Add FullStory, Inc. to subprocessors list

site-policy-bot · site-policy-bot · commit 9592a53ca7f2 · 2025-11-06T07:58:38.000Z
diff --git a/Policies/acceptable-use-policies/github-child-sexual-exploitation-or-abuse.md b/Policies/acceptable-use-policies/github-child-sexual-exploitation-or-abuse.md
@@ -1,6 +1,6 @@
 ---
 title: GitHub Child Sexual Exploitation or Abuse
-shortTitle: Child Sexual Exploitation or Abuse
+shortTitle: CSAM Policy
 versions:
   fpt: '*'
 topics:
diff --git a/Policies/acceptable-use-policies/github-misinformation-and-disinformation.md b/Policies/acceptable-use-policies/github-misinformation-and-disinformation.md
@@ -1,6 +1,6 @@
 ---
 title: GitHub Misinformation and Disinformation
-shortTitle: Misinformation and Disinformation
+shortTitle: Disinformation Policy
 versions:
   fpt: '*'
 topics:
@@ -18,4 +18,3 @@ You may not post content that presents a distorted view of reality, whether it i
 * Unsubstantiated claims that could promote hate or targeted harassment of specific groups of people
 
 We encourage active participation in the expression of ideas, perspectives, and experiences and may not be in a position to dispute personal accounts or observations. We generally allow parody and satire that is in line with our [Acceptable Use Policies](/site-policy/acceptable-use-policies/github-acceptable-use-policies), and we consider context to be important in how information is received and understood. When reviewing content under this policy, GitHub will consider the impact of various factors that may help to orient the viewer, such as whether the content has been provided with clear disclaimers, citations to credible sources, or includes other details that clarify the accuracy of the information being shared.
-
diff --git a/Policies/github-terms/github-copilot-extension-developer-policy.md b/Policies/github-terms/github-copilot-extension-developer-policy.md
@@ -7,7 +7,9 @@ topics:
   - Legal
 ---
 
-> Last Updated: September 6, 2024
+> Last Updated: October 20, 2025
+
+> [!WARNING] We are deprecating GitHub Copilot Extensions on November 10, 2025, in favor of the Model Context Protocol (MCP). You can read more about this change in our [changelog post](https://github.blog/changelog/2025-09-24-deprecate-github-copilot-extensions-github-apps/).
 
 This Agreement is a legal agreement between you (“You”) and GitHub, Inc. (“GitHub”, “we”, or “us”). By clicking “I Agree”, you’re agreeing to be bound by all the terms of this Agreement. If you are entering into this Agreement on behalf of a company or other legal entity, you represent that you have the legal authority to bind the entity to this Agreement, in which case “You” will mean the entity you represent.
 
diff --git a/Policies/github-terms/github-dpa-previews.md b/Policies/github-terms/github-dpa-previews.md
@@ -0,0 +1,19 @@
+---
+title: GitHub DPA-Covered Previews
+allowTitleToDifferFromFilename: true
+versions:
+  fpt: '*'
+topics:
+  - Policy
+  - Legal
+---
+
+## GitHub DPA-Covered Previews
+
+The pre-release products and features listed below use data handling that is the same as when the software becomes generally available. Under [GitHub’s Pre-Release License Terms](https://gh.io/preview-terms), this software is governed by [the GitHub Data Protection Agreement](https://gh.io/dpa) as of the date listed, and the Customer is the Data Controller beginning on that date.
+
+| Product / Feature                                  | DPA Coverage Date   |
+|:---------------------------------------------------|:-------------------:|
+| Copilot CLI                                        | 27 October 2025     |
+| Copilot Enterprise & Users Usage Metrics Dashboard | 27 October 2025     |
+| Spark                                              | 27 October 2025     |
diff --git a/Policies/github-terms/github-pre-release-license-terms.md b/Policies/github-terms/github-pre-release-license-terms.md
@@ -54,9 +54,11 @@ These terms apply to the pre-release software made available to you by GitHub. T
 
 ## 4. Data Collection and Usage.
 
-  a. **Consent to Data Collection.** The pre-release software may collect telemetry information about you and your use of the software, and send that information to GitHub. Subject to the limitations in Section 4(b) below, GitHub may use this information to provide services, to improve our products and services, or for any other purpose permitted under the GitHub Data Protection Agreement or GitHub Privacy Statement. Your use of the pre-release software operates as your consent to these practices.
+  a. **Processing of Personal Data.** By default, GitHub is the data controller in relation to the Personal Data processed in connection with the pre-release software and follows the terms below. As the pre-release software is developed, it may reach a stage where data is handled the same as it will when the software becomes generally available. Pre-release software that has progressed to that stage of development is listed at [https://gh.io/dpa-previews](https://gh.io/dpa-previews). At that point, the customer becomes the data controller and the software is governed by the terms of the GitHub Data Protection Agreement instead of this Section 4.
 
-  b. **Use of Collected Data.**
+  b. **Consent to Data Collection.** The pre-release software may collect telemetry information about you and your use of the software, and send that information to GitHub. Subject to the limitations in Section 4(c) below, GitHub may use this information to provide services, to improve our products and services, or for any other purpose permitted under the GitHub Data Protection Agreement or GitHub Privacy Statement. Your use of the pre-release software operates as your consent to these practices.
+
+  c. **Use of Collected Data.**
   * GitHub will use collected data for analytics and measurement to understand how our pre-release software and related products are used.
   * The software will collect data and usage information about events generated when interacting with it. These events help us analyze and measure performance and features used. This usage information is used by GitHub and may be shared with affiliates and other third parties to help deliver, develop, evaluate, and improve the software and related products.
   * We analyze data to ensure the pre-release software is working as intended, to evaluate the safety, reliability, and user experience of the software, and to investigate and detect potential abuse.
@@ -66,8 +68,6 @@ These terms apply to the pre-release software made available to you by GitHub. T
       * GitHub does not own the output sent to you by the software.
       * GitHub will not use your inputs or the outputs generated to train AI language models, unless you have instructed us in writing to do so.
 
-  c. **Processing of Personal Data.** GitHub is the data controller in relation to the Personal Data processed in connection with the pre-release software.
-
   d. **Data Collection by You.** There may be some features in the pre-release software that enable you and GitHub to collect data from users of your applications. If you use these features, you must comply with all applicable laws on data collection, including providing appropriate notices to users of your applications as well as a copy of GitHub’s Privacy Statement. You can learn more about data collection and use in the software documentation.
 
   e. **Revocation of Consent to Data Collection.** You may revoke your consent to data collection by the prerelease software by contacting GitHub and requesting removal from the technical preview. Please note that, if you request removal from the preview, you will no longer be able to use the pre-release software.
@@ -120,4 +120,4 @@ You bear the sole risk of using the pre-release software.
 
 ## 15. Nature of Terms for Microsoft Customers.
 
-  If you license GitHub through Microsoft, these terms shall be considered an amendment to the Microsoft Product Terms for GitHub Offerings for the duration of your use of the pre-release software.
+  If you license GitHub through Microsoft and your agreement with Microsoft does not already provide for the inclusion of these terms, these terms shall be considered an amendment to the Microsoft Product Terms for GitHub Offerings for the duration of your use of the pre-release software.
diff --git a/Policies/github-terms/github-terms-of-service.md b/Policies/github-terms/github-terms-of-service.md
@@ -150,7 +150,7 @@ To the extent this agreement is not enforceable by applicable law, you grant Git
 
 By using automated means to access, collect, or otherwise use (“Access”) any publicly accessible Content from the Service for the purpose of developing or training any commercially available artificial intelligence model, machine learning system, or similar technology (a "Commercial AI System"), you hereby waive any and all policies, terms, conditions, or contractual provisions governing products, services, websites or datasets you own or operate that would otherwise prohibit, restrict, or place conditions upon GitHub's Access to any publicly accessible data, information or content associated with your products or services, including for the purpose of developing or training any Commercial AI System. You further agree not to impose technical or other targeted measures to restrict or retaliate against such Access.
 
-This Section D.8 does not apply to Access solely for the purpose of academic research or if, on the date you Access the Content, the number of monthly active users of the products or services made available by you is less than 700 million in the preceding calendar month. For the purposes of this Section, "you" shall refer to you and any entity that directly or indirectly controls, is controlled by, or is under common control with you (affiliates). 
+This Section D.8 does not apply to Access solely for the purpose of academic research or if, on the date you Access the Content, the number of monthly active users of the products or services made available by you is less than 700 million in the preceding calendar month. For the purposes of this Section, "you" shall refer to you and any entity that directly or indirectly controls, is controlled by, or is under common control with you (affiliates).
 
 ## E. Private Repositories
 
diff --git a/Policies/privacy-policies/github-cookies.md b/Policies/privacy-policies/github-cookies.md
@@ -46,6 +46,7 @@ GitHub | `saml_csrf_token_legacy` | This cookie is set by SAML auth path method
 GitHub | `saml_return_to` | This cookie is set by the SAML auth path method to maintain state during the SAML authentication loop. | Until user closes browser or completes authentication request
 GitHub | `saml_return_to_legacy` | This cookie is set by the SAML auth path method to maintain state during the SAML authentication loop. | Until user closes browser or completes authentication request
 GitHub | `show_cookie_banner` | Set based on the client’s region and used to determine if a cookie consent banner should be shown | Session
+GitHub | `social_csrf_token` | This cookie is set by the social initiate path to ensure that the user that started the flow is the same user that completes it. | 5 minutes
 GitHub | `tz` | This cookie allows us to customize timestamps to your time zone. | Session
 GitHub | `user_session` | This cookie is used to log you in. | Two weeks
 [Microsoft](https://privacy.microsoft.com/en-us/privacystatement) | `ai_session` | Application Insights session ID | One year
diff --git a/Policies/privacy-policies/github-subprocessors.md b/Policies/privacy-policies/github-subprocessors.md
@@ -32,7 +32,8 @@ If you have questions about this list, please contact us at <privacy@github.com>
 | Cloudflare                    | Content delivery service                                                       | United States                                     | United States      |
 | CoreWeave, Inc.               | Cloud Hosted Infrastructure                                                    | United States                                     | United States      |
 | Fastly                        | Content delivery service                                                       | United States                                     | United States      |
-| Fireworks AI	               | AI Inference and AI Services                                                    | United States, Iceland, Germany            | United States      |
+| Fireworks AI                  | AI Inference and AI Services                                                   | United States, Iceland, Germany                   | United States      |
+| FullStory, Inc.               | Customer support ticketing analysis                                            | United States                                     | United States      |
 | Google Cloud Platform (GCP)   | Cloud Hosted Infrastructure, AI Inference and AI Services                      | United States, Belgium, Singapore                 | United States      |
 | Hewlett-Packard Limited       | Cloud Hosted Infrastructure                                                    | United States                                     | United States      |
 | LambdaTest                    | Cloud Hosted Infrastructure                                                    | United States                                     | United States      |
