Privacy Policy

Scope and operator

This Privacy Policy explains how MergeRamp handles personal information when you visit mergeramp.com and when you use the MergeRamp service, including the MergeRamp GitHub App.

Contact: [email protected].

Information collected

Website requests can include your IP address, browser and device information, requested URL, referral information, and request time. Hosting infrastructure may process this information to deliver the website, diagnose errors, and protect it from abuse.

We use PostHog to understand how MergeRamp is used. After you make a banner choice, PostHog records page views, clicks, and other interactions. If you reject cookies, it uses a privacy-preserving identifier calculated on its servers, without cookies or browser storage. It receives page and referrer URLs, including campaign parameters, and browser and device type. If you accept cookies, PostHog also uses cookies to recognise repeat visits and records sessions of how pages are used, with form inputs masked. IP addresses are discarded, and we do not link website analytics to your identity.

When you use the MergeRamp service, we also collect:

• Your GitHub user identifier and username when you sign in, organization membership and role, and the session information needed to keep you signed in securely.
• Data from the organizations and repositories you connect, limited to what the permissions you grant the GitHub App allow, such as organization and repository identifiers, repository names, branches, pull requests, commit identifiers, and check results.
• Billing information, such as your plan, trial dates, Stripe customer and subscription identifiers, and payment or subscription status. Card details are handled by Stripe, and we never see full card numbers.
• Messages you send us, including the contact information and content you choose to provide.

Why information is used

We use account, repository, and billing information to provide MergeRamp, process payments, keep the service secure, and support you. We rely on the need to perform our contract with you or your organization, and on our legal obligations for billing and tax records. When we process data about other people, such as contributors to a connected repository, we do so on behalf of the organization that connected it. We use messages you send us to respond to your questions and support requests, relying on our legitimate interests in communicating with you.

We process technical request data to deliver and secure the website and the service, and anonymous analytics to understand how they are used. In both cases we rely on our legitimate interests in running and improving the website and the service. Cookies, session recordings, and heatmaps are used only if you accept them, and you can change that at any time using Cookie settings in the footer.

Cookies and browser storage

We set one strictly necessary cookie, mergeramp_consent, to remember your choice for 12 months. When you sign in to MergeRamp, we also set strictly necessary cookies to secure the sign-in process and keep you signed in. Anonymous analytics uses no cookies or browser storage. If you accept cookies, PostHog sets cookies and browser storage entries to recognise repeat visits and support session recordings and heatmaps. Cookies last up to 12 months; browser storage remains until you clear it or reject cookies. They are used only by us to improve MergeRamp, never for advertising.

You can use your browser settings to block or clear cookies and site storage. Clearing storage may reset browser identifiers; it does not erase information already received by a provider.

Providers and disclosure

Vercel hosts the MergeRamp website, Cloudflare Workers runs the backend that processes GitHub events and coordinates merge queues, and PostHog provides analytics. These providers act as our processors. Stripe processes payments and acts as an independent controller for payment data. GitHub provides the data you choose to connect, and its own terms apply to your GitHub account. Each provider’s privacy notice is linked below. We do not sell personal information or share it for advertising. We may disclose information where required by law, or to a successor if MergeRamp is sold or transferred.

Your privacy rights

Depending on your location and the applicable law, you may have rights to access, correct, delete, restrict, or receive a portable copy of your personal information. You may also have a right to object to processing, including processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent without affecting earlier lawful processing.

You can change your cookie choice at any time using Cookie settings in the footer. To exercise any other right, email [email protected]. If your information comes from a repository another organization connected to MergeRamp, you can also contact that organization. We will respond within 7 working days and may ask you to confirm your identity.

Changes to this policy

We may update this policy as MergeRamp changes. We will post the new version on this page with a new “Last updated” date, and tell account holders by email about significant changes.