Privacy Policy

This policy explains how patu.dev ("we", "us"), the operator of the Patu hosted service at patu.dev, handles personal data. We are the data controller for the personal data described here. Contact: hello@patu.dev.

1. What we collect

• Account data. The email address you sign up with, and the API key issued to your account.
• Authentication data. Short-lived sign-in links and a session cookie that keeps you logged in to the dashboard.
• Billing data. If you subscribe to a paid plan, our payment processor, Stripe, handles your payment. We do not receive or store your full card number; we receive limited data such as your subscription status, plan, and billing metadata needed to run your subscription.
• Usage and technical data. Request metadata and server logs, including IP address, timestamps, endpoint, response size and status. We use these to run rate limiting, detect abuse, keep the Service reliable, and understand aggregate usage.
• The files you send. The assets you submit for optimization are processed to produce the optimized output. If you use stored mode, the optimized variants are retained so they can be served back to you; if you use inline mode, they are processed to fulfill the request and not retained as a stored asset. Do not send files containing personal data you are not entitled to process.

2. Why we use it, and our legal bases

• To provide the Service (create your account, authenticate you, optimize and serve your assets): performance of our contract with you.
• To bill paid plans: performance of our contract, and compliance with legal obligations such as tax and accounting.
• To keep the Service secure and reliable (rate limiting, abuse prevention, logging, aggregate analytics): our legitimate interest in operating and protecting the Service.
• To communicate with you about your account and material changes: performance of our contract and our legitimate interest.

3. Cookies

We use a single session cookie to keep you signed in to the dashboard. It is strictly necessary for the login feature. We do not use advertising or cross-site tracking cookies.

4. Who processes data on our behalf

We use a small number of service providers ("processors") to run the Service. They process data only to provide their service to us:

• Stripe — payment processing and subscription management.
• Resend — sending transactional email (such as sign-in links).
• Cloudflare — content delivery, edge serving, and R2 object storage for stored assets.
• Scaleway — hosting of the Service, in data centers in the European Union.

5. International transfers

The Service is hosted in the European Union. Some processors may handle data outside the European Economic Area. Where that happens, the transfer relies on an appropriate safeguard such as the European Commission's Standard Contractual Clauses or an adequacy decision.

6. How long we keep it

• Account data: for as long as your account is open, then deleted or anonymized within a reasonable period.
• Stored assets: until you delete them, or your subscription ends and they fall outside your plan's limits.
• Logs: for a limited retention window used for security and reliability, then deleted or aggregated.
• Billing records: for as long as tax and accounting law requires.

7. Your rights

Subject to applicable law, you can ask to access, correct, delete, restrict, or port your personal data, and object to certain processing. To exercise any of these, email hello@patu.dev. You also have the right to complain to your data protection supervisory authority; in France this is the CNIL.

8. Security

We use reasonable technical and organizational measures to protect personal data, including encryption in transit, access controls, and secrets kept out of application logs. No system is perfectly secure, but we work to reduce risk and to respond if something goes wrong.

9. Children

The Service is not directed to children and is not intended for anyone under the age at which they can consent to data processing where they live. Do not use the Service if you are under that age.

10. Changes

We may update this policy. If a change is material, we will give reasonable notice. The "last updated" date above always reflects the current version.

11. Contact

Privacy questions: hello@patu.dev.