01In short
- DevBench is a tool for software teams. It processes what it needs to run your workspaces and tell you about them. Nothing is collected for advertising or profiling, and nothing is sold.
- Two kinds of data, two places. Account data (who you are, which organization you belong to, billing) is held by Vesprr LLC. Workspace data (repositories, chat, notes, recordings, docs, media) is held on the host your organization chose: DevBench compute, or a host you run.
- Accounts are invite only. The product is for organizations, not the general public, and not for children.
- You can ask for a copy of your data or its deletion at any time. See section 9.
02Who is responsible
The controller for the data described here is Vesprr LLC, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, USA, a New Mexico limited liability company. We build and sell DevBench, at devbench.sh.
For anything in this policy, write to hello@devbench.sh. We have not appointed a data protection officer.
When your organization runs DevBench on a host it controls, your organization is the controller for the workspace data on that host and Vesprr LLC is a processor for it, under the data processing agreement.
03Where data lives
| Data | Where it is held | Who can reach it |
|---|---|---|
| Account data: users, organizations, memberships, roles, invite codes, API keys, billing | Vesprr LLC's server in the European Union (Contabo, Germany) | You and your organization's owners through the product; Vesprr LLC staff for support and billing |
| Workspace data: repository clones, branches, chat, notes, task timelines, recordings, docs, media, previews, deployments | The host your organization chose: DevBench compute in the EU, or a host you run | Members of your organization by role; Vesprr LLC staff only on DevBench compute, only for support you asked for, and logged |
| Provider tokens (GitHub, GitLab), cloud credentials, secrets | The same host as the workspace data, encrypted at rest | Never returned by the API; used by the server to clone, push and deploy on your behalf |
The line matters because it is what “runs on your host” means: on a host you run, your source code, your chats and your recordings never pass through a machine Vesprr LLC operates.
04What we process, and why
Each row is a feature. If the feature is not used, the data is not collected.
| What | Why |
|---|---|
| Username, email address, password (as a salted hash) | To sign you in and let your team recognise you. The email is for account matters, not marketing. |
| Your commit email and name | Every commit a workspace's box makes is authored as the person who asked for it. This is how. |
| Organization, membership, role | To decide what you may see and do. |
| Messages, files and notes in a workspace's chat and timeline | To deliver them to your team and the workspace's agent, and to keep the history. |
| Repositories, branches, merge requests, tasks, releases, deployments | To run the workspaces you create. |
| Recorded demos and uploaded media | Because you or an agent recorded or uploaded them for the workspace. |
| Push notification tokens, device platform and name | To reach the right handset, and to show you which devices are registered. |
| The audit log: sign-ins and actions taken in a workspace | Security, troubleshooting, and so a team can see who changed what. |
| The text on a box's terminal screen, with obvious secrets masked | Only if your organization turns on box health: to judge whether the agent is stuck and which key frees it. The screen is sent to TypeSafe AI (section 6); DevBench keeps a hash of it, not the text, with what was decided and pressed. |
| Usage: agent spend and compute minutes per workspace | To show the Usage page and, on paid plans, to bill. |
| Billing name, address, VAT ID, invoices | To invoice your organization, as tax law requires. Card details are held by the payment provider, not by us. |
| An access request from this site: email, name, team size, repositories, where it should run, plan, message, the page it was sent from, a hash of the IP address | To reply, and to spot one address submitting the form in bulk. The IP is stored only as a salted hash. |
We do not collect location, contacts, photos, calendars, microphone or camera data, or an advertising identifier. The apps declare no permission for any of them.
05Legal bases
- Contract (Art. 6(1)(b) GDPR): running the account and the workspaces your organization asked for, and replying to an access request.
- Legal obligation (Art. 6(1)(c)): keeping invoices for the period tax law requires.
- Legitimate interest (Art. 6(1)(f)): the audit log, rate limiting, abuse prevention and cookieless site analytics. You can object; see section 9.
- Consent (Art. 6(1)(a)): only where we ask for it, such as a product update mail. Withdraw it any time.
06Subprocessors
We use a small number of processors, each for one job. None may use your data for its own purposes. The list is kept current here; customers on a data processing agreement are told of changes in advance.
| Who | What for | Where |
|---|---|---|
| Contabo GmbH | Runs the servers that hold account data and DevBench compute. | Germany (European Union) |
| Amazon Web Services | Hosts this website and the DevBench web app. It serves pages and files; it holds no account data. | United States |
| Stripe | Checkout, invoices and card storage for paid plans. | United States |
| Google (Google Analytics), Mixpanel | Usage analytics for this website and the product, only once enabled and only with your consent. See section 10. | United States |
| Google (Firebase Cloud Messaging), Apple (APNs) | Deliver push notifications to phones. They receive the notification content and the device token. | United States |
| Anthropic (Claude Code) | In a workspace that runs Claude Code, the agent sends prompts, and the code it reads, to Anthropic's models, on the account your organization added. | United States |
| OpenAI (Codex) | In a workspace that runs Codex, the agent sends prompts, and the code it reads, to OpenAI's models, on the ChatGPT sign-in or API key your organization added. | United States |
| TypeSafe AI (optional) | Only if your organization turns on box health. Judges from the text on a box's terminal screen whether the agent is stuck, with obvious secrets masked before it is sent. Off by default. | Given on request |
Your git provider (GitHub or GitLab) and any cloud you deploy to (AWS, Hetzner, DigitalOcean, Vultr) are not our subprocessors. They are yours: you hold the account, and DevBench acts on it with credentials you gave.
07How long we keep it
- Account data: while the account exists, then 30 days, then deleted. Backups roll off within 90 days.
- Workspace data on DevBench compute: while the workspace exists. Deleting a workspace deletes its box, its volume and its media. Organization backups are yours to delete.
- Workspace data on a host you run: your retention, your backups. We hold none of it.
- Audit log: 12 months.
- Invoices: for as long as tax law requires.
- Access requests from this site: 12 months after the last contact, then deleted.
08Transfers outside the EU
Account data and DevBench compute are in the European Union. Where a subprocessor above is outside the EU, the transfer rests on the European Commission's standard contractual clauses or an adequacy decision, and we can show you the mechanism on request.
09Your rights
Under the GDPR you can ask us to:
- tell you what data we hold about you, and give you a copy (access, portability);
- correct it;
- delete it, where we have no legal reason to keep it;
- restrict or stop processing it, including any processing based on legitimate interest;
- withdraw consent you gave.
Write to hello@devbench.sh. We answer within one month. You can also complain to the data protection authority of the EU or EEA country where you live or work.
When your organization is the controller (workspace data on its own host), send the request to your organization's owner; we help them answer it.
11Security
Provider tokens and secrets are encrypted at rest and never returned by the API. Merge is human only, for every caller. Protected branches are refused in the box and again on the server. Every action in a workspace is in the audit log. The security page names the code path that enforces each of these, and its Trust section describes the hosting model and how to report a vulnerability.
12Changes to this policy
When this policy changes, the date at the top changes with it and the previous version stays available on request. A change that affects what we collect or why is announced to organization owners by mail before it takes effect.
13Contact
Vesprr LLC, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, USA.
hello@devbench.sh for anything about your data.
security@devbench.sh for a vulnerability report.