Who operates Ernest
Ernest is operated by CHNY SOFTWARE, a French SASU registered with the Paris RCS under SIREN 100 333 053, with registered office at 1 rue Marguerin, 75014 Paris, France. CHNY SOFTWARE uses Kubeply as its company and product studio brand, and Ernest as the product brand for this PR review service. This policy applies to Ernest and to related Kubeply communications about Ernest.
Information we collect
We collect the information needed to operate Ernest, invite teams into the beta, inspect code changes, and support users.
- Waitlist and contact data, such as work email, name, company, and messages you send to us.
- Account and workspace data, such as organization names, repository names, installation identifiers, roles, and integration settings.
- GitHub data needed for review, such as pull request metadata, changed file paths, diffs, comments, checks, CI status, repository guidance, and policy files.
- Slack data needed for chat workflows, such as workspace identifiers, channel names, user mentions, commands, message content addressed to Ernest, and Ernest responses.
- Inspection data, such as execution logs, selected commands, test results, findings, evidence, confidence signals, and review summaries.
- Technical data, such as IP address, browser and device metadata, request logs, error logs, security events, and cookie or local storage data required to run the website.
How we use information
- Provide the website, waitlist, private beta, CLI, GitHub App, Slack workflows, and support.
- Inspect pull requests and local changes, generate findings, post checks or comments, and preserve review evidence.
- Operate, secure, debug, and improve Ernest, including abuse prevention, reliability work, and product analytics.
- Communicate about beta access, product updates, operational notices, and support requests.
- Comply with legal obligations and enforce our terms.
Legal bases
When European privacy law applies, we process personal data to perform a contract or take steps before entering one, based on legitimate interests in operating and securing Ernest, with consent where required for optional communications or analytics, and to comply with legal obligations.
How we share information
We do not sell personal information. We may share information with infrastructure, hosting, observability, email, security, payment, and support providers that help us operate Ernest; with GitHub, Slack, or other integrations you connect; with professional advisers; or where required for legal, safety, or corporate transaction reasons.
Model providers
Ernest may send prompts, pull request context, repository excerpts, logs, Slack messages addressed to Ernest, and inspection evidence to model providers when needed to produce a review. We configure model providers not to use Ernest customer data to train their models where provider controls are available.
Repository and code data
Ernest processes repository content only to provide the requested inspection, reproduce evidence, improve review quality, secure the service, and support your team. You should not connect repositories or channels that you are not authorized to share with Ernest.
Retention
- Waitlist and contact data is kept until you ask us to delete it or for up to 24 months after the last meaningful interaction.
- Account, workspace, and integration settings are kept while the account or installation is active, then normally deleted or anonymized within 90 days after closure.
- Inspection artifacts, review outputs, prompts, evidence, and execution logs are kept for up to 180 days by default during private beta, unless a separate agreement sets a different period.
- Operational logs are normally kept for up to 90 days. Security logs may be kept for up to 12 months when needed to investigate abuse, incidents, or legal claims.
- Backups expire on their normal rotation schedule, usually within 90 days.
- Billing, tax, legal, and dispute records may be kept for the period required by law.
Cookies and analytics
Ernest uses cookies or local storage that are necessary to operate the website and product. If we add optional analytics such as PostHog, we will ask for consent where required and provide a way to refuse or withdraw that consent.
Security
Ernest is designed around scoped integrations, bounded inspection, and separation between product control surfaces and repository execution. No system is perfectly secure, so teams should use least-privilege installation settings and avoid sending secrets or sensitive personal data unless necessary for the inspection.
Automated decisions
Ernest generates review output, findings, and risk signals, but it does not make fully automated legal or similarly significant decisions about you. Your team remains responsible for merge, deploy, access, employment, security, and operational decisions.
Business customers and DPA
When Ernest processes personal data on behalf of a business customer, the customer may act as controller and CHNY SOFTWARE may act as processor. In that case, a Data Processing Addendum or separate written agreement may apply and will control where it conflicts with this policy.
International transfers
Ernest may use providers located outside the European Economic Area. Where required, we rely on appropriate safeguards such as adequacy decisions, standard contractual clauses, or equivalent contractual protections.
Your choices and rights
Depending on where you live, you may have rights to access, correct, delete, export, restrict, object to, or withdraw consent for the processing of your personal data. To make a request, contact us at [email protected]. If you are in France, you may also file a complaint with the CNIL. If you are elsewhere in the European Union, you may contact your local data protection authority.
Changes
We may update this policy as Ernest changes. If an update materially changes how we handle personal information, we will take reasonable steps to notify affected users.