Privacy policy

Controller

Identity and contact details: [To be completed before commercial launch]

Data protection officer (if any): [To be completed before commercial launch]

Data processed

Patcharo processes the following categories of data:

• Account: e-mail address, display name, language, creation and sign-in dates.
• Sessions: session id, IP address and browser, to show and revoke your active sessions.
• Workspaces: name, members and roles, invitations, notification preferences.
• Inventory entered by your teams: devices, versions, environments and, if you fill them in, hostnames, management IP addresses, serial numbers, notes.
• Tracking: remediation statuses, exceptions, alerts and the audit log of changes.
• Billing (once online payment opens): Stripe customer and subscription ids; card data is processed by Stripe and never stored by Patcharo.

Purposes and legal bases

Data is used to provide the service: authentication, analysis of your devices against public vulnerabilities, collaboration, alerts and account security.

Legal basis for each purpose: [To be completed before commercial launch]

Patcharo uses no advertising, no audience measurement and does not sell data.

Processors

The following technical providers take part in running the service:

• Cloudflare — application hosting and delivery.
• Supabase — database and authentication.
• Resend — transactional e-mails (confirmation, password reset, alerts).
• Stripe — payment (once online payment opens).

Transfers outside the European Union

Data location, transfers and safeguards: [To be completed before commercial launch]

Retention

Retention periods for accounts, workspace data, the audit log and billing: [To be completed before commercial launch]

Deleting your account from Settings › Account erases your account and the workspaces you own that have no other member, with their data; a shared workspace must first be handed over to another member.

Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to lodge a complaint with a supervisory authority (in France, the CNIL).

How to exercise them and contact: [To be completed before commercial launch]