GDPR
How Packrat handles personal data under the EU and UK General Data Protection Regulation: who is responsible for what, which companies process data for us, and how to use your rights.
Last updated October 13, 2026.
Who is responsible for what
For telemetry data, you are the controller and Packrat is your processor. Your apps decide what is in it. Packrat stores and processes it on your instructions, to provide the service, and for nothing else.
For account data, Packrat is the controller. That is your email address, your name, your sessions and what you write to us. The privacy policy says what we collect and why.
Personal data in telemetry
Telemetry often holds personal data without anyone meaning it to: an email address in a log line, a user id on a span, an IP address, the text of a page in a session replay. You decide what your apps send, so:
- send ids in place of names and addresses where you can;
- use the scrubbing and masking options of your OpenTelemetry, Sentry or Datadog SDK before data leaves your app;
- do not send special categories of personal data.
Legal bases
For account data, we rely on the contract with you (to provide the service), on our legitimate interest in keeping the service secure and working, and on legal obligation where one applies.
Sub-processors
These companies process data for Packrat.
| Company | What it does | What it receives |
|---|---|---|
| build.io | Runs the app and its Postgres database, in the United States | Account data, telemetry on its way to storage |
| Cloudflare | Network edge and R2 object storage | Requests to packrat.sh, stored telemetry |
| Anthropic | The model behind Packrat's agent | The telemetry and code excerpts the agent looks at, for apps it is on for |
| Mailer To Go | Sends email | Email addresses, and the content of sign-in and report mail |
| GitHub | Sign-in, and repository access if you connect one | Your GitHub identity |
We tell account holders by email before we add a sub-processor that receives telemetry.
Where data is processed
Packrat processes data in the United States. There is no EU region today. If you send personal data from the EU or the UK, that is a transfer to the United States, and it needs a data processing agreement with standard contractual clauses.
Data processing agreement
Write to [email protected] for a data processing agreement.
Retention and deletion
Telemetry is kept for 12 months for active customers. Deleting your organization or application immediately deletes its data.
Your rights
For account data, you can ask for access, correction, deletion, restriction, or a copy you can take elsewhere, and you can object to processing. Write to [email protected]. We answer within 30 days. You can also complain to your data protection authority.
If your personal data is in a Packrat customer's telemetry, ask that customer: they are the controller, and we help them answer.
If something goes wrong
If we learn of a breach of personal data in your org, we tell the org's members by email without undue delay, with what we know about what was affected.