Privacy policy
Last updated: 20 October 2026
This policy explains which personal data we process when you visit patchpatrol.ai or the documentation at docs.patchpatrol.ai, or when you contact us.
1. Controller
aistack GmbH Managing director: Moritz Tanzer Siezenheimer Str 39B, 5020 Salzburg, Austria Email: contact@patchpatrol.ai
We have not appointed a data protection officer because we are not legally required to. Please send any privacy questions to the address above.
2. What this policy does not cover: the PatchPatrol software
PatchPatrol runs in your own infrastructure, for example in your CI or locally. Review content goes only to the model endpoint you configure. The software sends no usage data to us, and the licence is checked locally, without contacting a licence server. So we receive no data from your review runs. If you configure a remote model provider, that provider processes the content it receives under its own terms.
3. Hosting
Both websites run on servers of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, in its Falkenstein data centre in Germany. Hetzner processes data on our behalf under a data processing agreement (Art. 28 GDPR).
When you open a page, your browser sends the technical data needed to deliver it: your IP address, the date and time, the requested address, the page you came from (referrer), and your browser and operating system. We use this data only to deliver the pages and to fend off attacks. We do not keep access logs with this data.
The legal basis is our legitimate interest in running the websites securely and reliably (Art. 6(1)(f) GDPR).
4. Contact form
When you use the contact form, we process your name, your work email address, your company, your message and the language of the page you write from. We use these details only to answer your request. Providing them is voluntary, but we cannot handle your request without them.
How your request travels:
- Your browser sends the form to our server over an encrypted connection.
- To prevent abuse, the server forwards at most five requests from one IP address within ten minutes. For this, the IP address is held only in the server's memory. It is not written to disk and is deleted at the latest when the server restarts.
- The server hands your request to the email service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA), which delivers it as an email to our mailbox contact@patchpatrol.ai. Your email address is set as the reply-to address so we can answer you directly.
Resend processes data in the USA. The transfer is based on Resend's certification under the EU-US Data Privacy Framework (Art. 45 GDPR) and, in addition, on the European Commission's standard contractual clauses in our data processing agreement with Resend (Art. 46 GDPR).
Legal basis: if your request is about a pilot, pricing or working together, we process it to take steps at your request before a possible contract (Art. 6(1)(b) GDPR). For all other requests, the basis is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
Retention: we delete your request six months after the last message on the matter, unless it leads to a business relationship. Statutory retention obligations, for example under commercial or tax law, remain unaffected.
5. Contact by email
If you write to contact@patchpatrol.ai directly, we process your message and the details from the email exchange. The legal basis and retention period are the same as for the contact form.
6. Audience measurement with Plausible Analytics
To understand which pages people read, we use Plausible Analytics by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Plausible sets no cookies and stores nothing in your browser. The data is processed in the EU.
Plausible records the page you open, the page that referred you, how long you stay on it and how far you scroll, your approximate location (country, region, city), and your device type, browser and operating system. We send page addresses without query parameters or fragments. Nothing you type into a form is ever sent.
Plausible processes the data on our behalf under a data processing agreement (Art. 28 GDPR). The legal basis is our legitimate interest in improving our websites based on aggregated usage figures (Art. 6(1)(f) GDPR). You can object at any time (section 9). You can also block the measurement technically, for example with a tracking blocker.
7. Storage in your browser
If you switch between the light and dark theme, your browser saves your choice in its local storage (entry "theme"). The entry stays on your device and is not sent to us. It is strictly necessary for the function you asked for (§ 165(3) of the Austrian Telecommunications Act 2021). You can delete it at any time in your browser settings.
patchpatrol.ai and docs.patchpatrol.ai do not set cookies.
8. Fonts and links
We serve all fonts from our own server. Apart from Plausible (section 6), opening our pages makes no connection to third parties. Links to other websites, such as aistack.at, open only when you click them; the privacy policy of that site's operator applies there.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). Where we process data based on legitimate interests, you can object on grounds relating to your particular situation (Art. 21 GDPR). To exercise these rights, write to contact@patchpatrol.ai.
If you believe we process your data unlawfully, you can lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde): Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at, www.dsb.gv.at.
10. No automated decisions
We make no automated individual decisions and do no profiling (Art. 22 GDPR).
11. Changes
We update this policy when our websites or the law change. The version published on this page applies.