Privacy policy

Last updated: September 20, 2026

The privacy of your data—and it is your data, not ours!—is a big deal to us. In this policy, we lay out: what data we collect and why; how your data is handled; and your rights with respect to your data. We promise we never sell your data: never have, never will.

This policy applies to all products built and maintained by Smart IT Solutions EOOD including With1AI (all versions), the with1.ai website, the app.with1.ai web interface and their associated services (together, “With1AI”).

This policy applies to our handling of information about site visitors, prospective customers, and customers and authorized users (in relation to their procurement of the services and management of their relationship with With1AI). We refer collectively to these categories of individuals as “you” throughout this policy.

Our role: controller and processor

Two different kinds of data pass through With1AI, and the law treats them differently:

• Your account data (your name, email, billing records, how you use our website). For this data, Smart IT Solutions EOOD is the data controller under the General Data Protection Regulation (GDPR). This policy describes what we do with it.
• Your organization’s content (source code, issues, comments, Pull Requests and anything else your AI teammate reads or writes in the platforms you connect). This content belongs to you. Your organization is the controller and we act as a data processor, handling it only on your instructions to provide the service. If your content contains personal data of other people (for example, names in commit history or customer details in a ticket), you are responsible for having the right to share it with us. A Data Processing Agreement (DPA) is available on request at hello@with1.ai.

What we collect and why

Our guiding principle is to collect only what we need. Here’s what that means in practice:

Identity and access

When you sign up for With1AI, we ask for identifying information such as your name, email address, and company name. That’s so you can personalize your new account, and we can send you product updates and other essential information.

Crucially for our service, we also collect OAuth tokens and integration credentials for platforms like GitHub, Jira, Bitbucket, and GitLab. This is necessary for your AI teammate to read issues, access repositories, and open Pull Requests on your behalf. We securely store these credentials and only use them to perform the actions you authorize.

We’ll never sell your personal information to third parties, and we won’t use your name or company in marketing statements without your permission.

Your LLM API keys

With1AI works with the Large Language Model (LLM) provider you choose, using an API key that you bring from your own account with that provider. We store your key encrypted and use it only to run your organization’s tasks. We never use it for anyone else’s work or for our own purposes.

Source code and issue tracker data

With1AI integrates directly into your engineering workflows. To function as an AI teammate, the system reads context from your linked platforms, including:

• Issue descriptions and comments
• Source code repositories and file contents
• Pull Request diffs and reviews

This content inevitably includes some personal data, such as the usernames, names and email addresses of the people who wrote the commits, comments and reviews.

IMPORTANT: We do NOT use your source code, PRs, or tickets to train AI models.

Shared Memory: We retain context (such as code embeddings or summaries) securely in our databases to provide “Shared Memory” for your team. This means the AI can remember past decisions and context without needing to re-read everything. This data is strictly isolated to your organization and is never shared across different customers.

Execution logs: We keep logs of what your AI teammate did during a task (commands run, files changed, reasoning steps) so your team can review its work and we can debug failures. These logs are visible to your organization and isolated from other customers.

Billing information

If you sign up for a paid With1AI tier, you will be asked to provide your payment information and billing address. Credit card information is submitted directly to our payment processor, Stripe, and doesn’t hit With1AI servers. We store a record of the payment transaction (including the last 4 digits of the credit card number) for purposes of account history, invoicing, and billing support.

Website interactions

We do not currently run any analytics or tracking on with1.ai or app.with1.ai, and we set no advertising or tracking cookies. If we add analytics in the future, we will choose a privacy-respecting tool and update this policy before we switch it on.

One thing does happen when you load our pages: our sites are served by Cloudflare. Like any web host, Cloudflare processes your IP address and basic request information (browser type, requested page, time) to deliver the page and protect the site against abuse.

Correspondence

When you email us, we keep the message and your email address so we can reply and keep a history of the conversation.

Why we are allowed to process your data

Under the GDPR we need a legal basis for each use of your personal data. Ours are:

• To perform our contract with you: creating and running your account, connecting your integrations, running tasks, billing, and support.
• Our legitimate interests: keeping the service secure, preventing abuse, debugging, and serving and protecting our websites. We make sure these interests aren’t overridden by your rights.
• Legal obligations: keeping invoices and accounting records, and responding to lawful requests.
• Your consent: for anything optional, such as marketing emails. You can withdraw consent at any time.

When we access or disclose your information

To provide products or services you’ve requested. We use a small number of third-party subprocessors to help run our applications and provide the services to you:

• Cloudflare: hosting and delivery of our website and web interface.
• Stripe: payment processing.
• Hetzner: the dedicated servers that run our API, our databases and the virtual machines your AI teammate works in. These servers are located in the European Union.

Your LLM provider. To analyze code and generate solutions, With1AI sends the necessary context (prompts, code snippets, ticket information) to the LLM provider whose API key you connected. Because the key belongs to your account with that provider, the provider handles this data under your agreement with them, including their retention and model-training terms. They are your vendor, not our subprocessor. Please review your provider’s data policies and settings before connecting a key.

The platforms you connect. Your AI teammate posts comments, pushes commits and opens Pull Requests in GitHub, Jira, Bitbucket or GitLab at your direction. That content is then held by those platforms under their own terms.

No With1AI human looks at your source code or content except for limited purposes with your express permission, for example, if an error occurs that stops an automated process from working and requires manual intervention to fix a support case.

When required under applicable law. If we are compelled by legal process (such as a valid warrant or court order) to disclose data, we must comply. It is our policy to notify affected users before we disclose data unless we are legally prohibited from doing so.

If we are acquired or merged. If another company acquires With1AI, we will notify you before your information is transferred and becomes subject to a different privacy policy.

How we secure your data

Isolated VMs for Execution: With1AI executes code and background tasks inside secure, hardware-isolated cloud virtual machines (VMs) that are dedicated to a single organization. A VM may be reused for later tasks of the same organization, but it is never shared with other customers. This keeps each customer’s code and credentials separated and off your local machines.

All data is encrypted via SSL/TLS when transmitted between our servers, your browser and our third-party integrations. The database backups are also encrypted. In addition, we secure your data at rest using industry-standard encryption practices.

If we ever become aware of a breach affecting your data, we will notify you without undue delay, and notify the supervisory authority where the law requires it.

Data retention and deletion

We keep your information for the time necessary for the purposes for which it is processed:

• Organization content (OAuth tokens, LLM API keys, code embeddings, Shared Memory, execution logs): if you cancel your account, or uninstall our integration from your source control provider, this data is permanently deleted from our active systems within 30 days, and from our backups within 60 days.
• Account and contact details: for as long as your account is open, and deleted on the same schedule after you close it.
• Invoices and payment records: for as long as tax and accounting law requires us to keep them.
• Correspondence: for as long as needed to handle your request and keep a reasonable support history.

You have the right to request the deletion of your account and all associated data at any time by contacting us.

Your rights with respect to your information

Wherever you live, we extend the same rights to everyone. You have the right to:

• Know what personal information we hold about you, and to access a copy of it.
• Correct information that is inaccurate or incomplete.
• Delete your personal information.
• Export your information in a portable format.
• Restrict or object to our processing of your information.
• Withdraw consent where we rely on it.
• Not be discriminated against for exercising any of these rights.

To exercise a right, email hello@with1.ai. We will respond within one month. If your request concerns content inside your organization’s workspace, we may direct you to your organization’s administrator, since they control that data.

You also have the right to lodge a complaint with a data protection authority. Ours is the Bulgarian Commission for Personal Data Protection (cpdp.bg); you may also contact the authority in the EU country where you live or work.

Age requirement

With1AI is a tool for professional software teams. It is not intended for anyone under 18, and we do not knowingly collect personal information from children.

Location of site and data

Smart IT Solutions EOOD is headquartered in Bulgaria, in the European Union, and is governed by the GDPR.

Your organization’s content (source code, Shared Memory, execution logs, credentials) is stored and processed on our Hetzner servers in the European Union. Some of our service providers, such as Cloudflare and Stripe, operate globally, and the LLM provider you connect may process data wherever it operates. When we transfer personal data outside of the European Economic Area (EEA), we rely on an adequacy decision of the European Commission (such as the EU–U.S. Data Privacy Framework) or on appropriate safeguards such as Standard Contractual Clauses (SCCs) to protect your information.

Changes and questions

We may update this policy as needed to comply with relevant regulations and reflect any new practices. Whenever we make a significant change to our policies, we will refresh the date at the top of this page and take appropriate steps to notify account holders.

Have any questions, comments, or concerns about this privacy policy, your data, or your rights with respect to your information? Please get in touch by emailing us at hello@with1.ai or writing to us at:

Smart IT Solutions EOOD
VAT / Company Registration Number: BG204966981
Bulgaria, Pernik