Privacy Policy
CustomerShip helps app owners collect feature and bug reports from their own customers and turn approved ones into shipped code. This page explains what we collect from each of the two kinds of people who touch the product, why, and how to control or remove it.
Who this covers
- Owners — the businesses and developers who sign up, connect a repository, and manage requests from their dashboard.
- Requesters — the owner's own customers, who submit a request through an embedded widget or a hosted page. A requester never creates a CustomerShip account.
What we collect
From an owner, when they sign up and use the dashboard:
- Email address, and an OAuth identity if signing in with Google or GitHub.
- Connected repository metadata (provider, path, delivery mode) — never the repository's source code at rest.
- Billing information, handled entirely by Stripe — we never see or store card details ourselves.
From a requester, only when they submit a request:
- The request text itself (up to 1000 characters), and whether it's a feature, a bug, or something else.
- An email address and update preference, both entirely optional, and only used to notify that requester about that one request if they asked for it.
- The page the widget was embedded on, and, for abuse prevention only, the submitting IP address.
How it's used
- Request text is automatically screened and graded — a mix of hardcoded rules and AI models (via AWS Bedrock) — to catch spam or abusive submissions and estimate effort before an owner ships it. Every request's text and, when a repository is connected, a profile of that repository, may be processed by these models for this purpose. This is quality triage, not a decision made about any person.
- If an owner approves a request, the connected repository is checked out into an isolated, sandboxed environment to make the change, then discarded — nothing about the repository's contents is kept afterward beyond the change itself, delivered as a pull request or a direct commit.
- Emails we send are limited to sign-in links and, only if both the owner and the requester opted in, a notice once a specific request ships. Any recipient can unsubscribe from that second kind at any time.
How long we keep it
A submitted request that never gets actioned expires automatically — 30 days on a Free plan, longer (configurable up to 365 days) on a paid plan. Job records — the record of one shipped change — expire 30 days after completion. Deleting an app or a whole account removes everything tied to it immediately and irreversibly, from the owner's own settings.
Who else sees it
We use a small number of infrastructure providers to run the product: AWS (hosting, storage, and the AI models used for triage), Stripe (payments), and GitHub or GitLab (repository access, only for repositories an owner has explicitly connected). We don't sell personal data, and we don't use it for advertising.
Where it's processed
Data is stored and processed on AWS infrastructure in the United States. If you're contacting us from elsewhere, this means your data is transferred internationally to be processed; we rely on our providers' own standard safeguards for that transfer.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, or ask for it to be deleted. An owner can already do most of this directly — exporting or deleting an app or account from their own settings — without waiting on us. For anything else, or if you're a requester rather than an owner, email privacy@customership.bauk.uk.
Cookies
We set one functional cookie to keep an owner signed in. We don't use advertising or third-party tracking cookies.
Children
CustomerShip isn't directed at, or knowingly used to collect data from, children.
Changes to this policy
If we make a material change to this policy, we'll update the effective date above and, for signed-in owners, note it in the product.
Contact
Questions about this policy or your data: privacy@customership.bauk.uk.