Privacy Policy

1. Who we are

The data controller is Woden AI Ltd, registered in England and Wales under number 16869601, with its registered office at 167-169 Great Portland Street, London, England, W1W 5PF ("Woden AI", "we", "us"). Our VAT number is 509 1545 95. Our ICO registration number is ZC240138. We have not appointed a Data Protection Officer; the controller handles data protection matters directly. For anything about this policy or your data, email support@woden-ai.com.

This policy covers Woden Service Desk (connected to GitHub or standalone), DocBot, TagBot, the optional bring-your-own-AI connector, IRIS once it is sold, and the website at woden-ai.com including its portal (together, the "Services"). By using the Services you agree to the practices described here.

2. What we collect

2.1 Woden Service Desk

• Tickets and conversations: tickets, replies and internal notes, status, priority, SLA timings, time logs and estimates, attachments. On a desk connected to GitHub, tickets are also GitHub issues in your repository and GitHub holds a copy. On a standalone desk we are the only system of record.
• People: for your team, the identity your sign-in provider gives us (GitHub login, or name and email from Microsoft Entra External ID), roles, and the repository access used to scope agents. For your customers, their name and email from Entra External ID, Google or GitHub, so we can identify them and route notifications.
• Configuration: project, repository, portal name and address, SLA, business hours, intake form and knowledge-base settings.
• Team notes and knowledge base: note content and tags, and the articles you publish. Notes you lock are encrypted in your browser with a passphrase we never receive; we store ciphertext only. The per-user scratchpad is encrypted at rest.
• Board cache and push subscriptions: a cached snapshot of your board, and if you opt in to push notifications, the subscription your browser provides. You can revoke push in your browser or device settings.
• Plan and billing state: which plan you are on and your subscription status. Card details are held by GitHub or Paddle, never by us.

2.2 DocBot

• Source code, in the request only. The files a pull request changes are sent over TLS to Azure OpenAI in UK South (UK West failover), used to generate documentation, and discarded. They are never written to our storage.
• Repository and pull request metadata: repository names, pull request numbers and titles, changed file paths.
• Installation and usage: GitHub installation and account identifiers, token consumption per operation, timestamps and operation types, an audit log of runs (no source code), and the contents of your .github/wai-docbot.yml.

2.3 TagBot

• The pull request file list: file names, additions, deletions and status. TagBot never reads file contents, patches, descriptions or commit messages, and sends nothing to any model.
• Installation and aggregate statistics: your GitHub account ID and organisation name, the installation timestamp and repository list, and per-repository totals (pull requests analysed, files processed, lines changed, average complexity, risk counts).

2.4 The AI connector (opt-in)

If you connect your own AI tool, it can read your notes (never locked notes), the same figures your dashboard shows (including ticket titles and who they are assigned to), and the tickets you can already see in the portal — including a ticket’s own description when you ask for one — and your desk’s feature requests with their vote counts (never who voted). It sees the replies and internal notes on a ticketonly if an admin of your organisation switches that on; it is off until they do. It never sees attachments: attachment links are removed from a description or reply before it is sent.

It reaches only what you can already see. An agent whose desk visibility is off, or who is scoped to certain repositories, gets that same subset through the connector. Only admins and agents can connect one; customers cannot.

On a customer ticket it can change the board column, category, labels, start and target dates, estimates and who is assigned; it cannot raise, rename, rewrite, reprioritise, resolve or close one. On your team’s own development tickets it can do all of that and raise new ones, under that person’s name. If an admin switches it on, it can add an internal note, which customers never see. It can link a feature request to the development tickets that deliver it, but never edits a request. If an admin switches it on, it can delete a development ticket when you ask, which removes it from the desk (the record is kept until the organisation is deleted) — only one you raised (an admin, any development ticket) and never one with sub-issues; the ticket’s comments and time entries go with it, and a linked GitHub issue is closed, not deleted. It cannot reply to a customer, delete a customer ticket or a feature request, or add or remove the labels the desk acts on.

Two permissions are needed before any of this works: you grant the capability when you sign the connector into your own AI tool, and an admin of your organisation allows it in Integrations. An organisation that has not changed that setting allows every capability except reading replies, adding internal notes and deleting development tickets; an admin can withdraw any capability for everybody at any time. What is sent goes to the provider you chose (Anthropic or OpenAI), under your own account with them and under that provider’s terms. Woden AI runs no model on it and does not control what your provider does with it.

2.5 IRIS (once sold)

The licence check sends a licence key, a hardware identifier, the chip (not the Mac's name), OS and app version. The update check, about once a day, sends the app's name and version and the updater's version, with no profile of the Mac. Nothing else reaches us. Phone notifications, if you switch them on, go through your phone's own push service (Apple's or Google's), encrypted so only your phone can read them. What you say, what IRIS says, and the routing between them are processed on your Mac. A local model's work stays on your Mac; cloud coding work goes to the agent you chose, under its provider's terms. Paddle handles payment (see 6).

2.6 This website and the portal

• Analytics: Google Analytics (page views, traffic sources) and Azure Application Insights (performance and errors). See 10 for your choices.
• Portal sign-in: your GitHub login and public profile information, to show your installations and usage.
• Register interest in IRIS: the email address you give us, and when you gave it. We will email that address once, when there is a build to download.
• Access to our own service desk: the email address you provide, linked to your GitHub identity, so you can raise and track tickets with us.
• Support communications: whatever you send us when you ask for help.

2.7 What we do not collect

• We do not store your source code.
• We do not hold passwords; sign-in is GitHub or Microsoft Entra External ID.
• We do not collect payment card details; GitHub Marketplace and Paddle do.
• We do not track your browsing outside our Services.

3. How we use it

• To provide the Services: run your desk, document your pull requests, label them, and sync with GitHub where you have connected it.
• To manage usage and billing: count tokens, apply plan limits, and process billing through GitHub Marketplace or Paddle.
• To keep the Services working: monitor health, find bugs, and understand which features are used. We do not use your content to train models.
• To communicate with you: service notifications, replies to support requests, and, if you registered interest, one email about IRIS.
• To prevent abuse: detect fraudulent or abusive use and enforce our Terms.

4. Where it is stored, and for how long

4.1 Location

Everything is hosted in Microsoft Azure, UK South, in Azure Table Storage and Blob Storage. Production and our test environment are separate storage accounts with no shared data.

4.2 Retention: the GitHub Apps (DocBot and TagBot)

• Operational data is kept for the life of the installation.
• Billing records we hold — what was used and what it cost — are kept for seven years for accounting and tax purposes. We do not hold your card details or your invoices; see 4.4.
• Audit logs are kept for two years for security and debugging.
• After you uninstall, account and usage data is removed within 30 days, except billing records.

4.3 Retention: Woden Service Desk

Service Desk data is kept until you delete it. Nothing expires automatically. You can export it (on a desk connected to GitHub) and delete your organisation or your own identity yourself (see 7); deletion is immediate and permanent, and we hold no backup from which a deleted organisation can be restored. Uninstalling the GitHub App stops webhooks but does not delete a connected desk's data; deleting the organisation does.

4.4 Payment records are the payment provider's

We never see or store your card details. Who holds the record of a payment depends on how you bought:

• Paddle — Woden Service Desk plans paid to us directly, and IRIS once it is sold. Paddle.com Market Limited is the merchant of record and therefore the seller, so the transaction, the invoice, the VAT record and any refund are theirs and are kept under their policy. You can see and download your own at paddle.net.
• GitHub Marketplace — desks and DocBot installed from GitHub. GitHub collects the payment and holds that record.

What we keep is the state of your plan — which tier, which subscription, when it last changed — and a record of the billing events the provider sent us, so we can answer a question about your account without sending you elsewhere. For a Service Desk organisation that record is deleted with the organisation, along with everything else (see 7). The provider's own record is not ours to delete.

4.4 Retention: the website

An IRIS interest registration is kept until we have emailed you about a build, or until you ask us to remove it. A service-desk access record is kept while you have an account with our desk.

5. How we protect it

• TLS in transit; Azure Storage encryption at rest by default.
• Short-lived GitHub installation tokens, never stored or logged. The portal never mints a GitHub token; side effects are relayed with HMAC-signed, replay-protected requests that fail closed.
• Webhooks from GitHub and Paddle validated with HMAC SHA-256.
• Role-based access to Azure resources; production and test separated.
• DocBot's GitHub App private key held in Azure Key Vault.
• Locked notes end-to-end encrypted in your browser; the scratchpad encrypted at rest.

We hold no SOC 2 report or ISO 27001 certificate, and we do not claim to. We commission an annual penetration test, scan for vulnerabilities regularly as part of our development lifecycle, and are applying for Cyber Essentials. We are designed to meet our obligations under UK and EU data protection law. The security page lists what we do and do not claim.

6. Who we share it with

We do not sell, rent or trade your personal information or your content. We share data only with the sub-processors below, to operate the Services, and with your own AI provider only when you connect it.

Paddle.com Market Limited is the merchant of record for Service Desk plans paid to us directly and for IRIS: the seller for those transactions, collecting the billing and tax details needed to process them; we receive subscription status only. We may also disclose information where the law requires it, in response to valid legal process, to protect rights, property or safety, or to enforce our Terms. If Woden AI is acquired or merges, we will notify you before your information becomes subject to a different policy.

7. Your rights and controls

You can do most of this yourself, from the Service Desk or from GitHub:

• Export a full copy of your organisation's data, on a desk connected to GitHub.
• Delete the organisation (admins), which permanently removes its tickets, comments, boards, notes, articles, time entries, SLA policies, intake forms, attachments and reporting history. It does not delete the people; anyone who belongs to another organisation keeps their account.
• Delete your own account, which removes your sign-in and your memberships. Content you created stays with the organisation, because it belongs to the organisation and removing it would leave gaps in other people's records.
• Uninstall a GitHub App to stop its data collection; revoke the AI connector or push notifications at any time.
• Configure which repositories, branches and files DocBot touches.

Deleting an organisation does not cancel a paid subscription; cancel that first (see the Refund Policy).

If you are in the UK or EU you also have the rights to access, rectify, erase, restrict and port your data, to object to processing based on our legitimate interests, to withdraw consent, and to complain to the Information Commissioner's Office or your local authority. To exercise any right you cannot exercise yourself, email support@woden-ai.com; we respond within 30 days.

8. Children

The Services are not intended for children under 13 (16 in the EU) and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

9. International transfers

The Services are hosted in the UK. If you use them from elsewhere, your information is transferred to and processed in the UK, and by the sub-processors above in the regions they operate, under data processing agreements, Standard Contractual Clauses where applicable, and the adequacy decisions covering the UK. Content you send to your own AI provider through the connector leaves our boundary at your direction and is governed by that provider's terms.

10. Cookies and analytics

The website uses Google Analytics and Azure Application Insights, and session storage for navigation state. The GitHub Apps use no cookies. The Service Desk portal uses only essential session storage and the sign-in and push mechanisms described above; there are no advertising or third-party tracking cookies. You can block analytics with your browser's settings or the Google Analytics opt-out add-on.

11. AI and automated decisions

DocBot uses Azure OpenAI (gpt-5-mini, with a gpt-5 failover) to generate documentation. It is a supporting task: it makes no decision that affects your rights or access, the output is reviewed by people before it is merged, and it can be regenerated on request. Your code is not used to train models, under Microsoft's Azure OpenAI Data Protection Addendum. TagBot uses no AI. The Service Desk runs no Woden model; the only AI is the one you connect (2.4). IRIS runs a small routing model and speech on your Mac, and sends coding work to the agent you chose.

12. Legal basis

• Contract: providing the Services you asked for (Art. 6(1)(b) GDPR).
• Legitimate interests: keeping the Services working and secure (Art. 6(1)(f)).
• Legal obligation: tax and accounting records (Art. 6(1)(c)).
• Consent: analytics where required, push notifications, the AI connector, and the IRIS interest email (Art. 6(1)(a)).

13. Changes

When this policy changes, the date at the top changes. Material changes are communicated through the Services or by email with at least 30 days' notice before they take effect.

14. Contact

Woden AI Ltd, 167-169 Great Portland Street, London, England, W1W 5PF. Privacy requests and everything else: support@woden-ai.com (put "Privacy" in the subject) or the support page. See also our Terms of Service, Refund Policy and security page.