Skip to content
DownloadDocsChangelogBenchBlog

Privacy Policy

Last updated: 2026-07-01

1. Data Controller

The data controller within the meaning of Article 4 GDPR is:

2. Data collected on paneflow.dev

The website paneflow.dev uses two complementary analytics tools:

  • -Vercel Analytics · infrastructure metrics (page views, Web Vitals) provided by the hosting provider.
  • -PostHog · cookieless mode, no cookie is set, no identifier is persisted in the browser. Collected: anonymous page views, clicks on the download and navigation buttons, scrolls to key sections, UTM parameters, and the arrival referer. No session recording is performed. Sessions are not linked across visits (session identifier kept in memory only). IP addresses are never stored (masking enabled server-side in PostHog).

If you join the release list, the email address you submit is sent to Resend and stored only for Paneflow release updates. No advertising profiling is carried out.

3. Desktop application telemetry (opt-in)

The Paneflow application installed on your machine transmits no data unless you have explicitly consented via the consent window displayed at first launch.

If you accept, the following events are transmitted:

  • -app_started · application start
  • -app_exited · application exit
  • -update_installed · update installation

Each event is associated with an anonymous machine identifier (random UUID v4, stored locally and resettable by the user), the operating system, and the Paneflow version. No file paths, project names, terminal content, shell commands, or personal information are transmitted.

The environment variable PANEFLOW_NO_TELEMETRY=1 disables all telemetry unconditionally, before even the consent window is displayed. The consent window can be reopened at any time from the application preferences to revise your choice.

4. Sub-processors

In accordance with Article 28 GDPR, Paneflow uses the following sub-processors:

PostHog Inc.
Location: EU Cloud · AWS Frankfurt (Germany)
Role: Product analytics (website and opt-in desktop telemetry)
Cookieless mode, IP addresses not stored, 12-month retention, DPA signed with SCC Module 2 (controller-processor).
Vercel Inc.
Location: United States (edge network in Europe)
Role: Static hosting of paneflow.dev and Web Vitals
Accepted at Vercel onboarding. No account or form data is sent; as the host, Vercel processes technical connection data (IP address in server logs).
GitHub Inc. (Microsoft Corporation)
Location: United States
Role: Hosting of source code and release artefacts downloaded from the website
Download logs are governed by GitHub's terms of service.
Resend Inc.
Location: United States
Role: Email delivery and storage of release-list contacts
Stores email addresses submitted voluntarily through the release-list form. Used only for Paneflow release notes and major product updates.

5. Retention period

  • -PostHog: 12 rolling months
  • -Vercel Analytics: 30 days (default)
  • -GitHub: duration determined by GitHub's policy for access logs of public artefacts
  • -Resend: until unsubscribe or deletion request

Beyond these periods, data is deleted or anonymously aggregated.

6. Rights of data subjects

In accordance with the GDPR (Articles 15 to 21), you have the following rights regarding data relating to you:

  • -Article 15 · Right of access: obtain confirmation that personal data concerning you is being processed, and receive a copy.
  • -Article 16 · Right to rectification: have inaccurate or incomplete data corrected.
  • -Article 17 · Right to erasure ("right to be forgotten"): have your data deleted when the legal conditions are met.
  • -Article 18 · Right to restriction of processing: have processing temporarily suspended.
  • -Article 19 · Notification obligation: be informed of rectifications, erasures, or restrictions communicated to recipients of the data.
  • -Article 20 · Right to data portability: receive your data in a structured, commonly used, machine-readable format and transmit it to another data controller.
  • -Article 21 · Right to object: object at any time to the processing of your data on grounds relating to your particular situation.

Any request to exercise these rights should be sent by email to arthur.jean@strivex.fr. A response will be provided within a maximum of one month. If the response is unsatisfactory, you may lodge a complaint with the CNIL or the supervisory authority of your country of residence.

7. Contact

For any questions regarding this policy or the processing of your data: