Third-Party Privacy Notice

This Third-Party Privacy Notice explains how Tembo Data Systems, Inc. ("Tembo", "we", "us", or "our") handles personal data of individuals who are not direct users of our platform but whose data may be encountered or processed in the course of providing our services.

This notice should be read alongside our Privacy Policy and Data Processing Addendum.

1. Who This Notice Applies To

This notice applies to individuals whose personal data may be processed by Tembo in the following contexts:

• Contributors to customer repositories: Developers, contractors, or other contributors whose names, email addresses, or other identifying information appear in source code, commit history, or documentation within repositories connected to Tembo.
• Individuals referenced in issue trackers: People mentioned in issues, bug reports, or project management tools (such as Linear, Jira, or GitHub Issues) that are integrated with Tembo.
• End users of customer products: Individuals whose personal data may be present in databases, logs, or code that customers connect to Tembo.
• Business contacts: Individuals whose information we receive through business interactions, referrals, or publicly available professional sources.

2. What Data We May Process

The types of third-party personal data we may encounter include:

• Names and email addresses in code comments, commit metadata, or documentation
• Usernames and profile information from integrated services
• Any personal data present in source code, configuration files, or database schemas that customers connect to Tembo
• Contact information provided through business interactions

3. How We Process This Data

Third-party personal data is processed only as necessary to provide our services to our customers. Specifically:

• Code analysis: When Tembo clones and analyzes a customer's repository, we may process personal data present in the codebase (such as author names in commit history) as part of providing AI-powered code analysis and generation.
• Issue tracking integration: When connected to issue tracking tools, we may process names and assignments of individuals referenced in issues.
• AI processing: Personal data encountered in code or documentation may be included in context sent to AI language model providers. These providers do not use API data for model training (see our Privacy Policy for details on provider policies).

We do not use third-party personal data for marketing, profiling, or any purpose beyond what is necessary to deliver our services to customers.

4. Legal Basis for Processing

We process third-party personal data on the following legal bases:

• Legitimate interests: Processing is necessary for the legitimate interests of our customers in using our AI coding services, provided these interests are not overridden by the rights of the data subjects.
• Contractual obligation: As a processor, we process data on behalf of our customers (the controllers) under the terms of our Data Processing Addendum.

5. Data Retention

Third-party personal data encountered during service delivery is not independently stored by Tembo beyond what is necessary for active service provision. Code and repository data is processed in sandboxed environments and is not retained after the completion of the relevant task (such as generating a pull request).

For data retained by our AI providers, please refer to the retention policies described in our Privacy Policy.

6. Your Rights

If you believe your personal data is being processed by Tembo through a customer's use of our services, you have the following rights under applicable data protection laws:

• Right of access: You may request information about whether and how your personal data is being processed.
• Right to rectification: You may request correction of inaccurate data.
• Right to erasure: You may request deletion of your personal data, subject to any legal obligations.
• Right to restriction: You may request that processing of your data be restricted in certain circumstances.
• Right to object: You may object to processing based on legitimate interests.

To exercise these rights, please contact us at privacy@tembo.io. In many cases, we may direct you to the relevant Tembo customer (the data controller) to fulfill your request.

7. Contact Us

If you have any questions about this notice or how your data is handled, please contact us at: privacy@tembo.io

Tembo Data Systems, Inc.
2900 Reading Road, Suite 310
Cincinnati, Ohio 45209
United States