Privacy Policy
Last updated: October 1, 2026
This Privacy Policy describes how Gorilli ("we", "us", or "our") collects, uses, and protects your personal information when you use the Engammo platform (the "Service"). We are committed to protecting your privacy and handling your data transparently.
1. Information We Collect
Account Information
When you sign up through GitHub OAuth, we receive your GitHub profile information including your name, email address, username, and avatar URL. You can also sign up with an email magic link, in which case we store your email address. We store the GitHub OAuth access token issued at sign-in. We use this information to create and manage your Engammo account.
Repository and Pull Request Data
When you connect repositories to Engammo, we access pull request data from those repositories including PR titles, descriptions, labels, timestamps, author information, commit metadata, and changed files. This data is used to generate release notes. We also store the GitHub webhook event payloads we receive, for debugging and auditing.
Diffs are processed in memory and are not stored as raw diffs. When AI summaries are enabled, diff excerpts (up to about 4,000 characters per pull request) are sent to OpenAI to generate the summary. We store generated release note content, PR metadata, and webhook payloads.
Billing Information
Payments are processed by Stripe. We store your Stripe customer and subscription identifiers, but never your card details.
Usage Data
We use Umami to measure pages visited, referrers, and sign-up and login events. If you accept optional cookies, DataFast also measures unique visitors. DataFast records visits from AI crawlers to our site on the server, without cookies. We do not use advertising trackers.
Chat Widget
Our support chat is provided by Kommander.ai and loads on every page. When it loads, it receives your name, email address, and account identifiers (user, workspace, role, and plan) if you are signed in; browser details (user agent, language, timezone, and screen size); the current page and referrer; and an anonymous visitor ID. The visitor ID is stored in your browser only if you accept optional cookies; otherwise it lasts for the current page view.
Error Reports
When the Service encounters an error, error details (which may include request context) are sent to Bananaloop so we can fix the problem.
What We Do Not Collect
- Full source files or clones of your repositories
- Data from repositories not explicitly connected to Engammo
- CI/CD pipeline data or deployment artifacts
2. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the Service
- Generate AI-powered release notes, translations, and FAQs from your pull request data
- Manage your account and subscription
- Send transactional emails (sign-in links, invitations, account notifications); billing receipts are sent by Stripe
- Respond to support requests
- Analyze usage patterns to improve the product
We do not use your pull request data or generated release notes to train AI models. Your data is used exclusively to provide the Service to you.
3. Data Storage and Security
Your data is stored with Vercel (application hosting) and MongoDB (database). Data is encrypted in transit and encrypted at rest by our database provider. Integration credentials are additionally encrypted with AES-256-GCM.
Access to production systems is limited to the Engammo team.
4. Data Sharing and Sub-processors
We do not sell your personal information or share it with third parties for marketing purposes. We share data with the following service providers, who process it on our behalf:
- Vercel: application hosting and content delivery
- MongoDB: database
- OpenAI: release note summaries, translations, and FAQ search embeddings
- Anthropic: FAQ generation
- Resend: transactional email
- Stripe: payments and billing
- Umami and DataFast: website analytics
- Kommander.ai: support chat widget
- Bananaloop: error monitoring
- GitHub: sign-in and the source of pull request data
Only the pull request data needed for generation is sent to OpenAI and Anthropic. Under their API terms, these providers do not use API data to train their models and keep it only for a limited period (typically up to 30 days) for abuse monitoring.
If you enable the Kommander integration for a repository, the FAQs generated from your release notes are sent to your own Kommander account.
We may also disclose data if required by law, court order, or governmental regulation.
5. Data Retention
We retain your account data, generated release notes, and webhook payloads for as long as your account is active. If you cancel a paid subscription, your data is kept until you delete your workspace or ask us to delete it.
Workspace owners can delete a workspace and its release notes, repositories, and FAQs at any time from Settings. To delete your account and all associated data, contact us at [email protected]. We will process deletion requests within 30 days.
6. Your Rights
Depending on your jurisdiction, you may have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data
- Export your data in a portable format
- Object to or restrict certain processing of your data
- Withdraw consent where processing is based on consent
To exercise any of these rights, contact us at [email protected]. We will respond to requests within 30 days.
7. Cookies and Local Storage
We use an essential cookie to keep you signed in, and we remember your cookie choice in your browser. Umami does not use cookies. Optional storage is used only if you accept it in our cookie banner: DataFast analytics cookies to count unique visitors, and a persistent anonymous visitor ID for our chat widget (Kommander.ai). You can change your choice at any time with the "Cookie settings" link in the footer, and you can clear cookies and local storage in your browser settings.
8. International Data Transfers
Your data may be processed in countries outside your country of residence. When we transfer data internationally, we ensure appropriate safeguards are in place, including standard contractual clauses approved by relevant data protection authorities.
9. Children's Privacy
The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 30 days before they take effect. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
11. Contact
For questions about this Privacy Policy or our data practices, contact us at [email protected].