Privacy notice
Gondolier is operated by Laputa Cloud Co ("we", "us"). This notice describes what we process to run the service and who to contact about it. It covers the hosted product at gondolier.dev and api.gondolier.dev.
What we process
- Account and session data: your email address and authentication session, via Supabase Auth.
- Tenant configuration: your organization, forge connection metadata (instance URL, bot username), and managed-repository settings.
- Forge credentials: your forge personal access token or OAuth token. It is encrypted at rest, is never returned by the API, and is decrypted in memory only for the duration of a single queue operation.
- Queue activity: merge and bounce events for repositories you manage, for the dashboard and audit history.
- Billing records: subscription and payment state, processed by Stripe. Gondolier does not store your card details.
- Optional product telemetry: anonymized usage events via PostHog, only when telemetry is enabled for your session.
Who else touches this data
We use a small set of service providers to run Gondolier:
- Cloudflare — hosting, compute (Workers), and the sell site (Pages).
- Supabase — database and authentication.
- Stripe — billing and payment processing.
- PostHog — optional product analytics.
- Resend — transactional email (sign-in links).
We have not published a certified subprocessor list, retention schedule, or data-transfer mechanism beyond what is stated here. If you need one of those for a compliance review, contact us below and we'll work through it with you directly rather than publish a claim we can't yet stand behind.
Your data, your control
To request a copy of your account data, or to permanently delete your account and its data, email gondolier@laputacloudco.com from the address on your account. We don't yet have a self-serve export or delete button in the dashboard, so this is handled by request.
Contact
Questions about this notice, or about your data: gondolier@laputacloudco.com.
This notice will be updated as the product and its data handling evolve. We'll change the effective date above when it does.