Privacy Policy
This Privacy Policy explains how Grundbulten 161704 AB, org. nr 559590-2999 (“we”, “us”, “Hilma”) collects, uses, and protects personal data when you use Hilma at gethilma.io (“Service”).
Hilma operates under the General Data Protection Regulation (EU) 2016/679 (GDPR). Our supervisory authority is Integritetsskyddsmyndigheten (IMY), Sweden.
1. Data We Collect
Account data
When you sign up: your name, email address, and authentication credentials. These are managed by Clerk (our authentication provider). We store your Clerk user ID, name, and email in our own database to associate your account with your data.
Invocation data
When you submit a pull request for evaluation: the GitHub PR URL, diff, metadata (title, description, file list), commit messages, and PR comments. We store the processed analysis results, including scores, reasoning, and routing recommendations, for as long as your account is active.
Integration credentials
When you connect external services, we store:
- GitHub: OAuth access token or GitHub App installation ID, and repository access scope.
- Linear: OAuth access token and workspace identifier.
- Jira: OAuth access token, site URL, and user account identifier.
- PostHog: Personal API key and numeric project ID. The API key is encrypted at rest (AES-256-GCM) before it is stored.
OAuth tokens and API keys for your connected integrations are encrypted at rest (AES-256-GCM) before storage, and are used only to fetch context data when you request an evaluation.
Context data
Data fetched from your connected integrations to perform evaluations: issue titles and descriptions, project names and priorities, feature flag names, and event definitions. This data is processed to generate evaluations and stored with the invocation record.
Feedback and outcomes
Feedback you provide on evaluations (thumbs up/down ratings, outcome recording such as “shipped fine” or “caused issues”), and review actions taken on shared evaluations. This data is used to improve the Service.
Support conversations
When you contact us through the in-app or website chat (provided by Intercom), we process your name, email address, user ID, and the content of the conversation to answer your questions and improve the Service.
Usage analytics
We use PostHog to collect anonymised usage analytics (pages visited, features used, general interaction patterns). This data does not identify you personally and is not shared with advertisers.
2. Legal Basis for Processing
| Data category | Legal basis |
|---|---|
| Account data | Performance of contract — Article 6(1)(b) GDPR |
| Invocation and context data | Performance of contract — Article 6(1)(b) GDPR |
| Integration credentials | Performance of contract — Article 6(1)(b) GDPR |
| Feedback and outcome data | Legitimate interest — product improvement — Article 6(1)(f) GDPR |
| Anonymised aggregated data for model calibration | Legitimate interest — product improvement — Article 6(1)(f) GDPR |
| Support conversations | Legitimate interest — customer support and product improvement — Article 6(1)(f) GDPR |
| Usage analytics | Legitimate interest — product improvement — Article 6(1)(f) GDPR |
3. Data Storage and Location
All invocation data, results, and integration credentials are stored in Supabase (PostgreSQL), hosted in Frankfurt, Germany (EU Central). Your data does not leave the EU in connection with Supabase.
Authentication is managed by Clerk, which stores account data on servers located in the United States. Clerk relies on Standard Contractual Clauses (SCCs) as the transfer mechanism for EU personal data. See Clerk's Privacy Policy.
Transactional emails are sent via Resend, which processes email addresses in the United States under Standard Contractual Clauses.
4. Sub-processors
We use third-party sub-processors to provide the Service. A full list, including their locations and the data each processes, is available at gethilma.io/legal/sub-processors.
5. Data Retention
We retain your personal data for as long as your account is active. When you delete your account, all personal data associated with it — including invocations, results, feedback, integration credentials, and account information — is deleted within 30 days.
Dormant accounts: If your account has had no login activity for 24 consecutive months, we will notify you by email. If you do not log in within 30 days of that notification, your account and all associated data will be deleted. You can always prevent deletion by logging in.
Anonymised, aggregated data — which has no connection to your identity or your organisation — may be retained indefinitely for product improvement purposes.
6. Your Rights Under GDPR
As a data subject, you have the following rights under GDPR. To exercise any of them, contact hello@gethilma.io. We will respond within 30 days.
- Access (Article 15): Request a copy of the personal data we hold about you.
- Rectification (Article 16): Request correction of inaccurate or incomplete data.
- Erasure (Article 17): Request deletion of your data. You can also delete your account directly from the app.
- Restriction (Article 18): Request that we limit how we process your data while a dispute is resolved.
- Portability (Article 20): Receive your personal data in a machine-readable format.
- Object (Article 21): Object to processing based on legitimate interest, including processing for service improvement and model calibration.
If you are unsatisfied with our response, you have the right to lodge a complaint with Integritetsskyddsmyndigheten (IMY) at imy.se.
7. Cookies and Tracking
We use minimal cookies:
- Session cookie: Set by Clerk to maintain your authenticated session. This cookie is strictly necessary for the Service to function; it cannot be disabled without losing account access.
- Analytics: PostHog places a first-party cookie to track anonymised usage patterns. On our marketing site this loads only after you accept the cookie banner. You can opt out by contacting hello@gethilma.io.
- Support chat:Intercom places cookies to keep your chat conversation continuous. On our marketing site the chat loads only after you accept the cookie banner; inside the app it is part of the Service's support functionality.
We do not use advertising cookies, third-party tracking pixels, or device fingerprinting.
8. Security
We take reasonable technical and organisational measures to protect your data:
- All data in transit is encrypted via TLS 1.2 or higher.
- Connector credentials (OAuth tokens and API keys) are encrypted at rest with AES-256-GCM at the application layer before storage.
- All data is additionally stored on infrastructure that encrypts it at rest (Supabase/AWS).
- Every database query is scoped to the authenticated account, so users can only access their own data.
- Access to production data is limited to authorised personnel.
- The Service is hosted on Vercel with automatic DDoS mitigation.
No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at hello@gethilma.io.
9. Third-Party Services and Links
When you connect GitHub, Linear, Jira, or PostHog to the Service, those platforms' own privacy policies govern how they process your data. Hilma accesses only the data necessary to provide the Service, and does not store data from those services beyond what is needed for the evaluation.
10. Children
The Service is not directed at or intended for use by anyone under 18 years of age. We do not knowingly collect personal data from children.
11. Changes to This Policy
We will notify you by email of material changes to this Privacy Policy at least 14 days before they take effect. The "last updated" date at the top of this page reflects the most recent version.
12. Contact and Data Controller
Data controller: Grundbulten 161704 AB
Org. nr 559590-2999
Redargatan 6, 120 61 Stockholm, Sweden
hello@gethilma.io