Terms of service

These Terms of Service (“Terms”) are an agreement between [Company legal entity], a company registered in [Country of incorporation] with its registered address at [Registered address] (“MergeHarbor”, “we”, “us”), and the organization that uses the MergeHarbor services (“Customer”, “you”).

The “Services” are the MergeHarbor hosted service (the console at app.mergeharbor.com, the API, and the review agents), the MergeHarbor software that Customer runs in its own environment under an Enterprise agreement (“Self-Hosted Software”), and related documentation and support.

1. Acceptance

By creating an account, starting a trial, or using the Services on behalf of an organization, you agree to these Terms on that organization’s behalf and confirm that you are authorized to do so. If you do not have that authority, or do not agree, do not use the Services.

If Customer signs an order form or other written agreement with MergeHarbor (“Order Form”), the Order Form forms part of these Terms and prevails over them where they conflict. These Terms incorporate the Acceptable Use Policy and, where it applies, the Data Processing Addendum (“DPA”).

The Services are for business use. They are not intended for consumers or for anyone under 16.

2. Accounts and users

2.1 Customer may allow its employees and contractors (“Users”) to access the Services under its organization. Users can sign in with Google, GitHub, GitLab, Microsoft, email and password, or a magic link, and on Enterprise plans through Customer’s own OpenID Connect single sign-on.

2.2 Customer is responsible for its Users’ compliance with these Terms, for keeping credentials and API keys confidential, for the roles and permissions it assigns, and for all activity under its organization. Customer will provide accurate account and billing information and keep it current, and will notify us promptly at security@mergeharbor.com of any unauthorized access it becomes aware of.

3. Customer Data

3.1 Definition. “Customer Data” means all data that Customer or its Users submit to or make available to the Services, including source code and repository contents, pull-request diffs, titles, descriptions and comments, commit metadata, review rules and configuration, knowledge documents, and feedback on findings. Review output generated for Customer (“Output”) is also treated as Customer Data.

3.2 Ownership. As between the parties, Customer owns Customer Data and Output. MergeHarbor acquires no rights in Customer Data except the limited license in section 3.3.

3.3 Limited license. Customer grants MergeHarbor a worldwide, non-exclusive, royalty-free license, for the term of the agreement and any deletion period after it, to host, copy, index, transmit, and process Customer Data only as needed to provide, secure, support, and maintain the Services for Customer, to prevent abuse, and to comply with law. This includes the processing described in section 4.

3.4 No model training. MergeHarbor does not use Customer Data or Output to train, fine-tune, or otherwise improve any machine-learning model, whether its own or a third party’s. MergeHarbor uses third-party model providers only under terms that prohibit them from using Customer Data to train their models. Learning from Customer’s feedback — for example, adjusting which findings are shown to Customer — is limited to Customer’s own organization and does not change any model.

3.5 Aggregated service data. MergeHarbor may collect technical and usage metrics about the operation of the Services, such as review counts, latency, error rates, and model token usage (“Service Data”), and use them to operate, bill for, and improve the Services. Service Data does not include source code or the contents of pull requests, and MergeHarbor will not disclose Service Data in a form that identifies Customer or any individual.

3.6 Customer responsibilities. Customer is responsible for having the rights and permissions needed to submit Customer Data to the Services, including under any open-source or third-party licenses that apply to its code, and for configuring which repositories are connected.

4. How the Services process code

4.1 Hosted service. To review a pull request, MergeHarbor keeps a mirror and search index of each connected repository and sends the pull-request diff, together with relevant code context retrieved from that index, to large language model (“LLM”) providers. Depending on Customer’s routing settings and the risk of the change, requests are sent to Anthropic or OpenAI. The current list of subprocessors is in the DPA.

4.2 Customer controls. Where available on Customer’s plan, administrators can restrict model processing to approved providers, models, and regions (“data residency settings”), and Enterprise customers can use their own model-provider accounts. MergeHarbor will route requests only to providers and regions permitted by Customer’s settings.

4.3 Secret redaction. MergeHarbor automatically detects and removes common credentials, such as API keys, tokens, private keys, and passwords in connection strings, before content is sent to a model, written to logs, or archived. Detection is pattern-based and cannot recognize every secret, so Customer should not store secrets in source code.

4.4 Self-Hosted Software. When Customer runs the Self-Hosted Software, Customer Data stays in Customer’s environment and is sent only to the model providers that Customer configures. MergeHarbor does not receive Customer Data from a self-hosted installation unless Customer chooses to share it, for example in a support request. Customer is responsible for the infrastructure, security, backups, and model-provider accounts of its installation.

5. AI output

The Services use AI models to generate findings, explanations, and suggested changes. Output can be incomplete or wrong, can miss defects and vulnerabilities, and can propose changes that do not work. Output is a tool to assist human reviewers. Customer is responsible for reviewing Output before relying on it or merging any code, and for features it enables that act on Output automatically, such as status checks or auto-approval. Output may be similar to output generated for other customers, and MergeHarbor does not warrant that Output is unique or free of third-party rights.

6. Acceptable use and restrictions

Customer will use the Services in compliance with the Acceptable Use Policy and applicable law. Customer will not, and will not allow anyone to: (a) copy, modify, or create derivative works of the Services, except as the Self-Hosted Software documentation allows; (b) reverse engineer or decompile the Services, except to the extent the law expressly permits despite this restriction; (c) resell, sublicense, or provide the Services to third parties except as an Order Form permits; (d) access the Services to build a competing product or to benchmark them for publication without MergeHarbor’s consent; (e) circumvent usage limits, spend caps, or security controls; or (f) submit special categories of personal data, payment card data, or protected health information except as incidentally contained in source code.

7. Plans, trials, and fees

7.1 Plans. Plans and prices are described on the pricing page or in an Order Form.

• Starter is free for one active developer and includes 50 reviews per month. When the allowance is used, reviews pause until the next month.
• Team is charged per active developer per month. Each active developer adds 100 reviews to a monthly allowance pooled across the organization. Reviews beyond the allowance are charged at the per-review overage rate on the pricing page, currently $0.30 per review.
• Enterprise fees, allowances, and rates are set in the Order Form.

7.2 Active developers and reviews. An “active developer” is a person whose pull request received a billable review during the billing month. A “review” is one completed review of one pull-request commit. The pricing page explains what is and is not counted.

7.3 Spend caps. Billing administrators can set a monthly overage limit in the console. When the limit is reached, new reviews pause until the next month or until the limit is raised. Customer will not be charged overage above a limit it has set.

7.4 Trials. MergeHarbor may offer a 14-day trial of the Team plan, or another trial agreed in writing. Trials are free. At the end of the trial, the organization moves to the Starter plan unless Customer has chosen a paid plan. Trials, Starter, and other free use are provided without any service-level commitment and may be changed or ended at any time.

7.5 Billing. Unless an Order Form says otherwise, the billing month is the calendar month (UTC). Team fees for active developers and any overage are calculated for each billing month and charged when the month’s statement is finalized, using the payment method on file. Annual and invoiced agreements are billed as stated in the Order Form. Invoices are payable within 30 days of the invoice date unless the Order Form says otherwise.

7.6 Taxes. Fees exclude taxes. Customer is responsible for all sales, use, value-added, goods and services, withholding, and similar taxes, other than taxes on MergeHarbor’s income. If Customer must withhold tax, it will gross up its payment so that MergeHarbor receives the full amount invoiced.

7.7 Late payment. If an undisputed amount is more than 15 days overdue, MergeHarbor may, after giving notice, suspend paid features until it is paid. Customer may dispute an invoice in good faith by notifying MergeHarbor before its due date, and the parties will work together to resolve the dispute.

7.8 Price changes. MergeHarbor may change prices or allowances with at least 30 days’ notice. Changes take effect at the start of the next billing month after the notice period, or, for an Order Form with a fixed term, at its next renewal.

7.9 Refunds. Fees are non-refundable except as these Terms or an Order Form state or as the law requires.

8. Term, renewal, and cancellation

8.1 Monthly plans. Self-service subscriptions continue month to month until cancelled. An owner can cancel at any time in the console. Cancellation takes effect at the end of the current billing month, and fees already incurred, including overage, remain payable.

8.2 Order Forms. Each Order Form runs for the term it states. Unless it says otherwise, it renews automatically for successive periods equal to the initial term (or 12 months, if shorter) unless either party gives notice of non-renewal at least 30 days before the end of the current term.

9. Suspension

MergeHarbor may suspend access to all or part of the Services if (a) Customer’s use poses a security risk to the Services or to others, (b) Customer materially breaches the Acceptable Use Policy, (c) payment is overdue as described in section 7.7, or (d) suspension is required by law. MergeHarbor will limit the suspension to what is reasonably necessary, give advance notice where practical and otherwise prompt notice, and restore access once the cause is resolved.

10. Termination

10.1 For breach. Either party may terminate these Terms or an Order Form by notice if the other party materially breaches them and does not cure the breach within 30 days of notice, or immediately if the other party becomes insolvent or ceases to do business in the ordinary course.

10.2 Effect. On termination or expiry, Customer’s access to the Services ends, Customer pays all fees incurred up to the effective date, and, if Customer terminates for MergeHarbor’s uncured breach, MergeHarbor refunds any prepaid fees for the remainder of the term.

10.3 Export and deletion. For 30 days after termination or expiry, Customer can export its reviews, findings, rules, usage statements, and audit log from the console or API. After that period, or earlier if Customer deletes its organization, MergeHarbor deletes Customer Data from its production systems within 30 days, including repository mirrors and indexes. Copies in backups are deleted as the backups expire, within [Backup retention period, e.g. 90] days, and stay protected under these Terms until then. MergeHarbor may keep data the law requires it to retain, and billing records, for as long as required. Repository contents remain available to Customer in its own code host throughout.

10.4 Survival. Sections 3, 5, 7 (for amounts owed), 10.3, 11, 12, 13, 14, 15, and 17 survive termination.

11. Confidentiality

11.1 “Confidential Information” means non-public information that one party discloses to the other and that is marked confidential or that a reasonable person would understand to be confidential. Customer Data is Customer’s Confidential Information. Pricing in an Order Form and non-public information about the Services are MergeHarbor’s Confidential Information.

11.2 The receiving party will use the disclosing party’s Confidential Information only to perform under these Terms, will protect it with at least the care it uses for its own similar information and no less than reasonable care, and will disclose it only to its employees, contractors, advisers, and subprocessors who need to know it and are bound by confidentiality obligations at least as protective as these.

11.3 These obligations do not apply to information that is or becomes public through no fault of the receiving party, was known to the receiving party without restriction before disclosure, is received from a third party without a duty of confidentiality, or is independently developed. A party may disclose Confidential Information when required by law, after giving the other party prompt notice where legally allowed so that it can seek protection.

12. Security and data protection

MergeHarbor maintains administrative, technical, and physical safeguards for Customer Data appropriate to its sensitivity, as described on the Security page and in Annex II of the DPA. MergeHarbor will not materially reduce the overall level of these safeguards during the term. The DPA applies to personal data that MergeHarbor processes on Customer’s behalf and is incorporated into these Terms.

13. Intellectual property and feedback

MergeHarbor and its licensors own the Services, including all software, models, prompts, documentation, and improvements, and all related intellectual property rights. Except for the rights expressly granted in these Terms, no rights are granted by either party. Subject to these Terms, MergeHarbor grants Customer a non-exclusive, non-transferable right during the term for its Users to use the Services, and, under an Enterprise agreement, to install and run the Self-Hosted Software for its internal business purposes. If Customer gives MergeHarbor suggestions or feedback about the Services, MergeHarbor may use them without restriction or obligation; this does not grant MergeHarbor any right to Customer Data.

14. Warranties and disclaimers

14.1 Each party warrants that it has the authority to enter into these Terms. MergeHarbor warrants that, during a paid subscription term, the Services will perform materially as described in the documentation and MergeHarbor will not materially decrease their overall security. If the Services do not conform to this warranty, Customer’s remedy is for MergeHarbor to use reasonable efforts to correct the non-conformity and, if MergeHarbor cannot do so within a reasonable time, for Customer to terminate the affected subscription and receive a refund of prepaid fees for the remainder of the term.

14.2 Except as stated in section 14.1, and to the extent permitted by law, the Services and Output are provided “as is” and “as available”, and MergeHarbor disclaims all other warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, title, and non-infringement. MergeHarbor does not warrant that the Services will be uninterrupted or error-free, or that Output will identify all defects or vulnerabilities. Free plans and trials are provided without any warranty.

15. Limitation of liability

15.1 Excluded damages. To the extent permitted by law, neither party is liable for any lost profits, revenue, or goodwill, or for any indirect, incidental, special, consequential, or punitive damages, even if it was advised of the possibility of them.

15.2 Cap. To the extent permitted by law, each party’s total liability arising out of or relating to these Terms is limited to the fees paid and payable by Customer for the Services in the 12 months before the event giving rise to the liability. For free plans and trials, MergeHarbor’s total liability is limited to US$100.

15.3 Exceptions. Sections 15.1 and 15.2 do not limit: (a) Customer’s obligation to pay fees; (b) a party’s indemnification obligations under section 16; (c) liability for a party’s gross negligence, wilful misconduct, or fraud; or (d) liability that cannot be limited by law. For breaches of section 11 (Confidentiality), section 12 (Security and data protection), or the DPA, each party’s total liability is limited to [Enhanced data-protection cap, e.g. two times] the amount in section 15.2.

16. Indemnities

16.1 By MergeHarbor. MergeHarbor will defend Customer against any third-party claim alleging that the Services, as provided by MergeHarbor and used in accordance with these Terms, infringe that third party’s intellectual property rights, and will pay the damages and costs finally awarded or agreed in settlement. If such a claim is made or appears likely, MergeHarbor may procure the right for Customer to continue using the Services, modify them to be non-infringing, or, if neither is commercially reasonable, terminate the affected Services and refund prepaid fees for the remainder of the term. MergeHarbor has no obligation for claims arising from Customer Data, Output that Customer modifies, combination with items not provided by MergeHarbor, use in breach of these Terms, or free plans and trials.

16.2 By Customer. Customer will defend MergeHarbor against any third-party claim arising from Customer Data, including a claim that Customer lacked the right to submit it, or from Customer’s use of the Services in breach of the Acceptable Use Policy, and will pay the damages and costs finally awarded or agreed in settlement.

16.3 Process. The indemnified party will notify the indemnifying party promptly of the claim, give it sole control of the defense and settlement (provided that no settlement may impose an admission or obligation on the indemnified party without its consent), and provide reasonable cooperation at the indemnifying party’s expense. This section states each party’s entire liability, and the other party’s exclusive remedy, for third-party claims of these kinds.

17. General

17.1 Changes to these Terms. MergeHarbor may update these Terms by posting a new version on this page. For material changes that adversely affect Customer, MergeHarbor will give at least 30 days’ notice by email or in the console, and the change will take effect at the start of Customer’s next billing month after the notice period, or, for an Order Form with a fixed term, at its next renewal. Changes required by law or to address security may take effect sooner. If Customer does not agree, it may cancel before the change takes effect.

17.2 Notices. Notices to MergeHarbor must be sent to legal@mergeharbor.com with a copy to [Registered address]. MergeHarbor sends notices to the email address of Customer’s organization owners or the address in the Order Form. Notices are effective when received, and email notices are received when sent unless the sender receives a delivery failure.

17.3 Governing law and disputes. These Terms are governed by the laws of [Governing law jurisdiction], without regard to its conflict-of-laws rules. The courts of [Courts with exclusive jurisdiction] have exclusive jurisdiction over any dispute arising out of or relating to these Terms, and each party consents to their jurisdiction. Either party may seek injunctive relief in any competent court to protect its intellectual property or Confidential Information. The UN Convention on Contracts for the International Sale of Goods does not apply.

17.4 Export and sanctions. Each party will comply with applicable export control and sanctions laws. Customer represents that it is not located in, and will not allow access to the Services from, any country or by any person subject to comprehensive sanctions.

17.5 Publicity. MergeHarbor will not use Customer’s name or logo to identify it as a customer without Customer’s prior written consent.

17.6 Assignment. Neither party may assign these Terms without the other’s consent, except to a successor in a merger, acquisition, or sale of all or substantially all of its relevant business or assets, on notice to the other party.

17.7 Subcontracting. MergeHarbor may use subcontractors and subprocessors to provide the Services and remains responsible for their performance under these Terms and the DPA.

17.8 Force majeure. Neither party is liable for delay or failure to perform caused by events beyond its reasonable control, other than payment obligations.

17.9 Entire agreement. These Terms, together with any Order Form and the documents referenced here, are the entire agreement between the parties about the Services and supersede any prior agreements on that subject. Terms in a Customer purchase order or similar document do not apply. If a provision is unenforceable, the rest remains in effect. A failure to enforce a provision is not a waiver. The parties are independent contractors, and there are no third-party beneficiaries.

Questions about these Terms: legal@mergeharbor.com.