GitLab
- Your data trains their AI only if you opt in.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- The policy describes staff access for safety and legal checks.
They collect account, code, and device data; AI inputs are not trained without consent, but ads cookies and public posts can linger.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account info, your code and comments, device IDs, cookies, and sometimes partner data.
Read the exact line
Privacy policy
“When you register for an account with GitLab, we collect information that identifies you such as your name, username, email address, country and/or region, and password.”
Training
They run the service, improve it, send marketing, and use cookies for interest-based ads.
Read the exact line
Privacy policy
“In addition, we use cookies to gather information to provide interest-based advertising which is tailored to you based on your online activity.”
Sharing
Other users, the public if your profile is public, vendors, affiliates, and sometimes partners.
Read the exact line
Privacy policy
“We share your Personal Data with our service providers. These are companies who provide services on our behalf, including in the areas of cloud hosting, marketing, advertising, ad measurement, social engagement, analytics, support ticketing, credit card processing, AI and ML, security, and other such similar services.”
Kept
They keep data while your account is active; some public posts can stay forever.
Read the exact line
Privacy policy
“GitLab will only retain your Personal Data for as long as your account is active or as needed to perform our contractual obligations, provide you the Services, comply with legal obligations, resolve disputes, preserve legal rights, or enforce our agreements.”
Controls
You can update your profile, unsubscribe from marketing, and delete a SaaS account in settings.
Read the exact line
Privacy policy
“If you only want to delete your SaaS account, you may do so by logging into your account and going to the “Delete Account” option in your User Settings.”
Fine print
They post policy updates on the site and may email you; the terms page does not spell out refunds.
Read the exact line
Privacy policy
“If we decide to make a significant change to our Privacy Statement, we will post a notice of the update on the homepage of our Website.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Delete your SaaS account
Log in, then User Settings → Delete Account
Ask to delete personal data everywhere
Make a Privacy Request and select “Delete my personal data”
Turn off interest-based ads cookies
Cookies Policy / Privacy Preference Center (Targeting and Advertising Cookies)
Unsubscribe from marketing email
Unsubscribe link in marketing emails or the preference center
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They track how you use the site so they can show ads based on your activity.
Read the exact line
Privacy policy
“In addition, we use cookies to gather information to provide interest-based advertising which is tailored to you based on your online activity.”
For example, visiting pricing pages could later show you GitLab ads on other sites.
Even after you leave, some of your name or comments on public posts can stay.
Read the exact line
Privacy policy
“Please note that due to the open source nature of our Services, we may retain limited Personal Data indefinitely in order to provide a transactional history.”
For example, a comment you left on a public issue may still show after you delete your account.
If you use Duo, your code and prompts can be sent to outside AI companies.
Read the exact line
Privacy policy
“To provide these features, GitLab may transmit your code, supporting contextual information, and other prompts you submit to the Services to third-parties, such as private code modeling service providers.”
For example, a snippet you ask Duo to complete may be sent to another vendor’s model.
Sales partners can get your information when the rules allow it.
Read the exact line
Privacy policy
“Where permitted and with your consent (if required), we may share your data with these partners and resellers.”
For example, a reseller helping your company buy GitLab may receive your work email.
They say they will not train AI on your Duo prompts unless you agree.
Read the exact line
Privacy policy
“However, we will not use your AI-inputs to train any language models without your instruction or prior consent.”
For example, your private code suggestion prompt should not be used to train a model unless you opt in.
Staff generally do not go into private projects except for security, law, uptime, or support you ask for.
Read the exact line
Privacy policy
“Except to host the Services, GitLab does not process Personal Data in private groups or projects unless the following situations arise: to maintain security or to remediate a security incident; to scan for malware and vulnerabilities that violate the Website Terms of Use; to comply with our legal obligations; to ensure the availability of the Services; to provide support to a repository owner upon request; or on the basis of your consent.”
For example, a private repo is not routinely read by employees unless there is a security issue.
Your IP and device data can be used to guess roughly where you are.
Read the exact line
Privacy policy
“We may also derive your approximate location from this information, including country, city, state and postal code.”
For example, they may log that you are in a certain city from your IP when you sign in.
Sales and event calls can be recorded and written down for training.
Read the exact line
Privacy policy
“We may record and transcribe sales calls hosted on various videoconferencing technologies to enable our sales and support teams to share conversational insights, create training and presentations, and improve their internal processes.”
For example, a sales demo call with you could be transcribed and used internally.
You must be at least 13, except for some education licenses.
Read the exact line
Privacy policy
“Further, GitLab does not knowingly collect Personal Data from, or direct any of our Services to, children under the age of 13.”
For example, if they learn a user is 12, they say they will close the account.
They say they use basic security measures to protect your data.
Read the exact line
Privacy policy
“We employ administrative, technical, and physical security controls where appropriate, to protect your information from unauthorized access or destruction.”
For example, they point to extra security documents for GitLab.com hosting.
Words to know
Legal words from the lines above, in plain English.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- targeted advertising
- Ads chosen for you based on what you have done across other apps and websites, not just this one. For example, you look at shoes in one app and see shoe ads in a totally different app the next day.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- prompt
- What you type or say to an AI to get a response. For example, asking a chatbot to write a birthday message is a prompt, and it may be stored.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
- inputs and outputs
- Inputs are what you type, say or upload to an AI; outputs are what it gives back to you. For example, the question you ask a chatbot is an input and its answer is an output, and both may be stored.
How we got here · grade B · score 50/100 · 15 of 15 policy answers backed by a verified quote · 5 not stated
What does the app collect beyond what it needs to work?
They collect account and profile details, your repos and comments, payment info if you pay, plus device IDs, IP, cookies, and usage metrics.
Does it record your voice, face or body, and what happens to that?
They may record and transcribe webinars, trainings, and sales calls, and keep a website chatbot transcript for 12 months.
Are your chats and uploads used to train AI models, and is that off by default?
They say they will not use your AI inputs to train language models without your instruction or prior consent.
Can employees or contractors read your conversations, and when?
They say they do not process private groups except for hosting, security, malware scans, legal duties, uptime, support on request, or consent.
Are you profiled or tracked for advertising?
They use cookies for interest-based ads and tools such as Google Analytics and Google Signals, with cookie controls described.
Do they sell or share your data, and can you opt out?
They share with service providers, affiliates, and, where permitted and with consent if required, partners and resellers.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
Not stated in the documents.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
Not stated in the documents.
Do they commit to basic security, and have they leaked data?
They describe administrative, technical, and physical security controls and point to more detail for GitLab.com.
Is there a real age gate, and are teens protected?
Users must be at least 13 except for educational licenses; they close accounts if they learn someone is under 13.
Will they tell you when the rules change, and is the policy specific?
The policy is dated. For significant changes they post a homepage notice and may email you.
Can they close your account without warning, and can you get your data out first?
They may delete inactive accounts and say they will email you first; the terms page does not describe a full export-before-close process.
If something goes wrong, who pays?
Not stated in the documents.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 6,192 words at a professional or legal expert level (Flesch reading ease 7.3); the terms are 1,214 words at a college graduate level.
