Legal

Privacy Policy

How CanyonTechs collects, uses, and protects your information.

Effective: May 1, 2026 · Last updated: June 6, 2026

1. Overview

Canyon Technologies LLC ("CanyonTechs", "we", "our") operates the CanyonTechs AI / AMP platform (the "Service"). This Privacy Policy explains what information we collect when you use the Service, how we use and share it, and the choices you have. By creating an account or otherwise using the Service, you agree to the practices described here.

This policy applies to the marketing website, the AMP web console, the API, and the open-source agents we publish (log-agent, Vector bundle, AWS scripts) when they are configured to transmit data to our Service. Because AMP processes production logs and source code on your behalf, much of the data we handle is your Customer Data for which you are the controller and we are the processor; for your own account and the marketing site, we act as the controller.

2. Information we collect

2.1 Account information

When you sign up we collect your name, work email, password (stored as a salted hash), and — if provided — your company name. If you authenticate with GitHub or Google we receive the basic profile fields those providers expose (display name, email, avatar URL). We do not receive your GitHub or Google password.

2.2 Workspace and project metadata

Repository URLs, branch names, language selection, integration credentials (GitHub / GitLab / Jira tokens), Context7 keys, and any other configuration you provide. Credentials are encrypted at rest using AES-256.

2.3 Log and incident data

Log lines, stack traces, and exception payloads transmitted to the /api/ingestion/logs or /api/parser/ endpoints, including any contextual metadata your agent attaches (hostname, service name, trace IDs, timestamps). Logs may incidentally contain personal data if your application emits it — you control what you send us (see §4).

2.4 Source code

To remediate an incident the agent clones the relevant repository into a single-use sandbox. Source code is processed ephemerally and is not retained as a corpus — see §4 for exactly what we keep and for how long.

2.5 Usage and telemetry

Standard server logs (IP address, user agent, request path, timestamps), product analytics events (which pages you visit in the console, which actions you trigger), and aggregated remediation outcomes (success rate, latency).

3. How we use information

  • Operate the Service. Detect incidents, run remediation agents, open pull requests, and file tickets on your behalf.
  • Improve product quality. Aggregate, de-identified incident patterns help us improve our parsers, prompts, and agent reasoning. We never train third-party models on your logs or source code, and we do not train our own production models on the contents of your repositories.
  • Account management. Authentication, billing, customer support, and security notifications.
  • Legal & safety. Investigate abuse, enforce our Terms, and comply with applicable laws.

4. How we handle source code and logs

Source code is treated as the most sensitive data we touch.

  • Ephemeral clones. Repositories are cloned into a per-run sandbox, used by the agent, and deleted immediately after the remediation completes (success or failure).
  • No code at rest. We do not persist full source code beyond the lifetime of a single remediation run. The only artifacts we retain are: the incident ID, the file path and line range that the agent modified, the diff, the resulting PR URL, and agent step logs.
  • Branch protection. The agent opens a pull request for human review. It cannot push to main or other protected branches.
  • Log payloads. Raw log lines are retained for the duration of your plan's audit window (see §9). You can purge specific incidents or all log payloads from the console at any time.
  • Your control. You decide which repositories to connect and what logs to ship. Scrubbing secrets and personal data from logs before they leave your environment is supported by our agents and recommended.

5. AI and LLM processing

AMP uses large language models (LLMs) to analyze incidents and generate fixes. This section makes the data flow explicit so you can decide what is acceptable for your organization.

  • What is sent. To produce a remediation the agent sends the model relevant log excerpts and the specific source-code snippets it is reasoning over — not your entire repository.
  • Who receives it. The model provider configured for your workspace. You may bring your own API key (OpenAI, Anthropic, Azure OpenAI, a self-hosted endpoint, etc.), in which case we are a pass-through and that provider's terms govern the traffic. If you opt into the managed model we operate, we send the traffic to our configured provider under a zero-retention / no-training agreement.
  • No training on your content. We do not use your logs or source code to train any model, and we contractually prohibit our managed LLM providers from training on traffic sent under our key.
  • No persistence of prompts. We do not log or store the prompt/response bodies exchanged with the model beyond the transient lifetime of the run; we retain only the resulting diff and step metadata described in §4.
  • Self-hosting. Enterprise customers can run AMP and point it at an in-cluster model so that no code or logs leave their network boundary.

6. Third-party services and integrations

We use a small set of sub-processors to operate the Service. By using the Service you authorize the relevant data flows below. A current, itemized sub-processor list is available on request and on our Security page.

  • Cloud hosting. AWS (compute, storage, networking) in the regions you select at workspace creation.
  • Email. Postmark, for transactional email (sign-up, password reset, security notifications).
  • Payments. Paddle.com Market Limited, which acts as our Merchant of Record for paid plans. Paddle processes your billing details, handles tax, and is the seller of record on your receipt; their privacy policy governs that processing. We never see or store full card numbers.
  • Error tracking. Sentry, for product diagnostics. Stack traces are scrubbed of obvious secrets before they leave your browser.
  • Model providers. Whichever LLM endpoint you configure for your workspace — see §5.

6.1 GitHub / GitLab OAuth and repository access

When you connect GitHub or GitLab (via OAuth or a personal/installation access token) we receive only the scopes you grant — typically read access to repository contents and write access to open pull requests on repositories you select. We store the resulting token encrypted (AES-256, envelope-encrypted with AWS KMS) and use it solely to clone repositories and open PRs for the actions you authorize. We do not access repositories you have not connected. You can revoke access at any time from your GitHub/GitLab settings or by disconnecting the integration in the AMP console.

6.2 Jira

When you connect Jira we receive the API token or OAuth grant you provide and use it to create and update issues that correspond to AMP incidents. We read and write only the projects you designate. We store the credential encrypted and never use it to read unrelated projects. Issue content you push to Jira is governed by Atlassian's terms once it leaves the Service.

If you are in the EEA, UK, or Switzerland, we process personal data on the following legal bases:

  • Performance of a contract — to provide the Service you have signed up for (account, remediation, billing).
  • Legitimate interests — to secure, maintain, and improve the Service in aggregate and de-identified form, balanced against your rights.
  • Legal obligation — to retain billing records and respond to lawful requests.
  • Consent — where required, e.g. certain optional analytics; you may withdraw consent at any time.

For Customer Data we process under your instruction, you are the controller and we act as your processor under a Data Processing Addendum (available on request).

8. International data transfers

We are based in the United States and our default hosting region is us-east-1. If you access the Service from outside the US, your information will be transferred to and processed in the US and other countries where we or our sub-processors operate. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum / Swiss equivalents) together with supplementary safeguards. EU customers can pin processing to eu-central-1 at workspace creation; Enterprise customers can request data residency in other regions we operate.

9. Retention

  • Account data: retained while your account is active and for 30 days after account deletion.
  • Incident metadata & agent step logs: 7 days (Starter), 90 days (Professional), indefinite or per contract (Enterprise).
  • Raw log payloads: same as your plan's audit window above, or until you delete them — whichever is sooner.
  • Source code clones: deleted within minutes of the remediation run finishing.
  • LLM prompt/response bodies: not persisted beyond the run.
  • Billing records: retained for 7 years as required by tax law.

10. Your rights

Depending on your jurisdiction (GDPR, UK GDPR, and similar regimes) you may have the right to access, correct, port, restrict or object to the processing of, or delete your personal information. You can exercise most rights directly inside the console — your settings page exposes export and deletion tools. For requests we cannot service through the product, email [email protected] and we will respond within 30 days.

If you are an EU/UK data subject and want to lodge a complaint with a supervisory authority, you have the right to do so. We are happy to provide our Data Protection Officer's contact details on request.

11. California privacy rights (CCPA / CPRA)

Canyon Technologies is a California company and serves California residents, so the California Consumer Privacy Act, as amended by the CPRA, applies to our handling of personal information about California consumers.

11.1 Categories of personal information

In the past 12 months we have collected the following statutory categories: identifiers (name, email, account ID, IP address); commercial information (plan, billing records held by our Merchant of Record); internet/network activity (console usage, server logs, analytics events); and professional information (employer/company name). Customer Data you submit (logs, code) may incidentally contain other categories that you control. We collect these from you directly, from your authentication provider, and automatically through your use of the Service, for the business purposes described in §3.

11.2 We do not sell or share your personal information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the CPRA. We have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of minors under 16.

11.3 Your California rights

  • Right to know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom it is disclosed.
  • Right to delete personal information we have collected, subject to legal exceptions.
  • Right to correct inaccurate personal information.
  • Right to opt out of sale or sharing — not applicable here because we do neither.
  • Right to limit use of sensitive personal information — we do not use sensitive personal information for purposes that trigger this right.
  • Right to non-discrimination for exercising any of these rights.

To exercise a right, use the tools in your console settings or email [email protected]. We will verify your request against your account information. You may use an authorized agent to submit a request on your behalf with written permission. California residents may also request information under California's "Shine the Light" law (Civil Code §1798.83); as stated above, we do not share personal information with third parties for their own direct marketing.

12. Data breach notification

We maintain a documented security incident response plan. If we become aware of a personal-data breach that affects your data, we will:

  • Notify affected customers without undue delay, and where we act as your processor, within the timeframe required by your Data Processing Addendum (and in any event within 72 hours of confirmation), so you can meet your own GDPR/CCPA notification obligations.
  • Provide the nature of the breach, the categories and approximate volume of data involved, the likely consequences, and the remediation steps taken or planned, to the extent known.
  • Notify regulators and affected individuals where required by applicable law (e.g. California Civil Code §1798.82).
  • Cooperate with your reasonable investigation and follow up with a written post-incident report.

13. Security

We encrypt data in transit (TLS 1.2+) and at rest (AES-256). Production access is gated by SSO with MFA, scoped IAM roles, and complete audit logging. See our Security & Compliance page for our current SOC 2 status, sub-processor list, and incident response commitments.

No system is perfectly secure. If you discover a vulnerability, please report it to [email protected] — we run a responsible disclosure program.

14. Children

The Service is intended for engineering professionals and is not directed at children under 16. We do not knowingly collect information from anyone under 16.

15. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified by email to your account address and posted at the top of this page at least 14 days before they take effect. Continued use of the Service after the effective date constitutes acceptance.

16. Contact

Questions about this policy, or to exercise a privacy right? Reach us at [email protected] or +1 925 795 1944.

Canyon Technologies LLC
Attn: Privacy
795 Winterside Circle
San Ramon, CA 94583, USA
+1 925 795 1944

This document is informational and is not legal advice. If you need to vet our practices against a specific compliance regime, contact us — we are happy to provide a DPA, sub-processor list, and security questionnaire.