Privacy

This policy explains what personal data Patchable collects on this website, why we collect it, how long we keep it, who we share it with, and the rights you have over it under the EU General Data Protection Regulation (GDPR) and the UK GDPR. We've kept it plain.

Who we are

Patchable is operated by Swiftmade OÜ, registered in Estonia (registry code 14173141, VAT ID EE101997148), with its registered office at Pärnu mnt 148, 11317, Tallinn, Estonia. For the purposes of GDPR, we are the data controller for personal data processed through this website.

For any privacy question or to exercise the rights below, email hi@patchable.dev.

What we collect, and why

We try to collect as little as possible. Here's everything:

• Waitlist email. When you submit your address through the “Notify me at launch” form, we store your email address, the page you submitted from, and the time of submission. Purpose: to email you once when Patchable launches. Legal basis: your consent (Art. 6(1)(a) GDPR), given when you submit the form.
• Support correspondence. If you email hi@patchable.dev we keep the message and your address so we can reply and follow up. Legal basis: our legitimate interest in answering you (Art. 6(1)(f) GDPR), or performance of a contract if your message relates to a purchase (Art. 6(1)(b)).
• Analytics. We use Google Analytics 4 to understand aggregate traffic patterns (pages viewed, approximate country, device, referrer). Google Analytics 4 truncates IP addresses and does not store them. Legal basis: our legitimate interest in measuring how the site performs (Art. 6(1)(f) GDPR). You can opt out at any time — see “Cookies and analytics” below.
• Server logs. Our hosting provider records basic request metadata (IP address, user agent, URL, timestamp) for security and abuse prevention. Legal basis: legitimate interest in keeping the site available and secure (Art. 6(1)(f) GDPR).

We do not collect special category data, we do not run advertising trackers, and we do not build behavioural profiles. We do not sell personal data, ever.

How long we keep it

• Waitlist email: until you ask us to remove it, or until 24 months after launch, whichever comes first. After launch we'll send one notification and then delete addresses that haven't opted into anything further.
• Support correspondence: up to 3 years after our last exchange, then deleted.
• Analytics data: retained in Google Analytics for the standard 14-month retention window.
• Server logs: rotated and deleted within 30 days, except where we need to preserve a specific log for a security investigation.

Who we share it with

We share personal data only with the service providers we need to run the site. They process data on our behalf, under contract, and only for the purposes we set:

• Cloudflare, Inc. — hosting and CDN for this website.
• Google Ireland Ltd. — Google Analytics 4 for traffic measurement.
• Google Fonts — the typefaces on this page are loaded from Google's font CDN, which receives your IP address as part of the request.
• Our waitlist backend, hosted on infrastructure we operate, which stores submitted emails in a database run on our behalf by our hosting provider.
• Email provider — we use a transactional email service to send the launch notification and to receive replies to hi@patchable.dev.

We do not share personal data with any other third party for their own purposes. We will disclose data if we are legally required to (court order, valid government request) and will push back where we believe the request is overbroad.

International transfers

Some of our processors are based outside the European Economic Area, principally in the United States. Where personal data is transferred outside the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), together with any additional safeguards required by Schrems II, to keep the data protected to a GDPR standard.

Cookies and analytics

We don't use cookies for marketing or advertising. Google Analytics 4 sets first-party cookies (typically _ga and _ga_*) to distinguish unique visitors. We have configured GA4 with IP anonymisation and without Google Signals or advertising features.

You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on, by using your browser's “Do Not Track” or tracking-prevention settings, or by blocking the analytics script with a content blocker. None of these affect your ability to use the site.

Your rights

Under GDPR and the UK GDPR you have the following rights over your personal data:

• Access — ask for a copy of the data we hold about you.
• Rectification — ask us to correct data that's wrong or incomplete.
• Erasure — ask us to delete your data (“the right to be forgotten”).
• Restriction — ask us to stop processing your data while a question about it is resolved.
• Portability — ask for your data in a structured, machine-readable format, or have it sent directly to another controller.
• Objection — object to processing based on legitimate interest, including analytics.
• Withdraw consent — where we rely on your consent (the waitlist), you can withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal.
• Lodge a complaint — with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the supervisory authority in your country of residence. We'd appreciate the chance to address your concern first, but you do not have to ask us first.

To exercise any of these rights, email hi@patchable.dev from the address concerned, or include enough information for us to identify the record. We respond within 30 days and will tell you sooner if we need more time or more information.

Security

The site is served over HTTPS. The waitlist API enforces TLS, rate-limits submissions, and stores data in a database with access restricted to the operators of Patchable. We don't store payment card data on our own systems — when checkout goes live, payments will be processed by a PCI-DSS compliant provider and we will receive only the metadata we need to fulfil and account for the purchase.

Children

Patchable is a tool for software teams. The site is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has submitted personal data to us, contact hi@patchable.dev and we will delete it.

Changes to this policy

If we change this policy in a way that affects you materially — new processors, new purposes, a meaningful change to retention — we will update the “Effective from” date at the top and, where required, notify you by email before the change takes effect. Smaller clarifications will be made with just the date updated.

Questions

Email hi@patchable.dev. A human reads it.