Por ahora, esta página solo está disponible en inglés.
Privacy policy
Last updated: 17 October 2026
1. Who is responsible
The controller for the personal data described here is DIGT CONSULTING BV, Muidepoort 46, 9000 Gent, Belgium, Company no. BE0783.477.116, VAT BE0783.477.116. Contact us about anything in this policy at privacy@pullpress.app.
Two roles apply. For your own account, billing, security logs and (consented) analytics, we are the controller. For the content and people a customer manages in a workspace — the sites, the editors they invite, change requests and comments — the workspace owner is the controller and we process that data on their behalf as a processor, under our Data Processing Agreement. If you were invited into someone else's workspace, they are your first point of contact for that data.
2. What we store
Your published content (pages, posts, images, data files) lives in your own GitHub repository, not in our database. Drafts are branches in that repository. What we do store is precisely this:
- Account: email address, display name, global role, interface preferences (language, theme, help display), which notification emails you want and, from sign-up, when you accepted which version of the terms.
- Workspace data: workspace and site names and settings, memberships and roles, invitations, branding, and the GitHub owner/repository names of connected sites. For each connected GitHub installation: the GitHub account it lives on, the numeric GitHub id of the person who confirmed access to it, when they did, and which of its repositories they could push to at that moment.
- Editorial workflow: change requests (title, entry path, collection, status, branch and pull-request number, review notes, schedule), comments and mentions on them, content ideas (title and note), and — for changes drafted by an AI agent — the model, prompt and sources it recorded.
- Search index: entry titles and their vector embeddings (computed from the title and a short excerpt of the entry), for semantic search on paid plans.
- AI requests: the text, diff, image or prompt you send to an AI feature is passed to Anthropic or OpenAI to process that one request. We store only the outcome you choose to save, and a monthly usage counter per workspace.
- Devices: if you use the PullPress Apple app (iPhone, iPad or Mac) with notifications, the Apple push token of your device.
- Credentials: personal API tokens and OAuth tokens for connected apps are stored only as SHA-256 hashes; sign-in uses single-use magic links (no passwords), and the sign-in link in an invitation is stored only as a hash. Workspace-supplied AI keys are stored encrypted.
- Billing (paid plans): a Stripe customer and subscription reference and the plan status. Card details, billing address and VAT id are held by Stripe, never by us.
- Git commits: changes you make are committed to the site's repository under your display name and, by default, a pseudonymous no-reply address (an internal id plus a short handle — never your email address). A site administrator can choose to record editors' real email addresses instead; the site settings say which applies.
- Security and operations: session records (IP address and browser user-agent), rate-limit counters keyed by IP address, and request/function logs at our hosting provider.
- Analytics: only if you accept analytics — pseudonymous usage events and error reports, linked to your account by an internal user id (never your email or name).
- Server error reports: when something breaks on our servers, an anonymous technical report (error type, message and stack with email addresses and ids removed, route) goes to our error tracking. It contains no account, workspace or site identifiers and is not linked to you.
3. Why, and on what legal basis
- Providing the service — your account, sign-in, workspaces, the editor and review flow, notifications, AI features you invoke, push notifications you enable: performance of our contract with you (Art. 6(1)(b) GDPR).
- Billing, invoicing and tax: our contract and our legal obligations under tax and accounting law (Art. 6(1)(b) and (c)).
- Keeping the service secure and reliable — session records, rate limits, logs, abuse prevention and anonymous server error reports: our legitimate interest in a secure service (Art. 6(1)(f)).
- Product analytics and client-side error tracking: your consent (Art. 6(1)(a)), which you can withdraw at any time via “Analytics settings” in the site footer or on your profile page in the app (or by clearing the pp_consent cookie).
- Processing on behalf of workspace owners: their instructions under the Data Processing Agreement (Art. 28).
We never sell personal data, use it for advertising, or let AI providers train on it.
4. How long we keep it
- Account data: as long as your account exists. Delete it yourself under Profile → Delete account (or via the Apple app); it is removed from the live database immediately.
- Workspace and workflow data: as long as the workspace or site exists. Deleting a site or workspace removes its change requests, comments, ideas and search index. If you delete your account, change requests, comments and ideas you wrote stay with the workspace without any link to you.
- Sign-in links: valid for 10 minutes and single-use; the sign-in link in an invitation email is single-use and valid for 7 days, and stops working once you have signed in. The code in a sign-in email is valid for 10 minutes, works once and is stored only as a hash. Sessions expire after 30 days without use; signing out ends them immediately.
- API tokens, connected apps and device tokens: until you revoke them, sign out on the device, or delete your account.
- Database backups: roll over automatically within at most 30 days, after which deleted data is gone from backups too.
- Hosting logs: kept by our hosting provider for a limited period (at most 30 days).
- Analytics events (only with consent): at most 12 months.
- Billing records and invoices: as long as tax and accounting law requires (typically 7 years), held by Stripe and in our books. When deleting your account deletes a workspace, its Stripe customer record (name, address, VAT id) is deleted too; the invoices themselves are kept for that legal period.
- AI providers keep API inputs and outputs for at most 30 days for abuse monitoring, under their API terms, and do not use them for training.
Content committed to your Git repository — including commit author names and addresses (a no-reply address unless the site records real email addresses) — is under the control of the repository owner and is not removed by deleting a PullPress account. When deleting your account deletes a workspace, we also uninstall the PullPress GitHub App from the GitHub account it was installed on, unless another workspace still uses it; you can always uninstall it yourself in your GitHub settings.
5. Who processes it
We use the following sub-processors, each bound by a data processing agreement:
- Netlify, Inc. — Hosting of the web app and serverless functions; request logs (United States (global edge network)).
- Supabase, Inc. — Managed Postgres database (account and workflow data, backups) (European Union (AWS Frankfurt region)).
- Resend (Plus Five Five, Inc.) — Sending sign-in links and notification emails (United States).
- GitHub, Inc. — Reading and writing your content in your repository via the GitHub App (United States).
- Stripe Payments Europe, Ltd. / Stripe, Inc. — Subscription billing, invoices, tax calculation and payment processing (Ireland and United States). Paid plans only.
- Anthropic, PBC — AI text helpers (translation, change summaries, quality checks, refresh drafts) (United States). Only when an AI text feature is used.
- OpenAI, L.L.C. — AI image generation and editing, alt-text suggestions, semantic-search embeddings (United States). Only when an AI image/alt-text feature or semantic search is used.
- PostHog, Inc. — Product analytics and error tracking (European Union (PostHog EU Cloud, Frankfurt)). Only after you accept analytics.
- Apple Inc. — Push notifications to the PullPress iOS app (Apple Push Notification service) (United States). Only if you use the iOS app and allow notifications.
The full list with transfer mechanisms is on the sub-processors page. Stock-photo search (if your administrator enables it) sends only your search terms to Pexels.
6. International transfers
Our database and analytics are hosted in the EU. Some sub-processors (see above) are based in the United States. Where personal data leaves the EEA, it is protected by the EU–US Data Privacy Framework where the recipient is certified, and otherwise by the European Commission's Standard Contractual Clauses, together with the supplementary measures they require (encryption in transit, data minimisation, hashing of credentials).
7. Cookies and local storage
Strictly necessary: the sign-in session cookie, pp_org (your active workspace), pp_theme and pp_locale (your display preferences), and pp_consent (your analytics choice). These need no consent.
Analytics: only after you click Accept on the consent banner does PostHog store an identifier in your browser (cookie/local storage). Before that — or if you decline — no analytics run at all. We use no advertising or cross-site tracking cookies.
8. Your rights
You have the right to access, rectify, erase, restrict and object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time without affecting earlier processing.
Self-service: under Profile you can edit your name, download a JSON export of your account data (profile, memberships, token metadata, and the change requests, comments and ideas you wrote) and delete your account. For anything else, email privacy@pullpress.app; we answer within one month.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live, work, or where the alleged infringement took place.
9. Security
All traffic is encrypted in transit; credentials are hashed or encrypted at rest; GitHub access uses short-lived installation tokens; and access is isolated per workspace. Details are on the security page.
10. Children
PullPress is a business tool and is not directed at children under 16.
11. Changes
We update this policy when our processing changes and change the date above. Material changes are announced to account holders by email before they take effect.