Last updated · 2026-07-04
Privacy Policy
Adaptrix S.L. · Spain. Privacy contact: hello@adaptrix.ai.
1 · Scope
This Privacy Policy describes how Adaptrix S.L. ("Adaptrix", "we") collects, uses, and protects personal data of users of FlowTrace (flowtrace.adaptrix.ai, "Service").
By using the Service you accept this Policy. If you do not accept, do not use the Service.
2 · Data we collect
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Identity | Email, GitHub login, GitHub user ID, name | Account creation, login | Contract (Art. 6.1.b) |
| Technical | IP, user-agent, session ID | Security, abuse prevention | Legitimate interest (Art. 6.1.f) |
| Code metadata | Repo URLs, file paths, function names, call graph nodes | Service core (graph indexing) | Contract (Art. 6.1.b) |
| Billing | Stripe customer ID, subscription status, billing email | Payment processing | Contract (Art. 6.1.b) |
| Behavioral | Login timestamps, indexed repos count | Service improvement, abuse prevention | Legitimate interest (Art. 6.1.f) |
We do NOT collect: repository file contents, special-category data (Art. 9 GDPR), or marketing tracking cookies.
3 · Sub-processors
- GitHub Inc. — OAuth provider, repository hosting. US (DPF certified).
- Stripe Payments Europe Ltd — payment processing. Ireland.
- Hetzner Online GmbH — server infrastructure. Germany.
- Cloudflare Inc. — DNS + CDN. US (SCCs).
4 · International transfers
GitHub and Cloudflare process some data in the United States under EU-US Data Privacy Framework (DPF) certification and Standard Contractual Clauses (SCCs) as applicable.
5 · Retention
- Active account data: duration of account + 30 days after deletion.
- Billing records: 6 years (Spanish tax law).
- Logs (IP, user-agent, login timestamps): 12 months.
- Code graph indexes: deleted within 30 days of subscription cancellation.
6 · Your rights (GDPR Art. 15-22)
You can access, correct, delete, restrict, port, object, or withdraw consent.
Requests to hello@adaptrix.ai — response within 30 days. You may also lodge a complaint with AEPD (www.aepd.es).
7 · Cookies
We use only functional cookies: flowtrace_session (JWT, HttpOnly, Secure, SameSite=Strict, 7 days) and flowtrace_csrf (session lifetime). No analytics, advertising, or third-party tracking cookies.
8 · Security
TLS 1.3 in transit. AES-256 at rest. Passwords never stored (GitHub OAuth only). Stripe handles all payment card data (PCI DSS Level 1). Annual penetration testing. Incident notification within 72 hours per Art. 33 GDPR.
9 · Children
Service not directed to users under 16. We do not knowingly collect data of minors.
10 · Changes to this Policy
Material changes: email notification + 30 days notice. Non-material: revised "Last updated" date.
11 · Contact
- Data controller: Adaptrix S.L., Spain
- Privacy contact: hello@adaptrix.ai
- Supervisory authority: AEPD (www.aepd.es)