Privacy Policy

Last updated: February 2026

Temujin Labs ("we", "us") operates Yam (yam.temujinlabs.com). This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with the EU General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).

1. Data Controller

The data controller for your personal data is:

Temujin Labs
Barcelona, Spain
Email: hello@temujinlabs.com

2. Data We Collect

Data Purpose Legal Basis
Email address Account creation, login, communication Contract performance
Password (hashed) Authentication Contract performance
Jenkinsfile content Pipeline analysis and scoring Contract performance
Build log content Build log debugging and error explanation Contract performance
Pipeline descriptions Pipeline generation Contract performance
Usage analytics Service improvement, feature usage tracking Legitimate interest
IP address Rate limiting, security Legitimate interest
Payment info Subscription billing (processed by Stripe) Contract performance

3. How We Use Your Data

We use your data exclusively to:

  • Provide the Yam service (analyzing Jenkinsfiles, debugging build logs, generating pipelines)
  • Authenticate your account and maintain security
  • Process payments via Stripe
  • Send essential service notifications (account changes, billing)
  • Protect against abuse (rate limiting, fraud prevention)
  • Improve the quality of AI analysis and recommendations

We do not sell your data. We do not use your data for advertising. We do not profile you for marketing purposes.

4. Content You Submit

Jenkinsfile content, build logs, and pipeline descriptions you submit are processed by our AI analysis engine. This content is:

  • Sent to Google Gemini API for analysis (the content itself, not linked to your identity)
  • Not stored permanently beyond what is needed to deliver results, unless you explicitly save it to your pipeline library
  • Not used to train AI models
  • Deleted upon account deletion

We strongly recommend that you remove any credentials, secrets, API keys, or sensitive environment variables from content before submitting it.

5. Third-Party Processors

We share data with the following processors, all of which are GDPR-compliant:

Processor Purpose Data Shared
Google (Gemini API) AI-powered pipeline analysis and generation Submitted content only (no personal data)
Stripe Payment processing Email, payment details
Hetzner Server hosting (EU) All service data (stored in EU)

6. Data Storage and Security

Your data is stored on servers located in the European Union (Hetzner, Germany). We implement the following security measures:

  • Passwords are hashed using bcrypt (never stored in plain text)
  • All connections are encrypted via TLS/HTTPS
  • API authentication uses JWT tokens with expiration
  • Rate limiting protects against brute force attacks
  • Security headers (HSTS, X-Content-Type-Options, X-Frame-Options) are enforced

7. Data Retention

  • Account data: retained while your account is active, deleted within 30 days of account deletion
  • Pipeline library: retained while your account is active, deleted upon account deletion
  • Analysis results: retained temporarily for delivery, not stored long-term unless saved to your library
  • Server logs: retained for 30 days for security and debugging purposes

8. Your Rights (GDPR)

Under the GDPR, you have the following rights:

  • Access: Request a copy of all personal data we hold about you
  • Rectification: Request correction of inaccurate data
  • Erasure: Request deletion of your data ("right to be forgotten")
  • Portability: Request your data in a machine-readable format
  • Restriction: Request that we limit processing of your data
  • Objection: Object to processing based on legitimate interest
  • Withdraw consent: Where processing is based on consent, withdraw it at any time

To exercise any of these rights, email hello@temujinlabs.com. We will respond within 30 days.

9. Cookies

Yam uses only essential cookies and local storage for authentication (JWT token storage) and user preferences (pipeline library). We do not use tracking cookies, analytics cookies, or third-party advertising cookies. No cookie consent banner is required because we only use strictly necessary storage.

10. Free Jenkinsfile Analyzer (Public Tool)

The free Jenkinsfile Analyzer does not require an account. For this tool, we process:

  • The Jenkinsfile content you submit (not linked to any account)
  • Your IP address (for rate limiting only, not stored permanently)

No personal data is retained from analyzer usage beyond the session.

11. Children

The Service is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us for immediate deletion.

12. International Transfers

Your data is stored within the EU. When we use Google's Gemini API (US-based), only submitted content is transmitted (no personal data). Google's API is used under their standard data processing terms with appropriate safeguards.

13. Supervisory Authority

You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es, or with your local EU data protection authority.

14. Changes

We may update this Privacy Policy. Material changes will be communicated via email or in-app notification. The "last updated" date at the top reflects the most recent revision.

15. Contact

For any privacy-related questions or data requests:

Temujin Labs
Barcelona, Spain
Email: hello@temujinlabs.com