This Privacy Policy describes how Corsair (“Corsair,” “we,” “us,” or “our”) handles information in connection with our integration infrastructure, hosted platform at hub.corsair.dev, open-source SDK (corsair and plugin packages), and hosted runtime offering (“Corsair Cloud”) (collectively, the “Service”).
Please read this policy carefully. If you have questions, contact us at team@corsair.dev.
1. Who This Policy Applies To
Corsair is developer infrastructure. Our direct customers are developers and companies (“Customers”) who integrate the Corsair SDK into their own applications (“Customer Applications”) so those applications can connect to third-party services on behalf of the Customer's own end users (“End Users”).
This policy explains:
- What information Corsair collects as the operator of Hub accounts, billing, and the control plane;
- How Corsair handles third-party integration data (including credentials and data obtained through integrated APIs) under each deployment option described in Section 2; and
- Your choices and rights with respect to information for which Corsair acts as a controller.
Customers are independently responsible for their own privacy disclosures to their End Users. This policy does not govern how a Customer Application uses third-party integration data once obtained — that is between the Customer and their End Users. If you are an End User of a Customer Application and have questions about your personal data, contact that Customer Application directly.
2. Deployment Options
Customers may use Corsair in one of two primary configurations. The option you choose determines where integration credentials and related data are stored and whether Corsair processes integration payloads in the course of providing the Service.
SDK with Corsair Hub
In this configuration, you run the Corsair SDK in your own application infrastructure and use Corsair Hub (hub.corsair.dev) for managed OAuth connect flows, token refresh, webhooks, and related control-plane features. OAuth tokens, API keys, and other integration credentials are stored in a database you operate (not in Corsair's integration datastore). The SDK encrypts stored credentials at rest using envelope encryption; the encryption key (CORSAIR_KEK) is held and managed in your application environment.
Calls from your application to third-party APIs are made from your infrastructure using the SDK. Corsair does not receive, log, or store the substantive content of those API requests or responses as part of this path, except as described in Section 4 (Hub control plane and operational metadata).
Corsair Cloud
In this configuration, Corsair hosts a managed SDK runtime for your project. Third-party integration data flows through Corsair-operated servers when your Customer Application invokes integrations through the hosted runtime. Corsair processes that data only to provide the Service — to execute the integrations you configure and to maintain connections on your and your End Users' behalf — and not for advertising, selling or licensing data to third parties, training or improving machine learning or AI models, analytics unrelated to operating the Service, or building Corsair product features outside your intended use case.
Corsair Cloud retains and stores the integration credentials and SDK database contents your project needs to operate — including OAuth access and refresh tokens, API keys, connection and tenant records, and related metadata — in either:
- a Corsair-managed database on infrastructure Corsair operates (the default for many Cloud projects), or
- a database you choose and provide (for example, via a connection URL you supply), where the hosted runtime writes the same encrypted SDK data to your database.
In both cases, credentials and keys are encrypted at rest. For Corsair Cloud, Corsair manages the encryption keys for data held in the hosted runtime (including Corsair-managed databases); for SDK with Hub, you manage CORSAIR_KEK in your environment as described above.
Stored credentials and SDK data are retained until you delete the applicable Hub project or Cloud environment (or as otherwise described in Section 9). This is separate from operational logging: when integration calls pass through the hosted runtime, Corsair also retains call metadata (such as timestamps, tenant and plugin identifiers, operation names, and success or error signals) but does not log the substantive payloads of third-party API requests or responses for diagnostic retention.
Corsair Cloud is designed so that one Customer's data is not accessible to other Customers: hosted environments and stored credentials are isolated by project and organization, and End Users within a Customer Application are isolated logically by tenant identifiers in the SDK — not on separate physical hosts per End User.
3. End User Connect Experience
When an End User connects a third-party account to a Customer Application through Corsair Hub, they see a Corsair connect screen that identifies the Customer Application by name and states that the application is powered by Corsair before being redirected to the third party's authorization flow. The connect screen explains that the named Customer Application will receive access to the data and permissions the End User approves with that third party. The specific scopes or permissions depend on the Customer Application's implemented features.
4. Information Corsair Collects and Processes
Hub control plane (all Customers)
To operate hub.corsair.dev, we collect and process limited categories of information, including:
- Customer account and project information — such as organization and project names, API keys, signing secrets, billing and contact details, and team membership;
- Encrypted OAuth application credentials — when you use managed or bring-your-own OAuth applications, client identifiers and secrets may be stored encrypted in Corsair's control-plane database to facilitate connect and token refresh;
- Webhook and connection metadata — routing identifiers, delivery status, and similar operational data needed to forward provider webhooks to your registered endpoints;
- Operational and diagnostic logs — metadata about Service operations (for example, timestamps, response codes, and project or environment identifiers). For Customers not using Corsair Cloud, these logs are retained for 90 days and then deleted or anonymized, as described in Section 9.
Token refresh (SDK with Hub)
When your application refreshes an OAuth access token through Hub, we transiently process the refresh token and new access token to complete the exchange with the third-party provider. For SDK with Hub, we do not persist end-user OAuth tokens in the Hub control plane after the refresh completes; tokens remain in your SDK database (or, for Corsair Cloud, in the Corsair-managed or customer-provided database configured for that project, as described in Section 2).
Corsair Cloud — stored credentials and SDK data
For Corsair Cloud projects, end-user and application integration credentials, tenant connection state, and other data the SDK persists to serve your Customer Application are stored and retained in your project's database — either Corsair's managed database or one you provide. Corsair processes and stores this data only to operate your hosted runtime, not for unrelated purposes described in Section 2.
Third-party integration data we process on your behalf
Depending on your deployment option, Corsair may process third-party integration data (including personal data contained in credentials or API payloads) as a processor or service provider on your instructions — principally when you use Corsair Cloud, or when Hub handles OAuth or webhooks on your behalf. We process that data only to provide the Service. We do not have a direct relationship with End Users; if you are an End User, contact the Customer Application you used to exercise privacy rights regarding data processed through Corsair on that Customer's behalf.
Hub account sign-in
When you sign in to Corsair Hub with Google or GitHub, we receive basic profile information from that provider (such as name, email address, profile picture if available, and a unique account identifier). We use this information only to create and maintain your Hub account, authenticate you, display your identity in the dashboard, and communicate with you about your account. We do not use it for advertising, and we do not sell, rent, or trade it to third parties. You can revoke Hub's access through your Google Account permissions or GitHub authorized applications settings, as applicable.
5. Google API Services User Data Policy
When Customer Applications connect to Google services through Corsair, Corsair's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In accordance with that policy, we do not:
- Use or transfer Google user data for serving advertisements;
- Sell or share Google user data with third parties, except as strictly necessary to provide the core functionality of the Service (for example, completing OAuth or token refresh with Google);
- Use Google user data to train or improve any machine learning or artificial intelligence model; or
- Allow human review of Google user data, except where necessary for security purposes (such as investigating suspected abuse), to comply with applicable law, or where an End User has separately and affirmatively consented.
Customers who access Google user data through their own Customer Applications remain independently responsible for complying with Google's policies for their use of that data.
6. How We Use Information
We use information we collect to:
- Provide, operate, maintain, and secure the Service;
- Authenticate Hub users and administer Customer accounts, projects, and billing;
- Execute integrations and related features you configure (including through Corsair Cloud);
- Provide support, troubleshoot issues, and protect against abuse or security incidents; and
- Comply with applicable law and enforce our terms.
We do not use third-party integration data or End User data processed through the Service for advertising, model training, or analytics unrelated to operating and securing the Service, as described in Section 2.
7. How We Protect Information
- Communication between the Corsair SDK and Hub is encrypted and authenticated using project-specific signing secrets.
- Credentials and keys stored through the Service are encrypted at rest; encryption keys for Corsair Cloud are managed by Corsair, and for SDK with Hub are managed in your application environment.
- We maintain access controls limiting employee access to production systems and logs.
- Corsair Cloud environments are isolated so that one Customer cannot access another Customer's stored integration data.
8. Data Sharing and Subprocessors
We do not sell third-party integration data or Hub account information. We may share information with:
- Amazon Web Services (AWS) — our infrastructure subprocessor for hosting Corsair Cloud and related production systems, bound by contractual confidentiality and security obligations;
- Government or regulatory authorities where required by law; and
- A successor entity in connection with a merger, acquisition, or sale of assets, subject to this policy continuing to apply or you being notified of material changes.
Integration API calls are made to third-party providers (such as Google, Slack, or other services you connect) according to your configuration; those providers handle data under their own policies.
9. Data Retention
Corsair Cloud — credentials and SDK database: OAuth tokens, API keys, connection records, and other SDK-persisted data (in a Corsair-managed database or a database you provide) are retained until you delete the relevant Hub project or Cloud environment (or we delete them following account termination, subject to any legal retention requirements).
Corsair Cloud — call metadata: Hosted-runtime call metadata described in Section 2 is retained with the project for as long as the project remains active, unless a shorter period applies under your agreement.
Operational logs (SDK with Hub, without Corsair Cloud): Control-plane and diagnostic logs described in Section 4 are retained for 90 days for security and diagnostic purposes, after which they are deleted or anonymized.
Webhooks: Webhook notification payloads are deleted upon successful delivery to your registered endpoint when possible. If delivery fails, we may retain the notification for up to 7 days to allow redelivery, after which it is deleted.
Hub account profile information from Google or GitHub sign-in is retained while your account remains active, or as needed to provide the Service.
10. Your Rights
If you are an End User of a Customer Application, direct requests regarding personal data (access, deletion, correction) to the Customer Application you interacted with. You may also revoke a third party's access to your account through that provider's settings (for Google, your Google Account permissions page).
If you are a Corsair Customer or Hub account holder, you can:
- Revoke Google or GitHub Hub sign-in access using the links in Section 4;
- Request deletion of your Hub account and associated control-plane data by contacting team@corsair.dev;
- Request a copy of Hub account data we hold as controller by contacting team@corsair.dev.
Where Corsair processes personal data on your behalf through Corsair Cloud or related features, you are the controller (or equivalent) for that data and Corsair acts as processor — End User requests should be handled by you, with our assistance as required by applicable law and our agreement with you.
11. Children's Privacy
The Service is not directed to children under 13 (or the relevant age of digital consent in your jurisdiction), and we do not knowingly collect data from children.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes to how we handle personal information or third-party integration data, we will update this page and, where required, seek renewed consent before making use of data in a new way.
13. Contact Us
Corsair