You review and merge. Here is the rest of the deal.

These Terms of Service (the “Terms”) are a contract between M82 Labs (“M82 Labs”, “we”, “us” or “our”) and the customer that installs or uses the Service (“you” or “Customer”). They govern the website at m82labs.dev, our GitHub App, our web application, and every related service we provide (together, the “Service”).

Acceptance. You accept these Terms by installing the GitHub App, signing in, completing checkout, or otherwise using the Service. If you install the Service for an organisation, you confirm that you have authority to bind that organisation, and “you” means the organisation. If you do not have that authority or do not agree to these Terms, do not install or use the Service.

Who may use it. The Service is for businesses and software teams. You must be at least 18 years old and able to form a binding contract. You may not use the Service if you are barred from doing so under the laws of the United States or the country where you are located.

Related documents. Our Privacy Policy describes what we collect and how we handle it, and is incorporated into these Terms. Where your organisation has signed a separate written agreement or data processing addendum with us, that agreement controls over these Terms to the extent they conflict.

The Service watches third-party APIs we support (“Vendors”) for changes, finds the code in the GitHub repositories you selected that those changes affect, writes a fix with an AI agent, and opens a pull request in your repository carrying the evidence for the change. Where we detect a change but do not open a pull request, we may notify you by email or in the application instead.

What the Service never does. These are commitments, not descriptions:

• We never merge. Every change is a pull request that a person on your team reviews and merges or closes.
• We never read your secrets. Environment files and their real-value equivalents are never opened, and credential values are never stored, logged or transmitted.
• We never modify your CI or workflows. Changes under .github/workflows/, to .env* files or to .git/ cause the run to fail rather than reach a pull request.
• We never read outside the repositories you selected on GitHub’s consent screen.

The GitHub App. The Service operates through a GitHub App that you install on your organisation or account. The permissions shown on GitHub’s consent screen are the whole of what we may access, and you can narrow or revoke them on GitHub at any time. Uninstalling the App ends all processing immediately.

Licence. Subject to these Terms, we grant you a limited, non-exclusive, non-transferable, revocable licence during your subscription to access and use the Service for your organisation’s internal business purposes.

Changes to the Service. We may add, change or remove features, and add or remove supported Vendors. If a change materially reduces what your plan provides, we tell you at least 14 days before it takes effect, and you may cancel without penalty before then.

Support. We provide support by email at contact@m82labs.dev during our business hours. We do not commit to a service level or uptime guarantee unless your organisation has signed a separate agreement that provides one.

Sign-in. You sign in with your GitHub account. There is no separate password. You are responsible for the security of your GitHub account and for everything done through it in the Service.

Who may act for an organisation. GitHub tells us who is an owner, administrator, member or collaborator of an installation, and we rely on that answer. Owners and administrators may install the Service, choose a plan, enter payment details, change settings and cancel. Members and collaborators may view the organisation’s changes and evidence for the repositories GitHub shows them, and may request a fix. We re-check these roles against GitHub regularly, and removing a person on GitHub removes their access to the Service within a short interval.

The organisation is the customer. A subscription belongs to the organisation’s installation, not to the person who set it up. It survives that person leaving, and it never moves to a different organisation.

Accurate information. You agree that the information you give us, including billing details, is accurate and kept current.

Notices from us. We send service notices to the email addresses GitHub provides for owners and administrators of your installation. You agree to receive these electronically, and they satisfy any requirement for written notice.

Your repositories. You are responsible for the repositories you connect: that you have the right to grant us access to them, that doing so does not breach any agreement or law, and that you have given any notices and obtained any consents needed for the people whose data appears in them.

Review before merge. You are responsible for reviewing every pull request we open, running whatever checks your own process requires, and deciding whether to merge it. See section 5.

Your GitHub account and the Vendors. You are responsible for your relationship with GitHub and with each Vendor, including their terms. We do not act for you with any Vendor and we do not change your Vendor accounts.

You agree not to:

• use the Service to build a competing product, or to probe, scan or test its security without our written permission
• reverse engineer, decompile or attempt to extract the source code of the Service, except where the law allows it despite this restriction
• resell, sublicense or share access to the Service outside your organisation
• interfere with the Service, circumvent its limits or rate controls, or place content in a repository designed to manipulate the AI agent into acting outside the change it was dispatched for
• use the Service in breach of any law, or to process data you are not entitled to process
• use the Service for any purpose that requires fail-safe performance, such as life-support, weapons or safety-critical systems

Limits. Each plan carries limits, such as the number of repositories, the number of pull requests per month and per day, and a spend cap for AI agent runs. Work that exceeds a daily limit queues; work that exceeds a monthly limit or spend cap is reported to you as a detected change without a pull request. We may apply reasonable fleet-wide limits to protect the Service for all customers.

What a pull request is. A pull request we open is a proposed change written with an AI agent, together with the evidence we observed: the Vendor artifact that shows the change, the call sites in your code it reaches, and the result of our own run of your tests. It is a suggestion for your review, not a change we have made to your code.

You decide. Nothing is merged unless a person on your team merges it. You are solely responsible for deciding whether a pull request is correct, complete and appropriate for your codebase, and for the consequences of merging it. Review it as you would a contribution from any outside contributor.

AI output. The agent is a large language model operating under the controls described in our Privacy Policy. Its output may be wrong, incomplete, or unsuited to your code even when our checks pass. We do not warrant that any pull request is correct, that it fixes the change it addresses, that it introduces no other problem, or that it is free of third-party rights. Our test run reports what your test suite reported, not that your code works.

Our evidence. We hold ourselves to opening pull requests only where an artifact we observed shows the Vendor change happened and where the change reaches confirmed call sites in your code. Where we cannot establish that, we do not open a pull request. This is how we work, not a warranty.

Ownership of pull requests. The pull request lives in your repository and belongs to you. You may edit, close or delete it. We do not claim any right in it or in your code.

You own your code. As between you and us, you own your repositories, their contents, and every pull request we open in them. These Terms give us no ownership of any of it.

Licence to us. You grant us a non-exclusive, worldwide, royalty-free licence, for the duration of your subscription, to access, clone, read, analyse and modify the contents of the repositories you selected, and to send excerpts of them to our model provider, solely to provide the Service to you. The licence ends when you uninstall the App or deselect the repository, except for data we retain as described in the Privacy Policy.

Our role. For your repository contents we act as your processor, on your instructions, which are the permissions you grant on GitHub. For the account information described in the Privacy Policy we are the controller. We process both as the Privacy Policy describes, and that policy is part of these Terms. Where data protection law requires a data processing addendum, we will enter one on request.

No training. We do not train any machine learning model on your code or your data, and we do not permit our model provider to do so.

Aggregated data. We may compile statistics about the Service that cannot reasonably identify you or your organisation, such as the number of pull requests opened per Vendor or how often our pull requests are merged, and use them to operate and improve the Service. A labelled evaluation record derived from a run may be kept as a structural record with no repository content, as the Privacy Policy explains, and we remove it on request.

Confidentiality. We treat your repository contents, run logs and evidence as your confidential information. We disclose them only to the service providers listed in the Privacy Policy, to the extent needed to provide the Service, or where the law requires it. This obligation survives the end of these Terms for as long as we hold the data.

Deletion. You may ask us to delete your organisation’s data at any time, and we complete it within 30 days, as the Privacy Policy describes. Uninstalling the App stops all processing immediately but does not by itself delete data.

Plans. The Service is sold as a monthly subscription on the plans and at the prices shown at m82labs.dev/pricing at the time you subscribe. There is no free tier and no free trial. Each plan’s limits apply from the first hour.

Choosing a plan and paying. An owner or administrator chooses a plan and completes checkout before the Service begins work on your repositories. The checkout page is Stripe’s, and Stripe is the merchant of recordfor the purchase: you buy the subscription from Stripe, at the price we set, under Stripe’s payment terms as well as these Terms. Stripe issues the invoice and receipt, sends them to you directly, and charges your payment method for each monthly renewal; your statement shows Stripe’s Link brand beside our name. Billing starts the day checkout completes and renews monthly on that date until cancelled. We never see your card number.

Price changes. We may change prices with at least 30 days’ notice by email. A change takes effect at your next renewal after the notice period. If you do not accept it, cancel before that renewal.

Taxes. Prices exclude taxes. As merchant of record, Stripe calculates any sales tax, VAT or GST due on your purchase from your location, adds it at checkout, shows it on the invoice, and remits it to the tax authority.

Changing plans. Owners and administrators change plans from the billing portal. An upgrade takes effect immediately and the difference is prorated for the rest of the period. A downgrade takes effect immediately and the unused difference is credited against future invoices.

Cancelling. You can cancel at any time from the billing portal, or from the order page Stripe gives you for purchases made through it. The plan runs to the end of the period you have paid for, and no further charge is made. Uninstalling the App also schedules cancellation at the end of the current period; reinstalling before then restores the subscription unchanged.

Refunds. Fees are non-refundable, and we do not refund partial periods, except where we terminate your subscription without cause, where section 2’s change-of-service rule applies, or where the law requires a refund. Because Stripe is the merchant of record, a refund is issued by Stripe, includes any tax you paid, and can be requested from us or from Stripe’s support for the purchase. Nothing here limits any statutory right you have as a consumer, although the Service is sold to businesses.

Failed payment. If a renewal payment fails, Stripe retries it. If it still fails, your subscription expires: we stop opening pull requests and notifying you, and your data is kept as the Privacy Policy describes until you subscribe again or ask us to delete it.

Chargebacks. If you dispute a charge with your card issuer instead of contacting us first, Stripe answers the dispute as merchant of record, and we may suspend the Service while it is open.

Term. These Terms apply from the moment you first use the Service and continue while you have an installation or a subscription.

Termination by you. Cancel from the billing portal, uninstall the App, or both. Section 7 says what happens to the current billing period.

Suspension by us. We may suspend the Service for your installation, with notice where practical, if we reasonably believe your use breaches section 4, threatens the security or integrity of the Service or other customers, or exposes us to legal liability; if a payment is overdue after the retries in section 7; or if GitHub revokes or suspends the App’s access. We lift the suspension when the cause is resolved.

Termination by us. We may terminate these Terms for your installation on 30 days’ notice for any reason, with a pro-rated refund of any prepaid fees for the period after termination, or immediately if you materially breach these Terms and do not cure the breach within 14 days of our notice, or if the breach cannot be cured.

Effect. On termination we stop all processing, your licence to the Service ends, and we handle your data as the Privacy Policy describes: kept until you ask us to delete it, so that the evidence behind pull requests we opened remains available to you, and deleted within 30 days of your request. Pull requests already opened remain in your repository.

Survival. Sections 5, 6 (confidentiality and ownership), 7 (amounts owed), 9, 11, 12, 13 and 14 survive termination.

Ours. The Service, including its software, detection and matching methods, prompts, evaluation corpus, documentation, wordmarks and the data we derive about Vendors, belongs to M82 Labs and its licensors. These Terms grant you no right in any of it except the licence in section 2. We reserve all other rights.

Not ours. Your repositories, your code and the pull requests we open in them are yours (section 6). Vendor specifications and changelogs belong to the Vendors.

Feedback. If you send us suggestions or feedback about the Service, you grant us a perpetual, irrevocable, worldwide, royalty-free licence to use it for any purpose without obligation to you. Do not send us feedback you consider confidential.

Publicity. We will not name your organisation as a customer or use its logo without your written permission.

GitHub. The Service depends on GitHub for identity, authorisation, repository access and pull request delivery. Your use of GitHub is governed by GitHub’s terms. We are not responsible for GitHub’s availability, for changes GitHub makes to its APIs or permissions, or for actions GitHub takes on your account.

Payment and other providers. Stripe is the merchant of record for your subscription (section 7): it sells it to you at our price, issues the invoice, handles tax, refunds and disputes, and processes your payment under its own terms and privacy policy. The other providers that process data on our behalf are listed in the Privacy Policy.

The Vendors. We monitor Vendors’ public specifications, documentation and changelogs. We have no relationship with any Vendor on your behalf, no control over what a Vendor changes or when, and no responsibility for a Vendor’s accuracy or for the effect of a Vendor’s change on your systems. We measure what a Vendor announced against what we can observe; where they disagree, we act on what we observe, and we may be late or wrong when a Vendor’s published artifacts are incomplete.

Model provider. The AI agent runs on models provided by a third party under a commercial agreement that does not permit training on your data. The provider’s availability affects the Service, and an outage there may delay detection and fixes.

Links. The Service links to Vendors’ and providers’ sites. Those sites are not under our control and a link is not an endorsement.

What we warrant. We warrant that we will provide the Service with reasonable skill and care, that we will keep the commitments in section 2 under “What the Service never does”, and that we will handle your data as the Privacy Policy describes. If we breach the first of these, your remedy is for us to correct the failure or, if we cannot, to refund the fees for the affected period and let you cancel.

What we do not warrant. EXCEPT AS STATED ABOVE, THE SERVICE IS PROVIDED “AS IS” AND “AS AVAILABLE”. TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL OTHER WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT, AND ANY WARRANTY ARISING FROM COURSE OF DEALING OR USAGE OF TRADE. WE DO NOT WARRANT THAT THE SERVICE WILL BE UNINTERRUPTED OR ERROR-FREE, THAT WE WILL DETECT EVERY VENDOR CHANGE OR DETECT IT IN TIME, THAT EVERY AFFECTED CALL SITE WILL BE FOUND, OR THAT ANY PULL REQUEST WILL BE CORRECT, COMPLETE, SECURE OR FIT FOR YOUR CODEBASE. OUTPUT OF THE AI AGENT IS PROVIDED FOR YOUR REVIEW AND YOU ASSUME THE RISK OF MERGING IT.

Your warranties. You warrant that you have the authority to accept these Terms for your organisation, that you have the rights needed to grant us the access described in section 6, and that your use of the Service complies with the law and with your agreements with GitHub and the Vendors.

Some jurisdictions do not allow the exclusion of certain warranties, so parts of this section may not apply to you. Where a warranty cannot be excluded, it is limited to 90 days from your first use of the Service and to the remedies in this section.

Exclusion of certain damages. TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PARTY IS LIABLE TO THE OTHER FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY OR PUNITIVE DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOST DATA, BUSINESS INTERRUPTION OR THE COST OF SUBSTITUTE SERVICES, ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE, HOWEVER CAUSED AND UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY. THIS INCLUDES DAMAGE CAUSED BY A PULL REQUEST YOU CHOSE TO MERGE.

Cap. TO THE FULLEST EXTENT PERMITTED BY LAW, EACH PARTY’S TOTAL LIABILITY ARISING OUT OF OR RELATED TO THESE TERMS OR THE SERVICE IS LIMITED TO THE GREATER OF (A) THE FEES YOU PAID US IN THE TWELVE MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM AND (B) ONE HUNDRED U.S. DOLLARS. MULTIPLE CLAIMS DO NOT INCREASE THIS CAP.

Exceptions. The exclusion and the cap do not apply to a party’s breach of its confidentiality obligations in section 6, to our breach of the commitments in section 2 under “What the Service never does”, to a party’s gross negligence, fraud or wilful misconduct, to a party’s indemnification obligations below, to your payment obligations, or to liability that cannot be limited by law. For a breach of confidentiality or of section 2’s commitments, our total liability is limited to three times the fees you paid us in the twelve months before the event.

Basis of the bargain. The prices reflect these limits, and the parties would not enter these Terms without them.

Indemnification by you. You will defend, indemnify and hold harmless M82 Labs and its officers, employees and contractors from third-party claims, and the resulting damages, costs and reasonable attorneys’ fees, arising from your repositories or data, your breach of section 4 or of your warranties in section 11, or your use of a pull request after merging it.

Indemnification by us. We will defend, indemnify and hold you harmless from third-party claims, and the resulting damages, costs and reasonable attorneys’ fees, alleging that the Service as provided by us, used in accordance with these Terms, infringes a United States patent, copyright or trademark or misappropriates a trade secret. This does not cover claims arising from your code, from a Vendor’s materials, from output you modified, or from your use in breach of these Terms. If a claim arises or we think one likely, we may modify the Service to avoid it, obtain a licence, or terminate the affected part with a pro-rated refund.

Procedure. The indemnified party must notify the other promptly, give it sole control of the defence and settlement, and cooperate reasonably at the indemnifying party’s expense. No settlement that imposes an obligation on the indemnified party may be made without its consent, not to be unreasonably withheld.

Governing law. These Terms and any dispute arising out of or relating to them or the Service are governed by the laws of the State of Delaware, without regard to its conflict-of-law rules. The United Nations Convention on Contracts for the International Sale of Goods does not apply.

Talk to us first. Before starting any proceeding, the party raising a dispute sends the other a written description of it, to contact@m82labs.dev in our case and to your organisation’s administrator addresses in yours, and the parties try in good faith to resolve it for 30 days.

Courts. Any dispute not resolved that way is brought exclusively in the state or federal courts located in the State of Delaware, and each party consents to their personal jurisdiction and venue. Either party may seek injunctive or other equitable relief in any court of competent jurisdiction to protect its intellectual property or confidential information, and either party may bring an individual claim in small claims court where it qualifies.

Jury trial waiver. TO THE FULLEST EXTENT PERMITTED BY LAW, EACH PARTY WAIVES ITS RIGHT TO A TRIAL BY JURY IN ANY PROCEEDING ARISING OUT OF OR RELATING TO THESE TERMS OR THE SERVICE.

Individual claims. Each party may bring claims against the other only in its individual capacity, not as a plaintiff or class member in any purported class, collective or representative proceeding, to the extent the law permits this waiver.

Time limit. Any claim arising out of or relating to these Terms or the Service must be brought within one year after it arises, where the law permits this limit; otherwise it is permanently barred.

Attorneys’ fees. In any proceeding to enforce these Terms, the prevailing party may recover its reasonable attorneys’ fees and costs.

Changes to these Terms. We may update these Terms. If a change materially reduces your rights or increases your obligations, we email every owner and administrator at least 30 days before it takes effect, and you may cancel before then. Smaller changes take effect when posted with a new version number and effective date. Continuing to use the Service after the effective date means the new version applies. Disputes are governed by the version in effect when the dispute arose.

Notices. Notices to us go to contact@m82labs.dev. Notices to you go to the email addresses GitHub provides for your installation’s owners and administrators, or to a notice in the application. Electronic notices satisfy any requirement for written notice.

Export and sanctions. You may not use the Service in breach of U.S. export control or sanctions laws, and you confirm you are not on any U.S. government restricted-party list and not located in an embargoed country.

U.S. government users. The Service is commercial computer software and commercial computer software documentation, provided with only the rights granted to all other customers under these Terms.

Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control, including outages at GitHub, our hosting providers or our model provider, except for payment obligations.

Assignment. You may not assign these Terms without our written consent, except to a successor in a merger, acquisition or sale of substantially all your assets, with notice to us. We may assign them to an affiliate or a successor. Any other attempted assignment is void.

Relationship. The parties are independent contractors. Nothing here creates a partnership, joint venture, agency or employment relationship.

Entire agreement. These Terms, the Privacy Policy and any separate written agreement with your organisation are the entire agreement about the Service and replace any prior understanding. If any provision is unenforceable, it is modified to the minimum extent needed and the rest remains in effect. A failure to enforce a provision is not a waiver. “Including” means “including without limitation”. Headings are for convenience only.

Accessibility. We aim to meet the Web Content Accessibility Guidelines 2.1 at level AA on the public site and in the application. If you have difficulty using either, email us and we will help.

Contact. M82 Labs, contact@m82labs.dev, m82labs.dev. We operate exclusively online and email is our method for every notice and request.