Autonomous/Engine Get started
§ LEGAL

Last updated · 2026-04-18

Last updated: April 18, 2026

This Privacy Policy describes how the operator of autonomousengine.org (“we”, “us”) collects, uses, and shares personal information in connection with (a) the autonomousengine.org marketing site and (b) the Autonomous Engine license server at api.autonomousengine.org. It does not cover the Autonomous Engine software you run on your own infrastructure — see Section 4 for why.

If you have questions, contact [email protected].

1. Who this applies to

This policy applies to:

  • visitors to autonomousengine.org;
  • people who create an account, sign up for the mailing list, or submit an inquiry through the site; and
  • customers whose installations communicate with our license server for activation, renewal checks, or billing webhooks.

2. Information we collect

From the website.

  • Page-view analytics. We use Plausible Analytics, which captures aggregated counts of page views, referrer, rough country, browser, and device class. Plausible does not use cookies and does not collect personal identifiers. We do not run session replay.
  • Forms. If you submit an email address (mailing list, demo request, support), we collect the address and the content of your message.

From the checkout and license server.

  • Account and billing data. When you subscribe, Stripe collects your name, email, billing address, and payment method and passes us the metadata we need to provision a license: email, billing country, subscription tier, status, start/renewal dates, invoice numbers, and the Stripe customer ID. We never see your card number.
  • Custom fields. If you purchase a source-access add-on, we also collect the GitHub username(s) you enter at checkout so that we can grant repository access.
  • License issuance log. Each time a license is issued, renewed, or revoked, we record the license key identifier, the Subscription it belongs to, the time, and (if provided by the client) a non-identifying host fingerprint derived from the deployment. The fingerprint is a short hash; it is not linked to any personal device identifier.
  • Operational logs. Request logs for the license server may contain IP address, user-agent, path, and response code. We retain these for up to 30 days for security and debugging.

From marketing emails. If you subscribe to our announcements list, our email provider (Resend) records delivery and open events (opens only if your client loads images). You can unsubscribe at any time from the footer of any email.

3. What we do with it

We use the information above only to:

  • operate the website, the license server, and the checkout;
  • fulfill the Subscription (provisioning, renewal, invoicing, tax calculation);
  • provide support and respond to your inquiries;
  • enforce the Terms of Service and the EULA and protect against fraud, abuse, and security incidents;
  • comply with legal obligations (tax, accounting, lawful-process responses); and
  • send operational email about your Subscription, and — only if you opt in — occasional announcement email about new releases.

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not train models on it.

4. What we do not collect

Autonomous Engine is a self-hosted product. It runs on your infrastructure. The following never reach our servers:

  • your source code, repositories, or artifacts;
  • your tickets, issues, or project-management data;
  • prompts, model output, or any conversation between AE and a language model;
  • your customers’ or users’ data;
  • any logs AE produces on your infrastructure;
  • integration credentials (GitHub tokens, Jira tokens, LLM API keys) — these live only in your installation’s credential store.

The license server’s only interaction with your installation is a periodic signed-JWT exchange that carries the license key and a short host fingerprint. That is the entire data flow.

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR:

  • Contract — to provision and bill your Subscription, and to provide support.
  • Legitimate interests — operating and securing the website and license server; limited analytics; responding to inquiries. You may object to processing based on legitimate interests as set out in Section 7.
  • Consent — for marketing emails. You can withdraw consent at any time.
  • Legal obligation — for tax, accounting, and lawful-process responses.

6. Subprocessors

We rely on the following processors to operate the service. Each has been selected for its own compliance posture, and each processes personal information only on our instructions.

  • Stripe, Inc. — payment processing and subscription billing.
  • Resend, Inc. — transactional and, where you have opted in, marketing email delivery.
  • Cloudflare, Inc. — DNS, CDN, and (if configured) tunnelling for the license server.
  • Our hosting provider(s) for the license server and website, as listed on the current subprocessor addendum (available on request at [email protected]).

We will update this list when we add or change subprocessors. Enterprise customers may request advance notification and a right to object.

7. Your rights

Subject to the limits of applicable law, you have the right to access, correct, delete, export, or restrict processing of the personal information we hold about you, and to object to processing based on our legitimate interests. If you are in the EEA, UK, California, or a jurisdiction with similar rights, those rights apply automatically. To exercise any of these rights, email [email protected]. We will respond within 30 days or the period required by applicable law, whichever is shorter.

You may also lodge a complaint with your local data-protection authority.

8. Retention

We keep personal information only as long as we need it for the purposes above:

  • billing and tax records — as required by applicable tax and accounting law (generally 7 years);
  • license issuance log — for as long as the Subscription is active and 3 years after termination, for dispute resolution;
  • operational logs — up to 30 days;
  • marketing subscribers — until you unsubscribe, then removed within 30 days.

9. International transfers

We operate in the United States. If you are outside the US, your personal information will be transferred to and processed in the US. Where legally required, we rely on Standard Contractual Clauses or equivalent safeguards with our subprocessors.

10. Security

We take commercially reasonable administrative, technical, and physical safeguards to protect personal information: encryption in transit (TLS), encryption at rest for billing and credential data, least-privilege access controls, and audit logging. No system is perfectly secure. We cannot and do not guarantee that unauthorized access, loss, or disclosure will never occur.

11. Children

The service is not directed to children under 16. We do not knowingly collect personal information from children under 16.

12. Changes

We may update this policy. Material changes will be announced on the site or by email to account holders at least 14 days before taking effect.

Contact

[email protected]