Privacy policy

Version draft. What plinto keeps about you, why, who else sees it, and what you can ask of us.

1. Who is responsible

[the company providing plinto], of [its country], is responsible for the personal data of the people who sign in to plinto. What an organization puts in plinto (its code, packages and logs, which can hold personal data such as the names and email addresses git records with each commit) we handle on that organization's behalf, as it asks. [A data processing agreement for organizations.]

2. What we keep

From Google or GitHub, when you sign in with them: the account's stable identifier and the email address they vouch for. Never your password.
What you give us: your user name; the SSH public keys you add, with their titles; the organizations you make or join, and the invitations you send.
What you do: reviews, comments, approvals, favourites, and the builds, releases and deployments you start, each with your user name and when.
Your organization's content: its git repositories, packages, build logs, and its pipelines' and environments' settings, including the addresses of the servers it deploys to.
To keep you signed in: a session cookie on plinto's addresses, until you sign out or for at most 365 days, and short-lived cookies while you sign in. The CLI's access keys are signed, not stored. plinto uses no advertising or tracking cookies.
How much is used: each organization's build minutes and storage, measured every few minutes.
Logs: plinto's services log which address was asked for and how it went, with user names in a few cases. The front door people use keeps no access log; the cache and proxy plinto's build workers reach the internet through log the addresses that reach them. Logs are kept until they rotate, a few days. [Confirm before publishing.]

3. Why

To give you the service you signed up for (our contract with you).
To keep plinto and its users safe: stopping abuse, investigating faults (our legitimate interest).
When the law requires it.

We don't sell personal data, use it for advertising, or profile you.

4. Who else handles it

OVHcloud, which hosts plinto's servers, its build workers and its file storage, in the European Union. [Name the data centres and the agreement with OVHcloud.]
Google and GitHub, only when you choose to sign in with them, under their own privacy policies.
Public package registries (Maven Central, npm, the Go module proxy, crates.io and toolchain vendors) receive plinto's requests for public packages, never your personal data.
Servers your organization deploys to receive what it deploys.

Nobody else, unless the law obliges us, in which case we tell you if we may.

5. Where

plinto keeps its data in the European Union. Signing in with Google or GitHub involves them, wherever they process it. [Transfers outside the EU, if any.]

6. How long

Your account, for as long as you have it.
An organization's data, until 30 days after it is deleted, when every part of plinto deletes it.
Backups, for up to [how long].

7. What you can ask

You can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, or to send it to you in a common format, and you can complain to a data protection authority. Your user name stays on the reviews, comments and builds of the organizations you worked in, which are theirs; we can replace it with a placeholder. Write to [a contact address].

8. Security

plinto is reached over encrypted connections only; sessions and invitations are kept as hashes; each build runs on a worker, isolated from other organizations' builds and from plinto's own secrets.

9. Children

plinto is not meant for anyone under 16.

10. Changes

We will tell you about important changes before they apply. plinto records which version each person accepted.

11. Contact

[a contact address]