Privacy Policy

The controller of personal data is Pierrr Technologies Ltd, a company registered in England and Wales under number 17477101, whose registered office is at 20 Wenlock Road, London, England, N1 7GU, United Kingdom. For any question about your data or this policy, write to team@pierrr.com with "Personal data" in the subject line. We apply the UK GDPR and the Data Protection Act 2018 and, for people in the European Economic Area, the GDPR.

We collect the following categories:

• Account data: email address, name, the identifier from the authentication provider (GitHub, GitLab or Google) when you sign in that way and, if you choose to sign in by email, a password (stored as a hash), a passkey or a second authentication factor.
• Organisation and project data: organisation name, invited members and their roles, project names, linked repositories, build and deployment logs, domains, access tokens (stored as a hash) and the log of actions taken in your organisation.
• Servers you connect: when you manage a server with the Pierrr agent, we receive its name, its system, the agent version, the state and usage of its containers and, for security scans, the identifier and severity of each finding. The content of your applications and databases stays on your server, except for operations you request.
• Technical data: IP address, browser type, sign-in and error logs, needed to run and secure the service.
• Product usage data: page views, dashboard actions and journey steps, measured with PostHog (see the cookie policy). These measurements are anonymous by default and only become identifiable with your consent.
• Notifications: your preferences and, if you enable browser notifications, the subscription address your browser gives us.
• Billing data: plan, payment history and subscription status. Card data is handled directly by Stripe and never passes through our servers.
• Referrals: the link between the referring account and the referred account, and the code used.
• Subscriptions: the email address you leave for the waiting list, the newsletter or status page alerts.
• Messages to us: messages sent to support, by email, form or chat.
• Content you entrust to us: the code of your repositories, your projects' variables and secrets (stored encrypted), and the data in your managed databases. For this content we act as a processor (see the data processing agreement).

To help you or resolve an incident, an authorised member of our team may access your account in support mode. This access is limited to what is necessary, logged, and only happens to handle a request or an incident.

Each processing activity relies on a legal basis under Article 6 of the UK GDPR and the GDPR:

• Providing the service (account creation, deployment, hosting, backups): performance of the contract.
• Billing and subscription management: performance of the contract and legal obligation (accounting).
• Security, fraud and abuse prevention: legitimate interest in protecting the platform and its users.
• Transactional emails (verification, deployment alerts, invoices): performance of the contract.
• Audience measurement and product improvement with identifiable data or session recording: consent.
• Support and answers to your requests: legitimate interest and performance of the contract.
• Artificial intelligence assistant: performance of the contract when you use it. No decision with a legal effect on you is made solely by automated means.

• Account and organisation: kept while your account is active, then deleted within 90 days after the account is closed.
• Project content (deployed code, secrets, managed databases): deleted when the project is decommissioned; the matching encrypted backups are purged within 30 days.
• Billing data: kept for 6 years, or longer if the applicable law requires, for accounting and tax obligations.
• Technical logs: kept for up to 12 months for security and diagnostics.
• Identifiable analytics data: deleted when you withdraw consent, and at the latest 12 months after collection.
• Support communications: kept for 3 years after the last interaction.

We use carefully chosen processors, each for a specific purpose. The up-to-date list, with their location and the safeguards that apply, is on the sub-processors page (/legal/subprocessors). It includes authentication providers (GitHub, Google), payment (Stripe), audience measurement (PostHog), email delivery, infrastructure hosting, network protection (Cloudflare) and artificial intelligence assistance (Anthropic, whose models are not trained on your data).

We never sell your personal data. We may disclose it to an authority where the law requires.

Pierrr is established in the United Kingdom and its infrastructure is hosted in the European Union. Transfers between the United Kingdom and the European Economic Area rely on the adequacy decisions that apply. Some providers (GitHub, GitLab, Google, Stripe, Resend, Cloudflare, Anthropic) may process data outside the United Kingdom and the European Economic Area, in particular in the United States. These transfers are covered by a recognised mechanism: an adequacy decision or applicable data protection framework, or standard contractual clauses and the UK addendum. You can ask us for a copy of the safeguards that apply.

Depending on the law that protects you, you have the rights of access, rectification, erasure, objection, restriction of processing and portability of your data. You can withdraw your consent at any time for processing that relies on it (identifiable audience measurement), without affecting what was done before. If you are in another country, you may benefit from additional rights under its law. To exercise your rights, write to team@pierrr.com. We reply within one month, extendable by two months for complex requests. We may ask you to verify your identity.

The detail of cookies and similar technologies (session, theme, language, consent, analytics) is in our dedicated cookie policy, available at /legal/cookies.

We use appropriate technical and organisational measures: HTTPS encryption for communications, encryption at rest for customer secrets and backups, isolation between each customer's spaces, and access control and logging. Internal access to data is limited to authorised staff bound by confidentiality. If you find a flaw, follow the vulnerability disclosure procedure (/legal/vulnerability-disclosure). If a data breach is likely to put you at risk, we tell you and the competent authority within the legal deadlines.

The service is meant for adults and organisations. We do not knowingly collect data about people under 16; if you think a minor has sent us data, write to us and we will delete it.

If you think the processing of your data does not comply with the rules, we invite you to write to us first so we can put it right. You can also lodge a complaint with the Information Commissioner's Office (ICO) in the United Kingdom (ico.org.uk), or with the data protection authority of your country of residence, for example the CNIL in France (cnil.fr).

We may update this policy. The date of the last update is at the top of the page, and we tell you about any material change.