiappan Street, Sowcarpet, Chennai – 600001, Tamil Nadu, India
contact@maiife.ai