Coreload: GitHub Actions runners Coreload Privacy Policy

What we collect, and why

• From GitHub, when you install the App: your organization's name and id, the installation id, the repositories you chose and the account that installed it. We use them to set up and run your runners.
• From each job: its job and run ids, the repository name, its labels, timings, the runner name and the outcome. We use them to run the job, to bill it and to keep the service working.
• When you sign in to the dashboard with GitHub: your GitHub login and the list of your App installations that GitHub gives us, held in a session behind a cookie, so that we can show you your organizations.
• When you visit coreload.com: if you accept analytics in our cookie banner, we record which pages you view, what you click, errors your browser hits, and recordings of your session with every form field masked. We never record billing, top-up, API-key or settings pages. We use PostHog (US Cloud, in the United States) for this. Until you accept, we still record which pages you view and leave, your clicks and other interactions (such as where on a page you click and when you submit a form) and errors your browser hits, without cookies, without recording, and without linking one page to the next.
• How you found us (attribution): if you accept analytics, we keep a first-party cookie named cl_attr on coreload.com for 90 days. It records the first and the most recent way you reached us: the source and campaign named in the link (for example a newsletter or a post), our short-link code, the host name of the site that referred you (never the full address), and the time. Our short links (go.coreload.com) run on Dub. Dub counts each click, with the time, country, device and browser type. When you install the GitHub App, those fields can go with the installation and be stored on your organization's record. If you have not accepted analytics, nothing is stored in your browser, and only the link fields of the page you install from go with the installation. We use these fields only to learn which channels bring customers, never to advertise to you.
• For billing: Stripe, our payment processor, takes your payments; we never see or store your card number. At your first top-up, Stripe's checkout asks for your billing name and address, and your tax ID if you have one, and saves them with your Stripe customer record. From Stripe we keep your Stripe customer id, your billing email, name and address, your top-ups and credit balance, and a fingerprint of the paying card (an identifier Stripe derives from the card, not the card number), which we use to give each promotional offer only once per card. If Stripe warns us that a payment may be fraudulent, or tells us of a dispute, we receive that notice, which names the payment and the reason; our service logs record that it arrived, not what it says. Stripe's own use of your payment details is governed by Stripe's privacy policy.
• To prevent abuse of promotional credit: when we review an organization for abuse, we may look at public facts about its GitHub organization (its age, workflow files, recent Actions runs, public repositories, stars and members), at whether its billing email's domain is a company, webmail or disposable one, and at our own usage records. A review can only pause promotional credit.
• When you write to us: your name, your email address and what you send.

Our legal basis

Where the GDPR or a law like it applies, we rely on these legal bases:

• To perform our contract with you: setting up and running your runners, jobs and sandboxes, with the records of your work, runners and dispatch, the job events in our queues and the files your jobs save for later jobs; your usage records, billing you and your dashboard's job history; your dashboard sign-in; and answering you when you write to us as a customer.
• Our legitimate interests (you may object to any of these by writing to hello@coreload.com):
  • keeping the service secure and working: our service logs, the machines' own system logs, our cloud account's audit log, the top-up attempt counters, the records of which of our machines served your organization, and the records left behind when a machine, a job or a dispatcher stops before reporting back;
  • preventing fraud and abuse: the fraud warnings and disputes our payment processor sends us, card fingerprints and our reviews for abuse of promotional credit;
  • learning how people find and use our site: what we record before you accept analytics (page views and leaves, clicks and other interactions, and browser errors), without cookies; Dub's count of each short-link click; and the link fields that go with an installation when you have not accepted analytics;
  • keeping your installation and organization records after you uninstall, until you ask us to delete them, so that we can answer questions and claims about your use of the service;
  • answering anyone who writes to us without a contract with us.
• Your consent: analytics, session recordings and the cl_attr cookie, only after you accept them in our cookie banner. You can withdraw it at any time with "Cookie settings"; that does not affect what was done before.
• A legal obligation: keeping billing and tax records as tax and accounting law requires, and any message the law requires us to keep.

What we do not keep

• Your secrets. A secret your workflow passes to a job is visible inside that job's VM while it runs, and is destroyed with the VM.
• Your code, build files and outputs. They live in the VM and are destroyed with it: a hosted-CI VM when its job ends, a sandbox when you destroy it or its time limit ends. Files a job chooses to save for later jobs are the exception, kept as "How long we keep it" says. While a sandbox lives, our sandbox service keeps each command's output in its memory so that you can read it, until newer output needs the space or the service restarts.
• Your hosted-CI job logs and artifacts. They stay on GitHub; we do not download them.

We do not sell personal data, use it for advertising, or use it to train models.

Who else handles it

These providers run the service for us, each with the data its work needs:

• A bare-metal hosting provider based in the European Union (name available on request): rents the machines the job VMs run on, and so handles everything a job processes while it runs, in France and Canada.
• Amazon Web Services: runs our control plane (job dispatch, state, usage records and service logs), in the United States.
• GitHub: delivers your jobs to our runners through your installation.
• Stripe: processes payments, with your billing contact and payment details.
• Google: our email (Google Workspace), and a public mirror of Docker Hub images that jobs pull.
• Cloudflare: hosts our website and domain, and stores the files jobs save for later jobs, encrypted, in the European Union.
• PostHog (US Cloud, in the United States): product analytics on coreload.com (without cookies until you accept analytics) and, after you accept, session recordings.
• Dub (dub.co): our short links, and their click counts.
• Mintlify: hosts our documentation at docs.coreload.com, and so sees its visitors' requests.

We share personal data with others only where the law requires it, or with a successor if our business is sold or merged.

How long we keep it

• Service logs, which include the job records above: 30 days.
• Dashboard sessions: eight hours.
• Top-up attempt counters (per IP address and per installation, which limit abuse of the top-up page): they expire within 30 minutes.
• The cl_attr cookie: 90 days in your browser, renewed when you arrive through a new link. It is deleted if you decline analytics in the banner.
• Analytics events and session recordings in PostHog: events for up to one year and recordings for up to 30 days. Attribution fields stored with your organization's record are kept as long as that record.
• Short-link clicks counted by Dub: Dub keeps click counts for 30 days.
• The machines' own system logs, which can name your organization: until newer entries need the space, and in any case until the machine is wiped when it leaves service.
• Usage records for billing: each job's usage record, 396 days; each VM's metering record (which organization it ran for, its VM id, when it started and stopped, and which machines reported it), 400 days; and each day's usage file per organization, which backs its invoices, with no end date.
• Billing records (top-ups, balances, invoices, and the billing name, address and tax ID kept with your Stripe customer record): as long as tax and accounting law requires.
• Card fingerprints and abuse-review records: with no fixed end date, so that an offer is given only once per card and per organization. You may ask us to delete them; we then stop giving that organization promotional credit.
• Installation and organization records: while the App is installed, and until you ask us to delete them after you uninstall it.
• Job events waiting in our queues: until they are processed, and at most fourteen days.
• Records of work, runners and dispatch (they name your organization, repositories and labels): most while their work, runner or dispatcher is active, and then at most 30 days after their last change. Some have no end date: counters of your organization's work and sandboxes, and records left behind when a machine, a job or a dispatcher stops before reporting back.
• Dashboard job history (a row for each of your organization's jobs, kept for the dashboard's pages, naming your organization and the job's repository, workflow, job, branch, label, run and job ids, size and result, with its times, cost and CPU and memory use): four hundred days. The results of the dashboard's queries over it: one to two days.
• Records of which of our machines served your organization: while the machine is in service, and an audit copy for one year.
• Our cloud account's audit log, whose request records can name your organization: four hundred days.
• Support messages: until the matter is closed and you ask us to delete them, or as long as the law requires.

If a job saves to our build cache, the cached files are readable only by your organization's jobs: on a shared machine they are kept for up to 25 hours unused, on a machine that serves only your organization until newer entries need the space, and in our cache storage for up to 30 days.

Security

We protect personal data with technical and organizational measures suited to the risk, and tell you without undue delay if a breach affects yours.

Your choices and rights

You can uninstall the App at any time, which stops new jobs. You can decline or withdraw analytics at any time with the "Cookie settings" link at the foot of every page on coreload.com. That deletes the cl_attr cookie and stops recording. Depending on where you live, you may have the right to access, correct, delete or move your personal data, and to object to or restrict how we use it. Write to hello@coreload.com and we will answer within one month. If you are in the European Economic Area, the United Kingdom or Switzerland, you may also complain to your data protection authority.

Where it is processed

Our control plane, where the records above are kept, runs on Amazon Web Services in the United States, and jobs run on bare-metal machines in France and Canada. Our other providers may process data in other countries, as their own terms say. Where data protection law requires a safeguard for a transfer to one of our providers, we rely on the safeguards in that provider's own data processing terms, such as the European Commission's Standard Contractual Clauses. If you need Standard Contractual Clauses with us for personal data inside your jobs, write to hello@coreload.com.

Changes

We publish each version of this policy on this page with its date, and tell you before a material change takes effect.

Contact

Coreload LLC, D81 Calle C, STE 301, Dorado, PR 00646. Email: hello@coreload.com.