Privacy

Working draft. The service is not open: no customer data is processed today. This text describes what will be processed when it opens, and will be completed with the identity of the data controller at incorporation.

What we store

Your account: email, name if you give one, language, and the devices you sign in from. Your organisation and its members. The existence of your servers — a name, an address, the agent version, the state of the entitlement — and the public half of your device keys. Your subscriptions and invoices, held by Stripe.

What we never store

No code, no project file, no service secret, no application log, no terminal content, no environment variable, no private key. What lives on your server stays on your server: the platform has no technical means of fetching it.

Analytics

The site measures page views with PostHog, without advertising cookies and without a durable identifier, and only after you agree in the banner. Declining takes nothing away from the site. The console measures screen usage on the same terms.

Transactional email

We send what makes the account work: address confirmation, sign-in, invitation to an organisation, alert about a server, billing notice. Those cannot be turned off while the account exists. Optional messages — news, tips — are turned off in one click from the message itself.

Payments

Stripe acts as merchant of record: it collects, invoices, handles taxes and holds the payment data. We keep a Stripe customer identifier, the plan, the state of the subscription and the invoice history. Never a card number.

Sub-processors

Sub-processor	Purpose	Region
Cloudflare	Hosting of the site and the console, binary storage, transactional email delivery	Global network
Neon	Platform database: accounts, organisations, servers, subscriptions	United States at launch; eu-central-1 today
Stripe	Merchant of record: payment, invoicing, taxes	United States and Ireland
PostHog	Site analytics, only after consent	United States at launch; European Union today
GitHub	Distribution of the signed desktop app releases	United States

The publisher will be a United States company and the platform will be hosted in the United States; the database still lives in a European region today and will be migrated before launch. [Full contact details, country of establishment for each sub-processor and the legal basis for transfers to be published when the service opens.]

Retention

The account and the organisation are kept while the account exists, then for thirty days after its deletion, in case the deletion was a mistake. Invoices are kept for as long as the applicable accounting law requires [duration to be confirmed at incorporation]. Analytics are kept for twelve months.

Your rights

You can see, correct, export and have your data deleted. Deleting the account is done from the console and also deletes the organisations where you are the only member. For anything else, write to privacy@pupitre.studio; we answer within thirty days. [Competent supervisory authority and details of any representative to be completed at incorporation.]