Privacy Policy

This policy explains how Devspeak S.A.S. handles personal data in gRit. It applies wherever you use gRit. We apply it together with the data protection laws that apply to you; where those laws give you more protection than this policy, they prevail.

Devspeak S.A.S., a simplified stock company (S.A.S.) incorporated in Colombia, Cll. 7D # 43A - 40, Piso 8, Medellín, Antioquia 050022, Colombia, is the controller of the personal data processed by gRit: the company that decides why and how it is processed. Contact for everything about your data: info@devspeak.dev.

• We do not receive card numbers: Dodo Payments collects them as Merchant of Record.
• gRit does not clone or store your source files, and it sends none of your data to AI or language-model services.
• We do not sell personal data and do not use it for advertising. gRit sets the cookies needed to sign you in and keep you signed in, and stores a few display preferences in your browser. Analytics cookies from Google Analytics are set only if you accept them in the cookie banner; until you choose, and if you reject, they are not set, and a Global Privacy Control signal from your browser counts as a rejection. Google signals and ad personalization are off, and Google keeps the data for 14 months. You can change your choice at any time with “Cookie settings” at the bottom of every page. The full list is in our Cookie and analytics policy.
• Visit statistics without cookies. gRit also counts visits with Umami, an analytics tool we host on our own servers. It sets no cookies and stores nothing on your device. It records the page, the website or campaign that referred the visit, browser, operating system, device type, language and a country derived from the IP address. It does not store the IP address, and it identifies a visit only with a code that changes periodically, so visits cannot be linked to you over time. We use these totals to understand which pages and sources bring visitors and to improve gRit.

We process your data to perform our contract with you (running the Service you signed up for), to meet legal obligations (billing and consumer-law records), for our legitimate interest in keeping the Service secure, and with your consent where the law requires it. With your consent, we measure use with analytics cookies; you can withdraw it at any time. By signing in after reading the notice, you authorize the processing described in this policy, for these purposes only.

Dodo Payments handles the data it collects at checkout as an independent controller under its own privacy policy. Google signals and ad personalization are off in Google Analytics, and Google keeps that data for 14 months.

We and our providers store and process data mainly in the United States. This means your data may be processed outside the country where you live, under laws that may protect personal data differently. Each provider is bound by a contract that requires it to protect the data and to use it only to provide its service to us, and we give each one only what it needs. You can ask us for more information at info@devspeak.dev. Encrypted copies of our database backups are also kept by Devspeak S.A.S. in Colombia.

• Account and repository data stay while you have an account. Delete your account in Settings → Profile: we immediately delete your account, sessions, Git host connections and tokens, repository snapshots and profile photo, remove the webhooks gRit added to your repositories, and cancel a paid subscription at Dodo Payments. Your repositories on GitHub or GitLab are not touched.
• Backups of the database are kept for up to 30 days in our cloud backup storage and for up to 8 weeks in the encrypted copies mentioned above. Deleted data disappears from them as they expire.
• Billing records (checkout consents, withdrawals, payment notifications and billing audit entries) are kept after account deletion, no longer linked to your account, for as long as tax and consumer-protection law requires us to be able to prove them. Dodo Payments keeps its own records under its policy.
• Server logs are rotated by size and overwritten as new logs arrive.
• Google Analytics data (only if you accepted): 14 months, then deleted automatically. Your cookie choice: on your device for 12 months, then we ask again.

Depending on the law that applies to you, you have the right to:

• know whether we process your personal data, and access it free of charge;
• correct or update data that is inaccurate or incomplete;
• have your data deleted when we have no legal or contractual duty to keep it;
• receive your data in a portable, commonly used format, or have it sent to another provider;
• object to, or ask us to restrict, certain processing, including processing based on our legitimate interests;
• withdraw your consent or authorization at any time, and ask for proof of the authorization you gave;
• be told how we have used your data;
• not be treated differently for exercising these rights.

We do not sell personal data or share it for cross-context behavioral advertising, and we do not take decisions about you based solely on automated processing that have legal or similarly significant effects.

How to exercise them. Write to info@devspeak.dev from the email address of your account, or tell us how we can verify your identity. Delete your account yourself in Settings → Profile. We answer questions about your data within 10 business days and requests to correct, update or delete data or to withdraw your authorization within 15 business days. If we need more time, we tell you why before the deadline and answer within 5 more business days for questions or 8 more for other requests. If the law that applies to you sets a shorter period, we follow it.

Complaints. If you are not satisfied with our answer, you can complain to the data protection authority of the country where you live or work, or of the country where we are established. Please contact us first, so we can try to solve it.

Encrypted connections (HTTPS), Git host tokens encrypted at rest, signed webhooks, access to production limited to the people who run it, and daily backups. No system is completely secure. If a security incident affects your personal data, we will notify you and the competent authorities as the law requires.

gRit is not for anyone under 18, and we do not knowingly collect their data.

We post changes on this page with a new effective date and email account holders about material changes before they apply.

Devspeak S.A.S., Cll. 7D # 43A - 40, Piso 8, Medellín, Antioquia 050022, Colombia · info@devspeak.dev

• October 28, 2026: Counsel-approved texts: analytics cookies only with your consent (Google Analytics) and the new Cookie and analytics policy; rights, international transfers and complaints described for users anywhere; governing law of Colombia with the courts of Medellín and your country's mandatory consumer protections always kept; Spanish version.
• October 15, 2026: The entity's address is printed from the company facts; version and change history added; no change to what we collect, who processes it, or the refund terms.
• October 14, 2026: First published version.