1. Who we are
Balearic Labs LLC ("Trunk," "we," "us," or "our") provides the Trunk website, hosted version control service, dashboard, API, and MCP server. This policy explains how we handle personal information in connection with those services.
When an organization provides information through its repositories or workspace, we process that information to provide the service to the organization. Its administrators control membership, permissions, and integrations. If you use an organization-managed account, contact that organization about its own privacy practices. Customer-operated installations are also subject to the operator’s policies.
2. Information we collect
- Account information: your name, email address, authentication information, and organization memberships.
- Content and activity: repositories, source code, commits, change proposals, reviews, verification results, workflow logs, and actions taken by people and agents. This content may include personal information you or others submit.
- Connected services: identifiers, access credentials, and information made available by integrations you or your organization authorize.
- Communications: information you provide when you contact us, including support requests and feedback.
- Technical information: request and security logs, IP addresses, browser and device information, and information about how the service is used.
3. How we use information
We use information to provide and maintain Trunk, authenticate users and agents, apply permissions and repository policies, run requested workflows, deliver service notifications, respond to support requests, understand usage, and improve reliability. We also use information to detect abuse, protect the service, resolve disputes, and meet legal obligations.
Where applicable data protection law requires a legal basis, we rely on performing our agreement with you, our legitimate interests in operating and securing the service, compliance with legal obligations, or your consent where required. You may withdraw consent without affecting processing that already took place.
4. Cookies and website analytics
The authenticated service uses session cookies to keep you signed in. Blocking these cookies may prevent sign-in features from working.
Our website uses Vercel Web Analytics to understand visits and page usage, including pages viewed, referrers, and browser, device, and approximate location information. Vercel describes this analytics service as using no analytics cookies and not tracking visitors across websites. See Vercel’s analytics privacy documentation for details.
5. When information is shared
Information is available to people and agents with access under your organization’s permissions. We also share information with service providers that support hosting, storage, authentication, analytics, communications, and other service operations.
When you enable an integration or connect an agent, information needed for that interaction may be sent to the provider you select, including code, context, and workflow results. Those providers handle information under their own terms and policies.
We may disclose information when required by law, to protect rights and safety, to investigate abuse, or as part of a merger, acquisition, financing, or sale of business assets, subject to applicable protections.
6. Retention and security
We retain information for the time needed to provide the service and fulfill the purposes described here. Relevant factors include whether an account is active, repository and audit-history requirements, support needs, security investigations, backup lifecycles, and legal obligations. Deleting an account does not necessarily remove commits or records held in an organization’s repositories.
We use safeguards designed to protect information, but no storage or transmission method is completely secure. Protect your credentials and avoid submitting secrets or personal information that is unnecessary for your work.
7. International processing
We and our providers may process information in countries other than where you live. Where applicable law requires safeguards for international transfers, those transfers must be subject to an appropriate legal mechanism.
8. Your choices and rights
Depending on your location, you may have rights to access, correct, delete, or obtain a copy of your personal information, and to restrict or object to certain processing. You may also have the right to complain to your local data protection authority. These rights are subject to applicable conditions and exceptions.
You can manage available account and notification settings in Trunk. For information controlled by your organization, contact its administrator. We may need to verify your identity before responding to a privacy request.
9. Children
Trunk is intended for professional use and is not directed to children under 16. If you believe a child has provided personal information to us, contact us so we can address it.
10. Updates and contact
We may update this policy as the service or our practices change. We will post the updated policy here and revise the date above, and provide additional notice when required by law.
For questions about this policy or to exercise your privacy rights, contact Balearic Labs LLC at support@balearic.ai.
Use of Trunk is also subject to our Terms of Service.