Privacy Notice

Last updated: October 30, 2026

This Privacy Notice explains how Octopus Foundry LLC ("we," "us" or "our"), the company behind Merge Freeze, collects, uses and protects your personal information when you use our app.

What personal data do we store and why?
For people who have logged in via GitHub on our website, we store these things in our database:
For people who have interacted with Merge Freeze via the Slack integration, we store these things in our database:
For customers on a paid subscription plan:

This is so we can provide the plan you have paid for, manage your subscription and meet our tax and accounting obligations.

Other things:
Legal bases for processing (GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases to process your personal information:

How we share information we collect

We do not sell your personal information, irrespective of where you are located.

We do use certain third-party providers to deliver and perform services for us and we may share certain information with these service providers:

From time to time as the business and the app evolves, there may be additional service providers or a service provider may be removed or replaced. We will periodically update this list to reflect any changes.

The service providers that process personal data on behalf of our customers (subprocessors) are listed in Annex III of our Data Processing Agreement. We will update that list at least 30 days before we add or replace a subprocessor. To get an email when it changes, email hello@mergefreeze.com and ask to be added to subprocessor updates.

International data transfers

Octopus Foundry LLC is based in the United States, and our service providers may process your information in the United States and other countries. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to a country that does not provide an equivalent level of protection, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or our providers' certification under the EU-U.S. Data Privacy Framework.

Security and storage

The following security measures are in place:

How do you get all of your personal data deleted from our system?

Your email address, GitHub username and avatar are deleted from our system when you delete your user in the user settings panel of the web UI.

Your name stays in the freeze history and freeze notes your team can see, so they keep an accurate record of who froze or unfroze branches. This history is deleted when the Merge Freeze app is uninstalled or your organization's account is closed.

Your Slack display name and avatar are deleted from our system when your Slack user no longer belongs to any Slack accounts that are linked to a Merge Freeze project. To delete this information at an earlier time please send a request via email to hello@mergefreeze.com.

Your GitHub account name, repository names and branch names are deleted from our system when the Merge Freeze app is uninstalled from your GitHub account, except for a short record of the installation, which we keep for up to 15 days for support and security purposes.

If you have had a paid subscription, we keep billing records (such as invoices, plan and payment history) for as long as we are required to by tax and accounting laws, even after you delete your user or uninstall the app. Stripe and GitHub also retain their own payment records in accordance with their privacy policies.

We retain an encrypted copy of the app’s log files for up to 15 days. At the end of this period, we will delete all information except that which we are obligated to retain by law.

Deleted data may remain in our encrypted database backups for up to 7 days until those backups expire.

Within 15 days of deleting your user, we remove your personal data from our systems, logs and backups, except your name in your team's freeze history and billing records we must keep by law.

Your data rights

You may have the right to:

by emailing us at hello@mergefreeze.com.

You can opt out of informative and marketing emails at any time by using the unsubscribe link included in those emails, which is managed by our email provider. We will still send you security alerts and essential notices about your account.

You will not be discriminated against for exercising any of your privacy rights.

That said, where our customer is an organization we receive and process information under the direction of our customer. In such circumstances:

In order to protect your information, upon receiving a request to exercise your privacy rights we will verify your identity by a method appropriate to the type of request you are making.

Data Processing Agreement

Where we process personal data on behalf of our customers, our Data Processing Agreement applies and forms part of our Terms of Service. No signature is needed. If you need a signed copy, please email us at hello@mergefreeze.com.

Changes to this policy

Occasionally we may make changes to this policy. If we do we'll update the "Last updated" date at the top of this page. If we make material changes, we'll also notify app managers by email or through a notice in the Merge Freeze web app.

Who should you contact if you have a complaint?