Last updated: October 8, 2026
This policy explains what information Approvegate (“we”, “us”) collects when you visit approvegate.io, use the Approvegate application, or call the Approvegate API from a CI/CD pipeline, and what we do with it. Approvegate is operated by its founder as a sole proprietorship based in the United States.
When you register or are invited to a workspace, we collect your name, email address, a hashed password (or, if you sign in with a third-party provider, the name, email and avatar that provider shares with us), your workspace name, and your role and permissions within the workspace.
Release requests and their details (change description, business justification, risk assessment, testing plan, ticket and pull request references), approval decisions and comments, separation-of-duties and approval policies, protected services, freeze windows, and files you upload, such as auditor sample lists.
When the Approvegate GitHub Action or API is called, it sends us the service, environment, release or branch, commit SHA, an optional change request ID and override reason, the CI provider, repository name, workflow, job, run ID and run URL, and the CI user login that triggered the run. We use this to decide whether the deploy is allowed and to build your audit trail. Calls are authenticated with an API token that you create and can revoke.
Every deploy check (allow or block), override, approval decision and policy change is written to a per-workspace audit log. Each entry stores a hash of the entry before it, so the log can show it has not been altered. Evidence packages you export are generated from these records.
Paid plans are billed through Stripe. Stripe collects and stores your payment card details; we receive only your subscription status, plan, billing email, and limited card details such as the brand and last four digits.
If you use our contact form or email us, we receive your email address and the content of your message.
Our servers log the IP address, browser user agent, requested URL, and time of each request for security, abuse prevention, and debugging. We also log API requests made with your workspace API tokens. If you accept analytics cookies, we record the pages you view, events such as button clicks, your referrer and UTM campaign tags, your browser, operating system and device type, and an approximate location derived from your IP address. If you are signed in, these analytics may be linked to your account.
We do not use your workspace content or deploy metadata to train machine learning models, and we do not sell or rent personal information to anyone.
If you are in the European Economic Area or the United Kingdom, we rely on these legal bases: performance of our contract with you (providing the service), our legitimate interests (security, improving the product, communicating with customers), your consent (analytics cookies, which you can withdraw at any time), and compliance with legal obligations.
We share information only with providers that help us run Approvegate, and only as needed for them to do so:
We may also disclose information if required by law, to protect the rights, safety or property of our users or the public, or as part of a merger, acquisition or sale of the business, in which case this policy will continue to apply to the transferred information.
Approvegate data is stored in the United States (AWS us-east-1). If you access the service from outside the United States, your information will be transferred to and processed in the United States.
Connections to Approvegate are encrypted in transit with TLS. Passwords are stored as salted hashes. Access to production systems is limited to the operator of the service. API tokens can be scoped to a single service and environment and revoked at any time. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach that affects your personal information, we will notify you as required by applicable law.
We keep account and workspace data, including audit records and deploy check history, for as long as your workspace is active, because audit evidence is only useful if it is complete. When you close your workspace or ask us to delete it, we delete or anonymize its data within 90 days, except where we must keep it longer to meet legal, tax, or accounting obligations. Server logs and analytics data are kept for as long as they are useful for security and product analysis and are then deleted.
We use a session cookie to keep you signed in and to remember your theme, language, and cookie choices. This cookie is required for the site to work. With your consent, we use a first-party analytics cookie to count unique visitors. Product videos are played through Vimeo with its do-not-track setting on, so Vimeo does not set tracking cookies. You can review and change your choices at any time with the cookie settings link at the top of this page.
Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can update most account details from your profile settings. For anything else, email us at [email protected] and we will respond within 30 days. We will not discriminate against you for exercising these rights. You also have the right to complain to your local data protection authority.
If your account belongs to a workspace managed by your employer, the workspace owner controls the workspace content and audit records. We may refer requests about that content to them.
Approvegate is a business tool and is not directed to children under 16. We do not knowingly collect personal information from children.
If we change this policy, we will update the date at the top of this page. If a change materially affects how we use your personal information, we will notify account owners by email before it takes effect.
Questions about this policy or your information: [email protected]
We respect your privacy. We respect your privacy.
TLDR: We use cookies for language selection, theme, and analytics. Learn more. TLDR: We use cookies for language selection, theme, and analytics. Learn more