Privacy policy

BranchDeploy is operated by Pixel Funnel Ltd, a company registered in England and Wales (Company No. 8497619). Our registered address is available on request.

Summary

The free tier of BranchDeploy runs inside your Azure DevOps organisation. Its configuration is stored in Azure DevOps Extension Data storage, and the deploy action itself sends no work item, branch, or pipeline data to Pixel Funnel Ltd. The extension does check your licence status and send anonymous usage telemetry (which you can turn off). The Pro tier stores your account, synced project settings, deployment records, and any release notes you write (not code) in a backend hosted on Cloudflare infrastructure. Connecting an AI assistant such as ChatGPT or Claude is optional; if you do, what it reads is covered in AI assistants.

Data controller

Pixel Funnel Ltd is the data controller for personal data processed in connection with BranchDeploy. Contact: privacy@pixelfunnel.co.uk.

What we collect

Free tier

The free tier keeps your configuration within your Azure DevOps organisation and sends only the limited data described below to Pixel Funnel Ltd:

• Extension configuration (pipeline ID, environment name, parameter names, branch patterns) is stored in Azure DevOps Extension Data — Microsoft's per-project document store for Marketplace extensions. It is subject to Microsoft's privacy policy and data residency settings for your organisation.
• Azure DevOps API calls are made using your active browser session. Pixel Funnel Ltd never receives your Azure DevOps session credentials, with one exception: when you connect the extension to a BranchDeploy workspace, it sends us a short-lived Azure DevOps access token once. We use it only to confirm the request came from inside your organisation, and do not store it.
• Licence check. The extension asks the BranchDeploy backend whether your Azure DevOps organisation has a Pro licence. This request includes your organisation name.
• Anonymous usage telemetry, described below, unless you turn it off.

Pro tier

When you use Pro features, BranchDeploy stores:

• Your account: the email address and display name of each member, their role, and when they last signed in; how each account first reached our sign-in page (the page or site that linked to it, and any campaign tags on that link); the Azure DevOps organisation your workspace is linked to; and your plan and billing status.
• Synced project settings: project names and IDs, environment names, pipeline IDs and names, pipeline variable names and values you configure, and branch rules.
• Deployment records: for each deployment, the Azure DevOps organisation, project and repository, work item ID, title, type and state, branch, environment, the name and email of the person who triggered it, where it came from (Azure DevOps, Teams, or an AI assistant), the pipeline run ID and link, timestamp, and outcome.
• Credentials: an Azure DevOps personal access token, if you save one for the Teams bot or AI assistant features, encrypted at rest; and hashed copies of MCP API keys, extension connection tokens, and AI assistant sign-in tokens. For each MCP API key we also store which member it belongs to and when it was last used.
• Release notes: the customer-facing wording you write, its title, summary, version label and release date, and a reference to the deployments and work item IDs each entry came from. Published entries are stored as a public snapshot and served without authentication at the feed and page URLs you share. Drafts are private until you publish.
• Teams: your Microsoft Teams tenant ID and the conversation where the bot is installed, and the Teams display name of people who request deployments.
• Workspace move requests: if someone connects the extension in an Azure DevOps organisation that is already linked to another BranchDeploy workspace, we record the request, and the Azure DevOps display name and sign-in account (usually an email address) of the person who made it.

We do not collect source code or commit messages. We do not store work item descriptions: where a description is shown to you, or sent to an AI assistant you have connected, it is read from Azure DevOps at that moment and not written to our database. See AI assistants below.

Anonymous usage telemetry

BranchDeploy collects limited anonymous usage telemetry to help us understand extension usage and diagnose reliability issues. This may include extension version, event type, success/failure status, broad error codes, coarse branch and environment categories (for example “feature” or “staging”), and hashed Azure DevOps identifiers. Identifiers are hashed with a server-side secret before storage, so we cannot reverse them to the original organisation, project, or user.

We do not collect repository names, branch names, organisation names, project names, user emails, access tokens, commit messages, pull request titles, or pipeline variables. Telemetry is best-effort and never blocks deployments. You can disable it at any time from Project Settings → BranchDeploy under “Anonymous usage telemetry”. Raw telemetry events are retained for up to 12 months.

Website visitors

This website (branch-deploy.dev) does not use advertising cookies, and our analytics stores nothing on your device: no cookies, local storage or session storage. We use PostHog (hosted in the EU) in its cookieless mode to understand how the site is used. It records the pages you view, the links and buttons you click, how far you scroll, your referring site and campaign tags, and your browser, device type and approximate location. To count unique visitors without a cookie, PostHog derives a temporary identifier on its servers from request details such as your IP address and browser, which resets each day, so we cannot follow you from one day to the next or across other websites. We do not record your screen or keystrokes, and form contents are never captured.

If you sign in to your account, we set a strictly necessary session cookie to keep you signed in. Usage of the account pages is recorded against your internal account and workspace IDs, not your name or email address, so we can see which features are used and improve them. Sign-in links, invitation links and payment references are removed from page addresses before anything is recorded. Our servers record key account milestones the same way, against those IDs: signing up, creating or joining a workspace, connecting the extension, Microsoft Teams or an AI assistant, saving an Azure DevOps token, deployments being queued and how they finished, and subscription and payment changes. These never include branch names, work item details, your name or your email address. Account pages also report errors to Sentry so we can fix problems. Cloudflare Pages may log anonymised request metadata (IP addresses are not stored by us).

Support communications

If you email us for support, we store your email address and message content for the purpose of responding to your request. We do not add you to any mailing list without explicit consent.

Legal basis for processing

Where we process personal data, the legal basis is:

• Contract — processing deployment log data is necessary to deliver the Pro subscription service.
• Legitimate interests — processing support emails to respond to your request, and measuring how the website and account pages are used, in the cookieless, pseudonymous way described above, to improve BranchDeploy.

Data retention

• Deployment records are retained for your plan's audit window (90 days on Pro), then deleted automatically.
• Anonymous telemetry events are retained for up to 12 months, then deleted automatically.
• Website and account analytics events are retained in PostHog for up to 12 months.
• Account data, synced project settings, and saved credentials are kept while your account is active, and deleted when you remove them, close your account, or ask us to.
• Release notes are kept until you delete them. Deleting an entry removes it and its public snapshot permanently. Deployment records referenced by a published entry are still deleted on the normal audit window; the entry keeps your wording and loses the link.
• AI assistant usage records (which tool ran, when, and whether it worked) are retained for 90 days, then deleted automatically.
• OAuth tokens for a connected AI assistant are stored hashed and expire automatically; revoking the connection deletes them.
• Workspace move requests are kept while both workspaces involved exist, as a record of how the organisation's link changed.
• Support emails are retained for up to 2 years, then deleted.
• Free tier configuration data is stored in Azure DevOps and remains under Microsoft's retention policies. Uninstalling BranchDeploy removes the extension; the configuration documents remain in Extension Data unless deleted via the Azure DevOps Extension Data API.

Data sharing

We do not sell personal data. We share data only with:

• Cloudflare, Inc. — infrastructure provider for the BranchDeploy backend and this website. Data is processed under Cloudflare's Data Processing Addendum.
• Stripe, Inc. — payment processor. Stripe handles billing data directly. Pixel Funnel Ltd does not store payment card details.
• Sentry (Functional Software, Inc.) — error monitoring for the BranchDeploy backend, Teams bot, AI assistant server, and account pages.
• PostHog, Inc. — product analytics for this website and the account pages, hosted in the EU, in cookieless mode as described above.
• Brevo (Sendinblue SAS) — sends account sign-in and invitation emails, workspace move notifications, and a few one-off setup emails: if you sign in but don't create a workspace, or a workspace doesn't finish connecting or deploying, we email you once about that step. Each is sent at most once.
• Other BranchDeploy workspaces, for move requests only. If you ask to link an Azure DevOps organisation that is already linked to another workspace, your Azure DevOps display name and sign-in account are shown and emailed to that workspace's owners and admins, so they can decide whether to approve the move.

AI assistants (ChatGPT, Claude, and other MCP clients)

BranchDeploy can be connected to an AI assistant, including the BranchDeploy app in ChatGPT. This is optional and off until someone in your organisation connects one.

• Connecting: ChatGPT and Claude sign in with BranchDeploy OAuth. We store a hashed access and refresh token, which organisation and user they belong to, the permissions granted, and when they expire. Other MCP clients can use an API key instead, which we also store hashed. You can revoke either at any time from your account page.
• What the assistant can see: only what you ask it for, and only for your organisation — your environments, your deployment records (including work item IDs and titles), and your release notes. It cannot read anything in Azure DevOps that BranchDeploy has not already recorded a deployment for.
• Work item descriptions: an owner or admin can switch on AI drafting under Release notes, which lets a connected assistant read the description on the Azure DevOps work item behind a deployment, so release notes can be drafted from what the work actually was. This is off by default. Descriptions often contain internal detail, so turning it on is a deliberate choice. They are read live, passed to the assistant, and never stored by us. Switching it off stops it immediately.
• Drafting and publishing: an assistant can write and revise draft release notes, which we store until you delete them. Nothing becomes public until a publish is confirmed against a preview of the exact content.
• Usage records: for each tool call we record which tool ran, for which organisation and user, from which assistant, whether it succeeded and how long it took. We use these to support you and keep the service reliable. They never include what you asked, the tool's input, or what it returned, and are deleted after 90 days.
• What the provider receives: anything returned to the assistant is processed by that provider — OpenAI for ChatGPT, Anthropic for Claude — under its own terms and privacy policy, not ours. We do not control how long they keep it or whether they use it to improve their models. If that matters to you, do not connect an assistant, and leave AI drafting off.

Your rights

Under UK GDPR and the Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Data portability (where applicable)

To exercise any of these rights, email privacy@pixelfunnel.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Security

Data in transit is encrypted with TLS. Pro data is stored in Cloudflare D1 (SQLite) with access restricted to the BranchDeploy backend service. An Azure DevOps personal access token you save for the Teams bot or AI assistant features is encrypted at rest (AES-256-GCM) and never returned to any client; API keys and tokens we issue are stored only as hashes. We never receive the Azure DevOps session credentials the extension uses; the short-lived access token it sends once when connecting is checked against Azure DevOps and not stored.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last revised. Significant changes will be notified to Pro subscribers by email.

Contact

For privacy questions, email privacy@pixelfunnel.co.uk.