Data processing terms

Last updated: 4 November 2026

These data processing terms ("DPA") form part of the terms of service between Sakuraj Technologies Private Limited ("processor", "we") and the organisation using ALIGN ("customer", "you"). They apply whenever we process personal data contained in customer data on your behalf. If they conflict with the terms, this DPA wins for personal data.

1. Roles

You are the controller (or a processor acting for your own controller) of personal data in customer data. We process it as your processor, only on your documented instructions. These terms, your configuration of the service and the actions of your members are your instructions. We will tell you if we think an instruction breaks data protection law.

2. Subject matter, duration, nature and purpose

• Subject matter: providing the service: capturing, compiling, storing, checking and serving decisions from your connected repositories and tools.
• Duration: the term of the agreement, plus the deletion periods below.
• Nature: collection, redaction, storage, model processing, retrieval, display, export and deletion.
• Purpose: only to provide, secure and support the service for you.

3. Data subjects and categories of data

Data subjects are your members and the people named in the content your members capture (for example in conversation text, commit messages, pull requests, Slack messages or Linear issues). The categories of data, their sources and their retention are:

We never collect:

File contents (including what an agent read or wrote through tools), the shell commands tools run and their output, diffs from your laptop, fenced code blocks, environment variables or .env files, secrets matching the redaction rules, keystrokes, screen contents, hostnames (only the salted hash above), OS usernames, IP addresses in event payloads, paths outside the repository, data from repositories that are not connected and opted in, Slack channel history, per-person productivity metrics.

4. Our obligations

• Confidentiality. Everyone who can access personal data is bound to confidentiality.
• Security. We keep the technical and organisational measures in section 8 and on the security page, and may improve them but not reduce their overall protection.
• Assistance. We help you answer requests from data subjects and meet your obligations on security, breach notification, impact assessments and consultations, taking into account the information we have.
• Breaches. We notify you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your data, with what we know and what we are doing about it.
• Deletion. At the end of the service, or when you delete your organisation, we delete customer data: a 7-day grace period you can cancel, deletion within 24 hours after it, and backups and point-in-time recovery logs age out within 7 more days. You can export your ledger before then.
• Records and audits. We make available the information needed to show compliance with this DPA and answer reasonable written audit questions once a year, or after a breach.

5. Subprocessors

You authorise the subprocessors listed on the subprocessors page. We bind each to data protection terms at least as protective as these, and remain responsible for them. We will announce a new subprocessor on that page and by email to owners at least 14 days before it processes your data; you may object on reasonable grounds, and if we cannot resolve the objection you may end the affected service and receive a refund of prepaid fees for it.

6. International transfers

Data at rest is stored in the United States (Google Cloud us-central1, Iowa). Model requests may be processed in any Google region; we store nothing there. Where personal data leaves the European Economic Area, the United Kingdom or Switzerland for a country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (module two, controller to processor, or module three, processor to processor), with the UK addendum where relevant, which are incorporated by reference; the details they need are in this DPA.

7. Model processing

Redacted conversation text, redacted pull-request hunks, and the Slack questions and Linear issue text that come from tools your organisation connects (redacted again on our servers) are processed by Google's Gemini models on Google Cloud's Agent Platform, which does not use them to train models under Google Cloud's terms. We do not use customer data to train or to evaluate models; if that ever changed, the subprocessor list would change first, with the notice in section 5.

8. Security measures

1. Scope by repository. Capture happens only in repositories the organisation connected and the developer opted into. Personal repositories never report. align status shows the scope; align off stops capture for this repository immediately, locally and on the server.
2. Redact on the laptop. Everything that could leave the machine passes the redaction engine first: transcripts, commit messages, and every argument of align decide, align ask and the MCP tools. File contents never leave, including anything the agent read or wrote through tools: transcripts carry the user's and the agent's words only, fenced code blocks become ‹code: N lines›, and every tool call becomes ‹tool: <name>, <bytes> bytes› plus the repository-relative paths it touched. Tool outputs, diffs from your laptop and the shell commands tools run are never captured. Text you paste without a code fence is sent after secret redaction. The server redacts everything again, including GitHub, Slack and Linear text, before it stores it or sends it to a model.
3. You see everything about you, and you can delete it. align sessions lists what was kept; align sessions rm <id> deletes a session and everything derived only from it: its lines and events, the quotes taken from it, and the wording of proposals nobody confirmed. Proposals from your sessions are visible only to you until you confirm them, share them, or they appear in a pull request you opened. Teammates never read your raw transcripts; they see only the short quotes that support a confirmed decision.
4. The organisation owns the ledger; sources keep their permissions. A person sees an entry only if they can access its repository; a receipt from a private Slack channel is visible only to that channel's members.
5. No scoring of people. No per-developer productivity metrics in the product, analytics, logs or exports. Seat counts for billing are aggregates. Every change goes through automated review and CI before it ships.
6. Retention by default. Raw events and transcript lines are kept 90 days, then deleted unless a receipt cites them. Deleting an organisation starts a 7-day grace period you can cancel; deletion then completes within 24 hours, and backups age out within 7 more days.

Also: encryption in transit and at rest; connector tokens encrypted with Cloud KMS and keys held in Secret Manager; row-level security on every table, with repository access checked on every read; sign-in without passwords and with hashed, expiring, revocable session tokens; logs and error reports without content; production changed only through releases a person promotes.

9. Contact

Questions about this DPA: privacy@bharatreachdsp.com.