Draft — to be reviewed by counsel before launch
Privacy Policy
Last updated 30 October 2026
This policy covers the Graphwake website and the Graphwake product (the "service").
Who we are
Graphwake is operated by [legal entity name, registered address and company number]. For the website and for account data we are the controller. For the content a customer puts into its workspace we process personal data on the customer's behalf, as described in our Data Processing Agreement.
The website
The website has no forms. “Start free trial” takes you to the sign-up page of the service, which is covered below.
Analytics
We use Google Analytics to count visits and clicks on “Start free trial”. It sets cookies in your browser to tell visits apart, and we ask it to anonymise IP addresses. It doesn't receive your email address.
The service
What we process
- Account data: the name and work e-mail address of each person in a workspace, their role, the teams they belong to, and the company name of the workspace.
- Workspace content: the API specifications a workspace uploads or lets us fetch, its services, teams, endpoint subscriptions, ownership, change history and audit log. Specifications can contain personal data only if a customer puts it there (for example an author name in a description).
- CI metadata: for each upload from a pipeline, the CI platform, the branch name, the commit SHA and commit time, the pull request number and link, and the pull request author's name as the pipeline reports it.
- Integration data: when a workspace connects Slack or Microsoft Teams, the workspace and channel identifiers needed to post alerts. Access tokens are stored encrypted.
- Billing data: the plan, subscription status and invoices. Card details are entered on Stripe's page and never reach us.
- Security data: sign-in and API key records (only hashes of keys and links are stored) and a record of administrative actions in the workspace's audit log.
Why, and on what basis
- To provide the service a customer signed up for: performance of our contract with the customer.
- To keep the service secure and to prevent abuse: our legitimate interest.
- To bill for the service and keep accounting records: our legal obligations and the contract.
- To send service e-mails (sign-in links, invitations, alerts, billing notices). We send no marketing e-mail from the service.
Where your data is stored
The service and its database run in the European Union (AWS eu-central-1, Frankfurt). Some sub-processors below may process data outside the EU; where they do, the transfer is covered by the European Commission's Standard Contractual Clauses.
How long we keep it
| Data | Kept |
|---|---|
| Workspace content (specs, services, teams, subscriptions, change history, audit log) | While the workspace is open |
| A closed workspace's data | 12 months after the account is closed, then deleted by our team (not automatically); sooner on request |
| Sign-in links, sessions and API keys that have ended | 30 days |
| Records of delivered notifications | 90 days |
| Records of CI uploads | 180 days |
When an account is closed, we keep the workspace's data for 12 months so the customer can reopen it. Deletion is done by our team, not by an automatic job: we delete the data at the end of that period, or sooner when an admin asks by writing to hello@graphwake.com. Invoices are kept as long as accounting law requires.
Sub-processors
| Sub-processor | Purpose | Location | Used |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Hosting, database and backups | EU (eu-central-1, Frankfurt) | Always |
| Stripe Payments Europe, Ltd. | Subscription billing and card payments | EU, with transfers to the US under Standard Contractual Clauses | When the workspace subscribes to a paid plan |
| Slack Technologies, LLC | Delivering change alerts to Slack channels | US, under Standard Contractual Clauses | Only when the workspace connects Slack |
| Microsoft Ireland Operations Limited | Delivering change alerts to Microsoft Teams channels | EU, with transfers under Standard Contractual Clauses | Only when the workspace connects Microsoft Teams |
| E-mail delivery provider (to be named before launch) | Sign-in links, invitations, alerts and billing e-mails | To be confirmed before launch | Always |
Your rights
You can ask for a copy of your personal data, have it corrected or deleted, object to or restrict its processing, and receive it in a portable format. If your data is in a customer's workspace, we will pass your request to that customer, who decides on it. You can also complain to your data protection authority.
Security
Data is encrypted in transit and at rest. Each workspace's data is isolated in the database by row-level security, sign-in links, sessions and keys are stored only as hashes, and administrative actions are recorded in an audit log that cannot be changed.
Contact
Write to hello@graphwake.com for any privacy question or request.