Privacy Policy

This Privacy Policy explains how Excellent Software, LLC (“Excellent,” “we,” “us,” or “our”) collects, uses, and shares information. It covers the following services, including the planned plugin connection described below:

• The website at excellent.so — marketing pages, docs, and the forms on them.
• An Excellent account — sign-in for the parts of the site that need one.
• The consulting client portal — scheduling, agreements, and billing for a paid engagement.
• The Excellent CLI — the software you install and run on your own machine.
• The Excellent plugin and hosted gateway — the OpenAI-plugin connection to ChatGPT and Codex, and the service behind it. Not yet published; see Excellent for ChatGPT below.

The short version

• The CLI runs on your machine. Your repository, the attempts it records, the evidence it collects, and the full receipts it writes stay on that machine. Connecting the plugin additionally shares the identifiers and summaries described below. The other things the app sends us — an optional registration, recovery codes you ask us to email, and bug reports you choose to file — are listed in when the app contacts us.
• When you connect the plugin, once it launches, its four tools will read authorized workspaces, check status, results, and receipt-verification information. They send identifiers and return limited summaries through the gateway to ChatGPT or Codex; they do not accept task text or full conversations, start checks, or run them. Signing in to connect uses your existing Excellent sign-in (an emailed code, Google, or GitHub); a password works only for the review accounts we set up for app-directory reviewers. See Excellent for ChatGPT below.
• We collect what you type into a form on the website, and what a consulting engagement needs to schedule, contract, bill, and deliver.
• Analytics and advertising scripts and cookies load only after you accept them in our banner. Decline, leave the banner unanswered, or send a Global Privacy Control signal, and nothing from Google or Meta loads in your browser.
• We don’t sell your personal information.
• We have no AI provider of our own and we receive none of your code. Model calls go from your machine to the provider you chose, on your account. See the CLI section for exactly how.

Information we collect

Information you give us

When you request updates, book a call, create an account, or contact us, we collect what you submit: your name, email address, company, role, scheduling preferences, and your message. We also receive anything else you choose to send, for example by email.

If you use the client portal, we collect what that workflow needs: login and session records, scheduling details, onboarding answers, signed-document status and signature metadata, pairing-code activity, support notes, and the billing identifiers and payment status Stripe gives us. We never see or store full payment card numbers— those go directly to Stripe.

Information collected automatically

Our servers and hosting provider process the ordinary request data any website receives: IP address, user agent, requested URL, and referrer. When you submit a form (an update signup, a booking, or an app registration), we store your IP address and browser user agent with that submission, to prevent abuse and keep a record of it. If you accepted cookies, we also store the campaign tags (utm_*), ad click identifiers (gclid, fbclid), external referrer, and landing page of the visit that first brought you here, and attach them to your submission. If you consent to analytics cookies, our analytics providers also collect pages viewed, referring URLs, approximate location derived from IP, device and browser type, and interactions such as an update signup, an install-command copy, or a booking request. We also use Vercel Analytics, which is cookieless and does not track you across sites.

Cookies & analytics

Non-essential browser trackers — Google Analytics 4, the Meta Pixel, and/or Google Tag Manager — load only after you accept them in our consent banner. Until then their scripts are not requested at all. We treat a Global Privacy Control signal from your browser as a decline. They never load on the account, client portal, or admin pages. You can change your choice at any time with the Cookie preferences link in the footer, which also deletes the Google and Meta cookies already set, or by clearing this site’s data in your browser. Each of those tools is also off entirely unless we have configured an id for it.

What this site stores in your browser:

• excellent-consent-v1 (local storage) — your banner choice. Strictly necessary.
• excellent_session, hire_session, excellent_admin_session (cookies) — keep you signed in to an account, the client portal, or admin. Set only when you sign in. Strictly necessary.
• excellent-attribution-v1 (local storage) — the campaign context described above. Only after you accept.
• _ga, _ga_* (Google Analytics) and _fbp, _fbc (Meta) cookies — only after you accept, and only for the tools we have configured.

Server-side conversion measurement. Separately from the browser trackers, when you submit a form we may record the conversion from our own server, so it is counted even when a browser tracker is blocked. Two paths exist. Both are inert until we configure a credential for them, and neither fires unless you accepted in the cookie banner:

• Google Analytics 4 (Measurement Protocol). A sign_up event with the form location, traffic source, and campaign parameters, plus your Google Analytics client id when the browser has one. It does not include your email address. We send it only if you accepted in the banner — decline, or leave the banner unanswered, and it is not sent.
• Meta (Conversions API). A “Lead” event with a hashed (SHA-256, one-way) version of your email address plus technical signals such as your IP address, user agent, and Meta click identifier. It is de-duplicated with the browser Pixel. We send it only if you accepted in the banner. Decline and we do not send it; leave the banner unanswered and we do not send it either — undecided is not consent.

Meta and Google process this information in the United States. International transfers are covered in Subprocessors below.

How we use information

• To reply to you, and to send product updates you asked for.
• To authenticate sessions, schedule calls, send transactional email, process payments, and manage signed documents for a consulting engagement.
• To operate, maintain, secure, and improve the website.
• To measure traffic and understand what is useful.
• To comply with legal obligations and enforce our terms.

Subprocessors

These are the third parties that process personal information on our behalf for the website, accounts, and the client portal. This list is current as of the “last updated” date above.

• Vercel — website and application hosting, plus cookieless analytics. Processes request data for every page you load. United States.
• Supabase — the database behind update signups, accounts, and portal records. United States.
• Stripe — payments and subscription billing for consulting engagements. Stripe is the processor of record for card data. United States.
• Resend — transactional email (sign-in links, booking confirmations, document notices, recovery codes the app asks us to send) and, for people who opt in, our product-update mailing list. United States.
• Google Calendar — when you book a call, we read our own operator calendar for availability and create the meeting event, which carries your name and email and a Google Meet link. United States.
• Google (Analytics 4, Tag Manager) and Meta — analytics and conversion measurement, on the terms in the section above.

All of these providers process data in the United States. Where you are in the EEA, UK, or Switzerland, we rely on each provider’s data-processing terms and an approved transfer mechanism (the EU–U.S. Data Privacy Framework and its UK and Swiss extensions where the provider is certified, otherwise Standard Contractual Clauses).

We will update this list before adding a subprocessor that handles personal information.No data processing agreement is drafted yet. If you need one, email us with the entity that is contracting and the jurisdiction it has to satisfy, and we will have one drawn up to those requirements.

Data retention

We keep contact, account, portal, billing, and signed-document records for as long as we need them to provide the service, satisfy legal and accounting obligations, resolve disputes, and enforce our agreements. Analytics data is retained on each provider’s default schedule.

Your rights & choices

You can ask us to access, correct, or delete the personal information we hold about you, or to unsubscribe from product updates, by emailing hello@excellent.so. We may need to confirm the request comes from you. We answer within one month, or within 45 days for California requests, and tell you if we need longer as the law allows. A deletion covers our database, our email provider, and, where the law lets us, our billing records at Stripe; signed agreements and invoices are kept as long as tax and contract law require.

California residents. Under the CCPA/CPRA you have rights to know, delete, and correct your personal information, and to opt out of its sale or sharing. We do not sell personal information. Our use of advertising-conversion measurement may constitute “sharing” for cross-context behavioral advertising under California law; declining in the cookie banner opts you out. To exercise your rights, contact us at the email above; we will not discriminate against you for doing so.

EEA/UK residents. Where applicable, you have rights to access, rectify, erase, restrict, and port your data, and to object to processing. Our lawful bases are your consent (analytics and advertising) and our legitimate interests or steps taken at your request (operating the website, bookings, accounts, and the portal). You can withdraw consent at any time without affecting earlier processing, and you have the right to complain to your local data protection authority.

How we share information

We do not sell your personal information. We share it only with:

• The subprocessors listed above, for the purposes listed there.
• Legal and safety — if required by law, or to protect our rights, our users, or the public.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.

Security

We use reasonable administrative and technical measures to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. What the product does on your machine is described on our security page. To report a security problem, email security@excellent.so.

Children’s privacy

The website is not directed to children under 13, and we do not knowingly collect personal information from them.

Third-party links

The website links to third-party sites we don’t control. Their privacy practices are their own; please review their policies.

The Excellent CLI

The sections above are about the website, accounts, and the client portal. This section is about the software you install and run.

Excellent is local-first. It runs on your own machine and keeps its state — tasks, attempts, the evidence it collects, results, and receipts — in a database on that machine. The optional plugin shares limited summaries from those records, as described below; it does not upload that database. Running Excellent locally does not require an account with us.

When the app contacts us

These website features send information when you use them. The optional plugin and gateway connection is described separately below.

• Registration. If you register when you first run the app, it sends the email address, and optionally the name and handle, you enter, plus basic details about the install. We store them, with your IP address and user agent, in our database, to keep in touch about the product and understand who uses it.
• Recovery codes. If you ask the app to email your account recovery codes, it sends the codes and your email address to our website, which passes them to our email provider (Resend) to deliver. We do not store the codes, but the delivered message is held by Resend and your mailbox provider like any other email.
• Bug reports. If you file a bug from the CLI or our bug form, we store what you write, an optional contact email, your platform and app version, any context you choose to attach, and a one-way hash of your IP address.

Model calls do not route through us. Depending on how you run it, either Excellent makes the model call itself — from your machine, with your key, straight to the provider you chose — or it runs your own coding agent, which calls its provider under its own account and never shows Excellent a key. In both cases the request goes to your provider on your account, under that provider’s terms. We do not proxy it, we do not have a model provider of our own, and we receive none of it. What ends up in a given prompt is a question about your agent and your provider, not about us. The security page describes both paths.

Team sync is optional and off unless you turn it on. If you enable it, your team’s Excellent installs sync to a server you provision and operate — a small VPS or container on your own infrastructure. Excellent does not host it, does not hold its credentials, and cannot read it. What is synced is described on our security page.

Deleting product data. Because it is on your machine, you delete it yourself. For the plugin agent, use its removal command and the separate gateway controls described on the Support page. Gateway access must be revoked separately.

Excellent for ChatGPT (plugin and hosted gateway)

The sections above are about the website, an Excellent account, the client portal, and the CLI. This section is about the Excellent plugin in OpenAI’s plugin directory — shared by ChatGPT and Codex — and the hosted gateway behind it: a different access point to the same Excellent Software, LLC service, which we also operate.

As of October 8, 2026, the plugin is not yet published. This section describes the v1 read-and-verify connection. It does not claim that production reads or local check execution are available today. ChatGPT and Codex have no tool for starting or running a check, or adopting a contract.

What the gateway is, and is not, told

The service has two parts: a hosted gateway we operate, and the Excellent agent you run on your own machine. The public tools relay identifiers to your paired agent and return limited summaries of local records through the gateway to ChatGPT or Codex. Result summaries exclude local source, commands, evidence, and full receipt contents. The public tools do not run checks.

The four tools are list_verification_workspaces, get_verification_status, get_verification_result, and verify_receipt. Their inputs are limited to lookup identifiers, the expected contract digest and attempt for receipt verification, and workspace-list pagination. There is no task-text or conversation input. The gateway stores read-operation metadata and the returned summaries; these are not held only in memory.

Categories of personal data

• Account and connection data — your Excellent account email, and the OAuth tokens that link your ChatGPT or Codex connection to it.
• Pairing and device data — the stored device public key and the workspace you enroll, so the gateway knows which of your agents to relay a read to. A sha256 fingerprint of that key is not the stored identity.
• Read inputs — workspace, check, operation, attempt, and receipt identifiers; an expected contract digest for receipt verification; and pagination parameters for workspace lists.
• Read-operation records and summaries — operation, account, connection, and workspace identifiers, status and timing, request fingerprints, and returned summaries. Depending on the tool, summaries include workspace and profile labels, check and adoption status, check outcomes, revision and contract digests, receipt references and digests, and receipt-verification findings and limitations.
• Ordinary request data — the IP address and user agent our hosting provider logs for any request, the same as the website (above).

The plugin does not take payment and does not collect payment card data. If you subscribe to the gateway plan, that happens on excellent.so, under the billing identifiers Stripe already gives us, described above.

Purposes

• To authenticate your ChatGPT or Codex connection to your Excellent account.
• To read authorized verification records from your paired Excellent agent and show limited summaries in ChatGPT or Codex.
• To track read operations, limit requests, and operate and secure the gateway.
• To bill the gateway plan, if you subscribe to it.

Categories of recipients

• Excellent Software, LLC, as the operator of the gateway.
• OpenAI, as the platform that shows the plugin to you inside ChatGPT or Codex. What OpenAI does with your interactions in its own product is governed by OpenAI’s own terms and privacy policy, not this one.
• DigitalOcean, as the gateway’s hosting provider.
• Stripe, the same processor listed in Subprocessors above, if you subscribe to the gateway plan.
• Your own Excellent agent, running on a machine you control, which receives the read request and returns the authorized summary. That is your device, under your account, not a third party.

The planned connection will use your existing Excellent account. When launched, our authorization server on www.excellent.so will handle sign-in and issue OAuth tokens. The gateway will check access tokens with that server before granting access. The gateway itself does not issue tokens and does not persist access or refresh tokens; during its own browser sign-in it holds a short-lived access token (valid for at most one hour) in memory only. We have not added a third-party identity provider, CDN, observability provider, or backup provider specific to the gateway beyond what Subprocessors already lists for the website. We will update this section before we add one.

Retention

The periods below for logs, account, pairing and device records, and backups are planned retention targets. Production enforcement of deletion and backup purge has not been verified.

For the planned connection, access tokens will be valid for up to one hour and refresh tokens for up to 30 days, with refresh tokens replaced each time they are used. An authorization grant will last at most 90 days; revoking it will end access sooner. These validity limits are separate from the record retention periods above.

We do not use this data to train a model, sell it, or use it for advertising. These are the retention rules the design is required to meet; as of October 8, 2026 we have not independently re-audited a production gateway against them, and we will correct this page if that changes.

Your controls

• Disconnect Excellent using the connection controls inside ChatGPT or Codex.
• Revoke the gateway connection, or disconnect a device, from your authenticated Excellent account settings.
• Remove the local agent entirely with its own command, from a terminal you control.
• Choose whether to use the read tools. A read shares its lookup inputs and returned summary through the gateway; it does not start or run a verification.
• Request deletion of your gateway account records by emailing hello@excellent.so. The planned target for completing a gateway deletion request is 30 days; production enforcement is not yet verified.

Disconnecting the plugin in ChatGPT or Codex, revoking the gateway connection, and removing the local agent are separate actions — disconnecting the plugin does not by itself revoke gateway access or delete gateway records. The Support page walks through each one.

Adoption and the model

The v1 plugin can report adoption status but cannot adopt a contract. The selected start surface is the local terminal command excellent plugin-agent check start, which requires a person at the terminal. That command currently refuses execution with r9_runtime_unavailable. A model’s confirmation does not grant start, run, or adoption authority.

Consulting engagements

During a paid consulting engagement we may see your systems, repositories, and internal information in order to do the work. That access is governed by the engagement agreement you sign, not by this policy, and we do not copy your code into our own systems beyond what the agreement allows.

Changes to this policy

We may update this policy. We will revise the “last updated” date above, and material changes will be reflected here.

Contact us

Excellent Software, LLC
Email: hello@excellent.so
Security: security@excellent.so

See also our Terms of Service.