Commit Karma only retains basic information related to github Users, Repos, Pull Requests and Code Reviews. It only uses this data to calculate a users "karma" (a users pull request to code review ratio across all projects) and other similar statistical summaries of data. Commit Karma never reveals information about private repostories or specific repositories or organizations a user may contribute to.
Commit Karma never sells any data to 3rd parties nor does it retain any personal information other than basic public information that github provides as part of its public api.