Privacy Policy

1. Scope and Our Role

This Policy covers website visitors, waitlist subscribers, account holders, organization members, invitees, and people whose personal information appears in issue-tracking systems connected to the Services. It also covers information you provide when contacting us.

We handle account, website, waitlist, and operational information for our own purposes. When a customer connects an issue tracker, we generally process the tracker information on that customer’s behalf to deliver features the customer selects. The customer typically determines what information is entered in its tracker, who may use it, and whether it may be disclosed. If your information appears only in another organization’s tracker, privacy requests about that content may need to be directed to that organization.

2. Information We Handle

• Account and organization information. Names, email addresses, preferred names, profile images, authentication identifiers, organization names, membership roles, and information about people invited to join an organization.
• Waitlist and communications. Email addresses, an indication of interest in beta testing, and information you provide in messages to us.
• Connected tracker information. Issue titles, descriptions, comments, assignees, status, estimates, labels, due dates, projects, milestones, dependencies, relevant user names, and linked pull-request status obtained from integrations you connect. Such content may include information about people who are not Resolute users.
• Integration and access information. Connected service names, site addresses, permissions, status and related metadata; credentials or access tokens held through our credential-management provider; and information necessary to authenticate authorized API access.
• Product, AI, and activity information. Saved views, filters, graph preferences, daily activity records, AI feature inputs and outputs, AI run identifiers, model names, durations, token counts, and related feature-usage information.
• Agent activity. When a coding agent connected through our MCP interface reports on its work, we store the tracker issue identifiers and keys it names, branch names, pull-request links, the progress updates and questions it sends, and the answers you give it along with your display name. Only the user who issued the agent's credential can see these records.
• Device, session, and technical information. IP addresses, browser or device information, login/session details, page views or interactions when optional analytics are enabled, and application or hosting logs, request identifiers, errors, and diagnostics.
• Subscription and billing information, if paid services are enabled. Customer and subscription identifiers, organization and seat counts, billing periods, subscription status, and information in billing-service notifications, which may include billing contact details. Payment information is expected to be collected directly by the checkout provider.

Information contained in tracker descriptions, comments, or text supplied to AI features may include personal or sensitive information even when the Services do not request that type of information.

3. How We Obtain Information

We receive information directly when you sign up for the waitlist, create or use an account, connect an integration, provide text to an AI feature, or contact us. Organization administrators and members may supply other people’s details when creating invitations. We obtain tracker content from connected providers at a user’s direction, identity and session information from our authentication provider, and technical information automatically when the Services are used.

4. How We Use Information

We use personal information to operate accounts and organizations; authenticate users; deliver invitations; retrieve, display, organize and update connected tracker information; provide saved views and AI-assisted features; operate authorized API and agent connections; administer the waitlist; respond to requests; troubleshoot errors; monitor usage and service performance; detect abuse and protect accounts; and comply with applicable legal obligations. If subscriptions are offered, we also use relevant account and subscription information to administer billing and seats.

We use optional product analytics to understand use of the Services when analytics are enabled. Separately, we use operational logs and error records to maintain, troubleshoot, and secure the Services. These are distinct activities, and disabling optional analytics does not necessarily disable operational logging.

5. Connected Services and Customer-Directed Actions

Users may connect Linear, Jira, Shortcut, and GitHub, subject to the permissions authorized through those services. Tracker records are generally retrieved through the Resolute application server when needed rather than maintained as complete copies in our database. Server processing and in-memory browser caching occur during ordinary operation. Saved views, settings, and other derived information may be retained separately.

Authorized users can create, edit, comment on, or delete certain records in connected trackers. Third-party AI agents connected through MCP or API credentials may also read and act using the token owner’s permissions. Confirmation steps available for certain in-app AI proposals do not necessarily apply to actions initiated through external agents. The connected provider’s own privacy terms and access controls also apply to information held by that provider.

6. AI-Assisted Features

The Graph Assistant, Blocker Discovery, Estimate Agent, and Spec → Graph features transmit selected content from connected issue trackers, dependencies and text supplied by users from our servers to Anthropic for AI inference. These materials may include identifiers or information about people referenced in tracker records. AI responses return to the Services for display or use in the requested feature. AI Inputs are held in server memory only for the duration of the request and are not written to our application database; complete tracker datasets ordinarily are not stored in our application database. Selected outputs or information derived from them may persist when a user-facing feature requires it or a user elects to save or write back content. In-progress Spec → Graph drafts may also persist in the user's browser local storage. The Terms of Service govern contractual rights and responsibilities for AI Outputs and autonomous or human-directed actions; an effective DPA governs covered customer-directed Personal Data processing.

We record technical metadata about AI usage, such as run identifiers, models, durations, and token counts, through our analytics and operational systems. The described AI usage events sent to PostHog do not include the prompt text; this does not mean all operational logs or vendor systems are free of personal information.

Resolute uses, or has requested, zero data retention terms with Anthropic. Under those terms, Anthropic does not store prompts or responses at rest after the API response is returned. Zero data retention applies only to the models and features Anthropic designates as eligible, and Anthropic may retain content flagged by its safety systems and content it is legally required to hold. Resolute's own handling of AI inputs is described above. Customer-selected external AI agents or assistants may separately receive, process or store information under their own providers' notices and agreements; Resolute's built-in AI practices do not govern those independent providers.

Model training and service improvement. Resolute does not use customer tracker content, AI Inputs or AI Outputs to train or fine-tune its own general-purpose models and does not sell those materials for AI model training. Resolute does not opt AI prompts or outputs into Anthropic model training. Resolute may use operational data such as feature events, model identifiers, processing duration, token counts and diagnostic records to run, protect, evaluate and improve the Services, consistent with applicable agreements and law.

Built-in approval versus external agents. In documented built-in AI proposal flows, users confirm suggested changes before write-back. Separately authorized external API/MCP agents may act within the token holder's permissions without that particular in-app confirmation. Users and organizations determine whether to connect those agents and the data and permissions they make available. Personal information sent directly to an independent agent provider is subject to that provider's own practices; information passing through Resolute is handled as described here and under any applicable DPA.

7. Cookies, Analytics, and Browser Storage

We use a WorkOS authentication cookie to maintain signed-in sessions; the current session configuration lasts seven days. A first-party cookie records your analytics choice for six months, so we do not ask again on every visit. The Services also use browser local storage for display and graph preferences, demo settings, AI-feature consent choices, dependencies you draw between issues in different trackers, and in-progress Spec → Graph drafts. Drafts stored in your browser may contain issue text and may remain after a tab is closed unless you clear them or the relevant browser storage.

PostHog product analytics are off by default and enabled when a user opts in. When enabled, PostHog may collect page views, interactions, session recordings with on-screen text masked, IP and device information and, for signed-in users, identifying profile and organization details. PostHog may place or use analytics identifiers through cookies or local storage when analytics are enabled. You can use available consent and analytics settings and your browser controls to manage optional analytics and stored information.

Separately, we send operational logs, diagnostic events, and errors to PostHog, and Render retains certain platform request logs. We also use PostHog to evaluate feature flags for signed-in users, and to record usage of our MCP interface: which tool an agent called, how long it took, whether it failed, and the agent client and model, but not the tool's inputs or results (when a call fails, the error message may describe what failed). Operational records may contain user or request identifiers, error details, and, in some cases, IP addresses. Those records are not governed solely by the optional analytics setting. Disabling essential session cookies or clearing local storage may affect sign-in, preferences, or saved browser drafts.

8. When We Disclose Information

We disclose information as needed to providers performing the functions described in this Policy: Render (application hosting), Neon (database hosting), WorkOS (authentication, organization administration and credential management), Anthropic (AI inference), and PostHog (analytics, error tracking and operational telemetry). Each provider receives the information relevant to its role. We exchange information with customer-selected integrations, including Linear, Jira, Shortcut and GitHub, to perform authorized requests.

If paid subscriptions are activated, Paddle is expected to provide checkout and merchant-of-record services. Paddle would collect payment and billing details directly and provide Resolute with subscription and billing information necessary to operate paid plans. Paddle may handle information in its own capacity under its applicable privacy notice.

We may also disclose information where required by law or legal process, to address misuse or protect rights and security, or in connection with a merger, financing, reorganization, or sale of assets, subject to applicable legal requirements. We do not sell personal information. Connecting a third-party tracker does not authorize unrelated use of its content.

9. Retention and Deletion

Retention depends on the type of information and where it is held. Connected tracker content is normally fetched live rather than persistently copied into the Resolute database, but data derived from trackers, saved views, agent activity, browser drafts, AI-related records, and operational logs may persist. Session information, customer-controlled tracker records, and vendor-held data may be subject to different retention practices.

We keep personal information for the periods below, unless a longer period is required by law or you ask us to delete it sooner and no legal basis for keeping it remains.

• Waitlist email addresses. Until you create an account or ask us to remove you from the waitlist.
• Account records. Profile, organization memberships, saved views, preferences, integration connections, API tokens, daily activity records, and agent activity are kept until the account is deleted.
• Billing and subscription records, including payment-provider notifications. Seven (7) years.
• Application logs, error records, and product analytics events. For a limited period, as needed to operate, troubleshoot, and secure the Services.
• AI feature inputs. Held in server memory only for the duration of the request.
• Session cookies. Seven (7) days.

Removing someone from an organization ends that person's access to the organization's workspace but does not delete the person's own account, which remains until it is deleted on request.

You may contact us to request deletion or correction. We complete deletion requests within thirty (30) days, subject to applicable law, customer instructions, and legitimate retention needs. Data stored in your browser may need to be cleared through your browser or the applicable feature, and information in external trackers is administered by their operators or the relevant customer.

10. Privacy Choices and Requests

You can choose whether to connect an external tracker and whether to enable optional analytics where that choice is offered. Disconnecting a tracker through the Services is designed to remove its stored connection and associated credential. You can also manage browser cookies and local storage, although doing so may affect Service features.

Depending on the law that applies to you and our handling of your information, you may have rights to request access, correction, deletion, a copy of your information, or limits on certain uses. You can submit a privacy request using the email address below. We may need to verify the request and determine whether Resolute or the relevant customer controls the information at issue. We will handle legally required requests and any applicable appeals or remedies in accordance with the governing law.

11. Security

We use authentication, access permissions, and encrypted network connections to support the Services. Our technical environment also relies on specialized hosting, database, and identity providers. No method of transmission, storage, or system operation is completely secure. This Policy does not promise a particular certification, uninterrupted availability, or that incidents cannot occur.

12. International Processing

Resolute is based in the United States, and personal information is processed in the United States by Resolute and the service providers listed in Section 8 (Paddle may also process billing information in the United Kingdom). We do not currently offer an EU or UK data residency option. When you provide information to us directly from outside the United States, you are sending it to a company in the United States, and we protect it as described in this Policy. When a business customer transfers personal data to us for processing on its behalf, the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, which are incorporated in our Data Processing Addendum, govern the transfer.

13. Additional Information for the EEA, United Kingdom, and Switzerland

Controller. For account, website, waitlist, billing, and operational information, Resolute Labs, Inc. is the controller. For connected tracker content, our business customer is the controller and Resolute is its processor. Requests about that content should go to the customer, and we will help the customer respond.

Legal bases. We process personal information on the following bases: performance of our contract with you (accounts, authentication, delivering the features you request, and billing); our legitimate interests in operating, securing, and improving the Services and in communicating with people who asked to hear from us, balanced against your rights; your consent for optional product analytics and marketing-site analytics, which you can withdraw at any time through the analytics settings or the consent banner; and compliance with our legal obligations. Connected tracker content is processed on the documented instructions of the business customer.

Your rights. You may ask us to give you access to, correct, erase, or provide a copy of your personal information, to restrict or object to certain processing, and to stop processing based on consent. We respond within one (1) month, which may be extended where the law allows. You also have the right to lodge a complaint with your data protection supervisory authority, including the UK Information Commissioner's Office or the Swiss Federal Data Protection and Information Commissioner.

Automated decisions. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.

14. Additional Information for U.S. State Residents

Depending on your state of residence (including California, Colorado, Connecticut, Virginia, Texas, and other states with comprehensive privacy laws), you may have the right to access, correct, delete, and obtain a copy of your personal information; to opt out of targeted advertising, the sale of personal information, and profiling that produces legal or similarly significant effects; and to appeal our decision on a request. We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use it for targeted advertising or for profiling that produces legal or similarly significant effects. The categories of personal information we collect and disclose for business purposes are described in Sections 2 and 8, and we have not sold or shared personal information in the preceding twelve (12) months.

Submit requests to steven@resolute.fyi. We will verify your request and respond within forty-five (45) days, which may be extended where the law allows. If we deny a request, you may appeal by replying to our response, and we will answer the appeal within the time your state's law requires. We do not discriminate against you for exercising these rights. An authorized agent may submit a request on your behalf with proof of your authorization.

15. Children

The Services are for business, professional, academic, and research use by people who are at least eighteen (18) years old. We do not knowingly collect personal information from anyone under eighteen (18). If we learn that we have done so, we will delete it.

16. Changes to This Policy

We may update this Policy as the Services or our practices change. The posted version identifies its effective date. We will provide any further notice, consent option or rights mechanism required by applicable law. Material changes to data practices may also require corresponding changes to product notices, contracts or choices.

17. Contact

For questions or privacy requests, contact Resolute Labs, Inc. at steven@resolute.fyi. Website: https://resolute.fyi.