Parties
(1) Solidafy Labs AB, org. nr 559551-4331, of Grönlingens väg 14, 174 62 Sundbyberg, Sweden ("Solidafy"); and
(2) The entity identified during account registration ("the Company"), represented by the individual accepting this agreement on the Company's behalf.
Solidafy and the Company are each a "Party" and together the "Parties".
Background
The Company wishes to use Solidafy's DevAnalytics platform for engineering analytics and AI productivity insights. For this purpose each Party will disclose to the other confidential information. The Parties enter into this Agreement to protect that information on a mutual basis.
1. Definitions
"Purpose" means the evaluation, implementation, and ongoing use of Solidafy's DevAnalytics platform by the Company, including any related discussions, integrations, and support.
"Confidential Information" means all non-public information disclosed by or on behalf of one Party (the "Discloser") to the other (the "Recipient"), in any form (written, oral, visual, electronic or other) and whether or not marked as confidential, that is by its nature confidential or that the Recipient should reasonably understand to be confidential. It includes business, technical, financial, commercial, product, customer, personnel and operational information, source code, models, prompts, datasets and know-how, and the existence and contents of this Agreement and of the discussions between the Parties.
"Platform Data" means the categories of engineering-activity telemetry, workflow metadata, and AI-usage metrics that Solidafy accesses and processes through its DevAnalytics platform in the course of the Purpose, as described in Schedule 1 (Data Categories). Platform Data is a subset of Confidential Information and is subject to the same protections.
"Representatives" means a Party's directors, officers, employees, group companies and professional advisers, in each case to the extent they need the Confidential Information for the Purpose.
2. Mutual obligations
The Recipient shall:
(a) use the Confidential Information only for the Purpose;
(b) keep it confidential and protect it with at least the degree of care it uses for its own confidential information, and in any event with no less than reasonable care;
(c) not disclose it to any third party except as permitted by this Agreement; and
(d) disclose it only to those of its Representatives who need it for the Purpose and who are bound by confidentiality obligations (whether by contract, professional duty or otherwise) no less protective than those in this Agreement.
The Recipient is responsible for any act or omission of its Representatives that would breach this Agreement if done by the Recipient.
3. Permitted disclosures
The Recipient may disclose Confidential Information to the extent required by law, regulation, a court or a competent authority, provided that (where lawful and practicable) it gives the Discloser prompt prior notice and reasonable cooperation so the Discloser may seek protective measures, and discloses only the part of the Confidential Information that is legally required.
4. Exclusions
The obligations in this Agreement do not apply to information that the Recipient can show:
(a) is or becomes public other than through a breach of this Agreement;
(b) was lawfully known to the Recipient, free of any duty of confidentiality, before disclosure by the Discloser;
(c) is lawfully received from a third party that is entitled to disclose it without restriction; or
(d) is independently developed by the Recipient without use of or reference to the Confidential Information.
5. No licence and no warranty
5.1 All Confidential Information remains the property of the Discloser. Nothing in this Agreement transfers or grants any right, title, licence or interest in any Confidential Information or intellectual property, except the limited right to use it for the Purpose.
5.2 Confidential Information is provided "as is". The Discloser does not warrant its accuracy or completeness, and the Recipient relies on it at its own risk.
6. Return and destruction
On the Discloser's written request, or on termination of this Agreement, the Recipient shall promptly return or destroy (at the Discloser's option) the Confidential Information and any copies, and on request confirm in writing that it has done so. The Recipient may retain copies to the extent required by law or by its bona fide internal compliance or backup procedures, and copies that are not practicable to delete from secure electronic backups, provided that any retained copy remains subject to this Agreement.
7. Data protection
7.1 Each Party shall comply with applicable data protection law (including the GDPR) in connection with the Purpose.
7.2 In the course of the Purpose, Solidafy will access and process Platform Data (as defined in Clause 1 and described in Schedule 1). The Platform Data consists of engineering-activity telemetry and AI-usage metrics only. Solidafy does not access source code, file contents, code diffs, ticket description bodies, comment text, AI prompt/response content, or any end-customer or production application data.
7.3 Where Platform Data includes personal data (such as developer usernames, names, or email addresses), Solidafy processes it solely for computing aggregated team-level delivery, productivity, and AI-impact metrics. Developer identities are aggregated or anonymised in dashboards where the use case allows.
7.4 The Parties shall comply with the separate Data Processing Agreement accepted during registration, which sets out the specific processing activities, categories of data subjects, and technical and organisational measures.
8. Term and survival
8.1 This Agreement takes effect on the date of acceptance and continues until terminated by either Party on 30 days' written notice, or on closure of the Company's account.
8.2 The Recipient's obligations in respect of Confidential Information survive termination for a period of five (5) years, save that the Recipient's obligations in respect of source code, models, prompts, datasets and technical know-how survive indefinitely.
8.3 Confidential Information that constitutes a trade secret remains protected under this Agreement for as long as it qualifies as a trade secret under applicable law.
9. No obligation and no partnership
This Agreement does not oblige either Party to proceed with any particular engagement, to disclose any information, or to enter into any further agreement, and it does not create any exclusivity. It does not create any partnership, joint venture, agency or employment relationship between the Parties.
10. Remedies
The Parties acknowledge that a breach of this Agreement may cause harm that cannot be adequately compensated by damages alone. In addition to any other remedy, the Discloser is entitled to seek injunctive or other interim or equitable relief from any court of competent jurisdiction.
11. General
11.1 Assignment. Neither Party may assign or transfer this Agreement without the other's prior written consent, except that either Party may assign it to a group company or in connection with a reorganisation of its business.
11.2 Entire agreement. This Agreement (including its Schedules) is the entire agreement between the Parties on its subject matter and supersedes any prior understanding on that subject matter.
11.3 Variation. Any variation of this Agreement must be in writing and agreed by both Parties.
11.4 Waiver. No failure or delay in exercising a right under this Agreement is a waiver of that right.
11.5 Severance. If any provision is held invalid or unenforceable, the remainder of this Agreement continues in force and the Parties shall replace the affected provision with a valid provision of similar effect.
11.6 Electronic acceptance. This Agreement is accepted electronically during account registration. Electronic acceptance constitutes a valid and binding signature under applicable law, including the EU eIDAS Regulation and Swedish law.
12. Governing law and disputes
12.1 This Agreement is governed by the substantive law of Sweden.
12.2 The courts of Sweden have exclusive jurisdiction over any dispute arising out of or in connection with this Agreement, with Stockholm District Court (Stockholms tingsrätt) as the court of first instance.
Schedule 1 — Data Categories
This schedule describes the categories of Platform Data that Solidafy accesses and processes. The specific fields vary depending on the Company's tooling. The categories below are representative and non-exhaustive.
1. Source control platform telemetry (e.g. GitHub, GitLab, Bitbucket, Azure DevOps)
Accessed via read-scoped API tokens. Solidafy pulls metadata about repositories, pull/merge requests, commits, CI/CD runs, and security alerts.
| Data category | Examples of fields | Personal data |
|---|---|---|
| Repositories | Name, id, visibility, language, timestamps, fork/star counts | Owner username |
| Pull / merge requests | Number, title, state, branch names, line-change counts, timestamps | Author username; title is free-text |
| Code reviews | Reviewer identity, review state, submitted timestamp | Reviewer username |
| Commits | SHA, commit message, timestamp, line-change counts | Author name, email, username |
| Security / dependency alerts | Alert id, state, severity, package name, advisory summary | None |
| CI/CD pipeline runs | Run id, workflow name, status, branch, duration, timestamps | Triggering actor |
Not accessed: source code, file contents, code diffs (only numeric line-change counts), issue/PR comment bodies, code-review inline comments.
2. Issue / project tracking telemetry (e.g. Jira, Linear, Azure Boards, Shortcut)
Accessed via read-scoped API tokens. Solidafy pulls issue metadata and status-change history.
| Data category | Examples of fields | Personal data |
|---|---|---|
| Issues / tickets | Key/id, title (summary), type, status, priority, project, labels, timestamps | Assignee, reporter; title is free-text |
| Status changelog | Status transitions: from/to value, timestamp, actor | Actor who made the change |
| Users | Account id, display name, email, active flag | Name + email |
Not accessed: ticket description bodies, comments, attachments, or custom free-text fields beyond the title/summary.
3. AI tooling usage metrics (e.g. Anthropic Claude, OpenAI, Mistral, GitHub Copilot)
Accessed via admin/read-only APIs where available. Solidafy pulls aggregate usage and cost metrics.
| Data category | Examples of fields | Personal data |
|---|---|---|
| Aggregate usage | Token counts, model, workspace, time bucket | None (aggregate) |
| Per-user activity | Sessions, tokens, lines/commits suggested vs accepted, by day | User identity |
| Cost reports | Spend by day, by workspace, by model/service | None |
| Users | User id, name, email, role | Name + email |
Not accessed: prompt or completion content (the actual text of AI conversations). Only counts, costs, and identifiers.
Personal data summary
| Category | Details |
|---|---|
| Identifiers | Usernames, display names, email addresses from source control, issue tracking, and AI-tooling platforms |
| Activity timestamps | PR/MR open/review/merge, issue status changes, commit times, CI/CD run times, AI-usage time buckets |
| Free-text touched | PR/MR titles, branch names, commit messages, issue/ticket titles (summaries) |
Solidafy does NOT access: source code or file contents; code diffs; ticket descriptions or comments; PR/code-review comment text; AI prompt/response content; or any end-customer, production application, or financial data.
Contact
- Company: Solidafy Labs AB (Org. nr: 559551-4331)
- Legal: legal@solidafy.com