Privacy Policy
TeamFlow manages your AI software factory. It works from reports about work, not from the work itself. This page says exactly what that means: what we hold, what a report can never carry, where it lives, who else touches it and what you can ask us to do with it.
Effective 25 September 2026 Last updated 26 September 2026 Applies to codercat.io and the TeamFlow service
1. Who is responsible
TeamFlow is made and operated by Macleod Labs FZ-LLC (registration number 0000004088182), of CWEP4972, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates.
For your account and billing details, Macleod Labs FZ-LLC is the controller: we decide what to hold and why. For the delivery reports your organisation sends us, your organisation decides what its people and agents report, and we hold it on their behalf as a processor. A written data processing agreement for organisations is available on request. Write to macleod@macleodlabs.ai.
You can reach us about anything on this page at macleod@macleodlabs.ai.
2. What we collect and why
Account and organisation
When you sign up we hold your email address and your organisation name. The first person to sign up creates the organisation and becomes its owner. The organisation's domain is taken from the owner's email domain, and the organisation's icon is fetched from that domain when the organisation is displayed. We need this to give you an account, to tell one organisation's board from another's, and to email you about the service.
Sign-in identity
Sign-in runs through Amazon Cognito. You can sign in with a passkey, with a one-time code emailed to you, or through Google or GitHub. When you use Google or GitHub we receive only your email address and name from them, never your password and never any other part of your account there. A passkey's private key never leaves your device; we hold only the public credential needed to check a signature. We do not hold passwords.
Payment
Stripe takes and processes every payment. TeamFlow never sees or stores card numbers. We hold what Stripe tells us about the subscription: the Stripe customer and subscription identifiers, the plan, the billing period, whether the subscription is paid, and the seats that follow from it.
If you buy TeamFlow on AWS Marketplace. Amazon Web Services takes your payment, not us. AWS tells us your AWS account ID, your customer ID, your licence and agreement IDs, and what you bought: the plan, the number of seats and the end date. We use this only to open your plan, count your seats and show your subscription in TeamFlow. We never get your card or bank details. We keep these details while your plan runs and as long as tax law needs billing records. AWS's own privacy notice covers what AWS holds: aws.amazon.com/privacy.
Delivery reports
The TeamFlow plugin in your editor and the CI reporters write a small, fixed set of derived facts about an issue's current state. The published reporting contract is an allowlist: the service drops any field it does not recognise rather than storing it, and answers with a list of what it dropped. A report may carry only:
- the organisation's tenant identifier, and the tracker the issue lives in (Jira, Linear or GitHub);
- the issue key, its link and its short title and status, plus parent and related issue keys;
- the actor who did the work, the repository and the branch;
- the normalised stage and status, any rework origin and loop count;
- a concise derived summary of the state, capped at 180 characters;
- compact evidence counts and references, execution identifiers and kinds;
- timestamps.
We hold this because it draws your board, your delivery rail and your activity feed.
Service logs and usage
Our servers keep ordinary operational logs: the time of a request, the route it hit, the response status, the size and duration, the account behind the credential, and the network address it came from. We use these to keep the service up, to find faults and to stop abuse. We count how many reports an account has sent so that we can tell ordinary heavy use from abuse; a repeated report whose content has not changed is recognised as the same report and is not counted again.
Sign-up checks
We check each new sign-up to keep out automated and fake accounts. The check reads the organisation name, the email address and its domain, the website you give, the time of the sign-up and the network address it came from. We may ask you to confirm your email address before your organisation opens. If a sign-up looks automated, we may refuse it, and we may block its email address and network address from signing up again. We rely on legitimate interests for this check: it keeps the service safe for real customers.
Our team may add short internal notes to an organisation, a refused sign-up or a block. We use these notes only to run the service. We never show them to other customers and never use them to train anything.
3. What we never collect
This is the part of the policy worth reading twice, because it is enforced by the service and not only promised here. A report is never allowed to persist:
- prompts or transcripts;
- source contents or diffs;
- raw shell commands or tool output;
- secrets;
- issue descriptions, comments or attachments;
- raw CI or test logs.
When you open a card, TeamFlow reads its comments from your tracker and shows them to you. It never stores them.
Because unknown fields are dropped rather than rejected, a reporter that is modified, or talked into attaching a prompt or a diff under a new name, still cannot make that content reach the store. We publish the full allowlist at llms.txt and on the capabilities route, so you can check the rule rather than take our word for it.
You have full control over your data
- It stays in your organisation. Your TeamFlow data is never shared outside your organisation. We never sell it, share it, or use it to train anything for anyone else.
- It is encrypted. Everything is encrypted at rest and in transit. Agent view conversations also use a key that belongs to your organisation alone.
- Streaming is strictly opt-in. Agent view is off until your organisation's owner or an admin turns it on, and each person must also turn it on for their own machine. Then TeamFlow keeps your agents' conversations for 7 days.
- Your admins decide who reads what. Each developer can read their own conversations. Owners and admins choose who else can read them, and can turn Agent view off at any time. That deletes every stored conversation at once.
- Secrets never leave your machine. Code and tool output stay masked unless your organisation's settings allow them.
- You see every support read. Our support team can read your conversations only to help with a problem. Each time, they must give a reason, the access ends after one hour, and your owners and admins see the read and its reason.
Test videos go from your machine straight to your own tracker, and never pass through TeamFlow.
We also run no analytics, no advertising, no tracking pixels and no third-party scripts on this website.
4. Where it is stored
TeamFlow's own data, including accounts, organisations and every delivery report, is stored on Amazon Web Services in the eu-west-1 region (Ireland).
Some of the companies listed below operate outside the United Kingdom and the European Economic Area, so payment and sign-in data may be processed elsewhere. The transfer safeguard we rely on for each of them is the European Commission’s Standard Contractual Clauses, with the UK Addendum for UK data.
5. Who processes it
We keep this list short on purpose. Every company here does one job for us and gets only what that job needs.
| Who | What they do | What they get |
|---|---|---|
| Amazon Web Services | Hosting, storage and the service itself, in eu-west-1 | Everything described in section 2 |
| Amazon Cognito | Sign-in and session tokens | Email address, name, passkey public credential |
| Resend, Inc. | Processor for transactional email: sends sign-in links, invite codes and member invites from macleod@macleodlabs.ai | Recipient address, subject and message body of sign-in and invite emails |
| Stripe | Takes payment and runs subscriptions | Email address, organisation name, payment details you give Stripe |
| Optional sign-in provider; serves the site's web fonts | Email address and name on sign-in; your network address when a font or an organisation icon is fetched | |
| GitHub | Optional sign-in provider; issues the CI identity token | Email address and name on sign-in; the workflow identity behind a CI report |
We do not sell personal data, and we do not share it for advertising.
How the troubleshooting classifier uses your data. TeamFlow's troubleshooting classifier learns from your organisation's own data, and never shares it. It uses what it learns only to improve the decisions it makes for your organisation.
TeamFlow keeps that learning apart from every other organisation. An owner or admin can switch the learning off at any time. TeamFlow then uses a general autofix method and deletes what it learned from your data.
Here, “your data” means the derived state TeamFlow already holds: stages, statuses, check results, decisions and their outcomes. It never means code, prompts or files. These never reach TeamFlow.
6. How long we keep it
- Account and organisation data is kept for as long as the organisation exists, and for 30 days after you ask us to delete it. After that it is removed from live systems.
- Delivery reports are kept until your organisation deletes them or until the organisation is archived. An organisation is archived when its last member leaves; its data stays readable to its administrators rather than being destroyed, so that a team that merges into another does not lose its history.
- Billing records are kept for as long as tax and accounting law requires, which is 5 years.
- Service logs are kept for 30 days and then deleted.
- Agent view conversations are kept for 7 days, then deleted. Turning agent view off deletes them at once.
- Sign-up checks. A sign-up that waits for its confirmation email is deleted when its link runs out, after 48 hours at most. The record of a refused sign-up, and a blocked email address or network address, are kept for 30 days at most and then deleted. We can remove a block sooner.
Backups are overwritten on their own cycle, so a deleted record can survive in a backup for a short time after it leaves the live service.
7. Owners, members and your organisation
TeamFlow is bought and used by teams, so some of your data is visible to the people you work with. Be clear about what that means before you invite anyone.
The reports in an organisation are visible to that organisation's members, including the actor name attached to each one. The owner administers the organisation: they invite people, remove them, and can see and delete the organisation's reports. Joining is invite-only, and the tenant a report lands in comes from the credential that sent it rather than from the report itself, so one organisation cannot address, read or write another's data.
If you are a member rather than an owner and you want your data changed or removed, ask your owner first, because they decide what their organisation reports. You can always come to us directly if that does not work.
9. Your rights
Under the UK GDPR and the EU GDPR you have the right to ask us for a copy of your personal data, to have it corrected, to have it deleted, to receive it in a portable form, to restrict or object to how we use it, and to withdraw consent where we relied on it. Write to us at macleod@macleodlabs.ai and we will answer within one month.
We rely on contract as our lawful basis for running your account and taking payment, on legitimate interests for keeping the service secure and working, and on legal obligation for keeping billing records.
If you think we have handled your data badly, please tell us first so we can fix it. You can also complain to the Information Commissioner's Office at ico.org.uk, or to the supervisory authority in the EU country where you live or work.
10. Security
Everything travels over TLS. Reporters authenticate with short-lived tokens rather than long-lived keys: a person signs in once, and a CI job exchanges the identity token its workflow already has. Long-lived organisation keys exist only as a documented fallback for setups that cannot sign in. Our own secrets are held in AWS Systems Manager Parameter Store and never in the repository.
Tenant isolation is structural rather than a setting: the account behind a credential owns the tenant, and a tenant named in a request body is ignored.
11. Children
TeamFlow is a tool for workplaces. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, tell us and we will delete it.
12. Changes to this policy
When we change this policy we update the effective date at the top of the page. If a change materially affects what we collect or who we share it with, we will email the owner of every organisation before it takes effect.
13. Contact us
Questions, requests and complaints about privacy go to macleod@macleodlabs.ai, by phone on +971 58 633 0035, or by post to CWEP4972, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates. Our Terms of Service cover the rest of the relationship.