What Mendr collects, and why

Mendr is operated by Arjan Jassal in British Columbia, Canada ("Mendr", "we", or "us"). Mendr finds known vulnerabilities in the dependencies of GitHub repositories you connect and opens fix pull requests for your review. This policy explains how we handle personal information and repository content when you visit or use Mendr.

Send privacy questions, requests, or complaints to Mendr's privacy officer at hello@mendr.sh.

Account information. When you sign in with GitHub, we receive your GitHub user ID, username, display name, email address, and avatar. We also receive the GitHub App installation, repository-access, and organization-membership information needed to decide what you can see. We store session records and an encrypted GitHub authorization credential that lets Mendr renew access. We do not store GitHub access tokens.

Repository content. For repositories connected through the Mendr GitHub App, we process repository metadata, source code, dependency manifests and lockfiles, security alerts, pull requests, comments addressed to Mendr, check and commit status, and bounded failed-job logs from GitHub Actions checks on Mendr pull requests. We store scan results, findings, and fix status for your workspace.

Fix records. While a fix runs, Mendr processes repository files, candidate changes, model requests and responses, commands and their output, build and test results, and answers that a workspace member gives. After a fix ends, Mendr keeps bounded evidence: reports, counts, identifiers, changed paths, publication records, and failure summaries. This evidence can contain excerpts of your source, diffs, prompts, commands, or output. Older records can contain encrypted copies of changed files, diffs, command output, and model events in an earlier format.

Integrations you connect. When a workspace connects Jira, Slack, Vanta, or a model-provider API key, we store the settings and encrypted credentials needed to operate that integration. We also store the records it creates or receives, for example issue references, channel and delivery records, or synchronization status.

Billing. Polar processes purchases as merchant of record. Mendr receives customer and product identifiers, subscription status, billing period, and cancellation status. Mendr does not receive full payment-card details from Polar.

Technical and usage information. Server logs record IP address and connection information. We keep an audit trail of material actions, usage metering, errors, and security events. If you arrive from a link with a campaign label, we count your sign-in click under that label and, if you sign up, record the label with your account. On the public site, when you are not signed in, an analytics service counts page views without cookies. Mendr uses essential session and sign-in cookies and stores interface preferences in your browser. We do not use advertising cookies.

• To authenticate you and check workspace access.
• To scan, prioritize, fix, and verify connected repositories, and to open and update pull requests.
• To operate the integrations and notifications you configure.
• To administer plans, metering, and support.
• To protect, diagnose, and improve the service.
• To comply with law and enforce our terms.

We do not sell personal information. We do not use repository content, fix records, or Slack data to train AI models.

Scans use a temporary checkout on Mendr's infrastructure. AI fixes run in a single-use sandbox that Mendr destroys when the fix ends. Neither is long-term storage.

Mendr sends fix instructions and relevant repository content to the model provider shown on the fix. Fixes that Mendr pays for go through Mendr's account with its model router, Vercel AI Gateway. For those requests, Mendr requests the gateway's zero data retention routing, and sets request options that stop the provider from storing the request where the provider offers that option. Vercel states that the gateway does not retain prompt or response content after a request completes. See Vercel's data retention documentation. Mendr cannot verify a provider's internal handling, and provider safety and legal exceptions can apply. Fixes started before October 26, 2026 could call OpenAI directly under Mendr's account. OpenAI states that it may keep abuse-monitoring logs of those requests for up to 30 days; see OpenAI's data controls.

On paid plans, a workspace can save its own model-provider API key. Mendr stores the key encrypted, shows only its last four characters, and uses it only to check the key with the provider and to run fixes for that workspace. Mendr sends the key and the fix requests through its model router to your provider. Those requests run under your provider account, settings, and data controls, and your provider's terms apply. Mendr does not request zero data retention routing for them and makes no retention promise about them.

OpenAI and Anthropic state that they do not train on commercial API inputs or outputs by default. Mendr does not opt in to share fix content for model training. A workspace that uses its own key controls its own account.

We share information only as needed to run Mendr:

• GitHub, for authentication, repository access, security alerts, and pull-request delivery.
• Infrastructure providers that host and deliver Mendr and count visits to the public site. The application and its database are hosted in the United States.
• A sandbox provider that runs the single-use environments for AI fixes.
• Vercel AI Gateway and the model provider shown on each fix, as described above.
• An exposure-scoring provider that estimates whether an advisory applies to how a repository uses a package. It receives advisory text, dependency chains, file paths, and bounded source excerpts around import sites. Mendr removes credential-like values and URL paths from runtime excerpts. To suggest how to split a batch fix into pull requests, it also receives the repository name, package versions, and the build and test setting. It does not receive the repository clone or Mendr's service credentials.
• Public vulnerability databases and package services, which receive package names and versions. For Go analysis, the public Go services also receive module paths, including private module paths that a repository declares.
• Polar, for purchases and subscription records.
• Services you connect, such as Jira, Slack, Vanta, or your own model provider. Data in those services is governed by your account and that provider's terms.

The named list of these providers is available on request at hello@mendr.sh. Providers can process information in other countries under their own terms. Information processed in another country is subject to that country's laws and can be accessed by its authorities. We can also disclose information when the law requires it, to protect rights or security, or in a business transaction with appropriate safeguards.

We keep account and workspace information while it is needed to provide Mendr. Sessions last until they expire or are revoked. GitHub webhook delivery audit events expire after 14 days. Scan and finding records, including affected file paths, are workspace data and remain while the workspace exists.

Today, fix records that can contain repository content are kept until the workspace is deleted. Mendr is building automated deletion of that content after a fix ends. This page will state the period when it is active. Older operational logs can contain fix content until they expire. Mendr keeps minimal fix history, such as status, timestamps, identifiers, commit and pull-request references, counts, and keyed fingerprints, to operate the product.

Audit, security, and billing records can be kept longer to provide the service, resolve disputes, maintain security, or meet legal obligations. Encrypted backups can retain deleted content until the backup expires under the hosting provider's schedule. Backups are used only for recovery. Content sent to GitHub, your model provider, or a service you connect is subject to that service's retention controls.

Deleting your personal account removes your Mendr profile, memberships, and personal repository grants. It does not delete shared workspace data, billing records, integrations, audit history, or anything created in external systems.

Uninstalling the GitHub App deactivates the workspace, removes stored integration credentials, revokes the Slack token where possible, and schedules eligible paid subscriptions to cancel at the end of the billing period. Uninstall alone does not delete workspace data. To delete a workspace, an admin requests deletion in Mendr and uninstalls the App within 24 hours. Deletion can be blocked when repository history is shared with another installation; contact us. Pull requests, branches, tickets, messages, and billing records remain in those external systems under their controls.

Data is encrypted in transit. Stored credentials and fix evidence are encrypted at rest. GitHub tokens are minted per operation, scoped to selected repositories, and expire within one hour. No method of storage or transmission is completely secure. Our security page describes the design.

Workspace admins can disconnect integrations, remove saved API keys, change notification settings, request workspace deletion, and uninstall the App. Any user can delete their personal account.

You can ask to access or correct your personal information, withdraw consent where it applies, or make a complaint by emailing hello@mendr.sh. We can ask you to verify your identity and can keep information where the law permits or requires. If we do not resolve your complaint, you can contact the Office of the Information and Privacy Commissioner for British Columbia or the regulator that applies to you.

We post changes here and update the date above. If a change materially affects how we handle personal information, we give additional notice or ask for consent where the law requires it.