Privacy policy
Last updated:
This policy explains what personal data we process when you visit this website, when you ask for access to SwitchYard and when you use it: why, on what basis, for how long, who helps us, and how you can exercise your rights.
Who is responsible for your data
The controller of your personal data is Pedro José Arenas Férriz, with tax identification number 44757791K and address at C/ Lolita Miralles Esteve, 8, 3º D, 03600 Elda (Alicante), España. For anything about your data, write to privacy@switchyardhq.io.
When you visit this website
This website’s pages set no cookies, store nothing on your device, run no analytics and load nothing from other websites: their pages, styles, fonts and images all come from the site itself. The hosting platform (Azure Static Web Apps) has built-in sign-in and sign-out addresses under /.auth/ that cannot all be switched off. The site never links to them, and only visiting one directly may set a technical cookie of the platform, which we do not use.
To deliver each page, our hosting provider, Microsoft, receives your IP address and the technical details your browser sends with every request, such as its type and preferred language. They are processed only to deliver the pages and to protect the service, in our legitimate interest in running a website that works and is secure (Article 6(1)(f) GDPR). We do not use them to identify you or to analyse visits.
When you ask for access
What we collect. What you enter in the form: your name, your email address, your organization (optional), what you would use SwitchYard for, and which agents and systems you use (optional). We also record the language of the page you sent it from, so that we can answer you in it, when it arrived and what we decided. Nothing else: we do not store your IP address or your browser’s details with your request.
Why. To review your request and answer it: if we approve it, with an email inviting you to create your organization in SwitchYard; if we reject it, with an email saying so. A person reads every request we keep and decides it; no decision is automated. The notice we receive when a request arrives says only that one is waiting, not what it says.
On what basis. Your own request: these are steps you ask us to take before entering into an agreement (Article 6(1)(b) GDPR). Your name, your email address and what you would use SwitchYard for are needed to review it, and the form is not sent without them.
What we do not keep. We keep one request per email address: while a request from your address is stored, sending the form again stores nothing new. To protect the form against floods, a day’s requests beyond a set number are not stored either. Messages that are not a genuine request, such as spam, are deleted without a reply.
How long we keep it.
| Your request | When we delete it |
|---|---|
| Waiting for a decision | Not on a schedule: it stays until we decide it, or until you ask us to erase it. |
| Rejected | 90 days after we reject it. |
| Approved | 30 days after you create your organization, or 60 days after the approval if you never do. |
| Not a genuine request | When we review it, without a reply. |
When you use SwitchYard
If you have an account in SwitchYard, as the Owner or a Member of an organization, we process:
- Your account: your email address, your name and whether your address is verified, which our sign-in provider, Clerk, gives us each time you sign in, and the identifier Clerk assigns you.
- Your place in your organizations: your role in each one and the projects you can access.
- What you do in SwitchYard: the tasks you create, the workflow runs you start, your answers to the steps that ask a person, and the agent seats and machines that are yours, so that your organization can see who did what.
- The machines you connect: their names, which are often their host names, and, if a machine declares you as the owner of its sessions, your email address.
- The audit log: a record of every change made in SwitchYard (who made it, which operation, when and with what result), without the content of the request and without your IP address.
- The emails we send you: invitations, and the alert notifications your email preferences ask for, along with those preferences.
- Technical logs: what the service does, such as the requests it receives and how they ended, so that we can run it and keep it secure.
We process this to provide SwitchYard to you and your organization under the agreement that gives you access (Article 6(1)(b) GDPR), and we keep the audit log and the technical logs in our legitimate interest in keeping SwitchYard secure and being able to show who did what (Article 6(1)(f) GDPR).
Your organization’s content. What your organization puts into SwitchYard (its repositories, tasks, workflows, operations, credentials and everything its agents and commands produce) is your organization’s. We are the controller of its processing, on the same basis as above (Article 6(1)(b) GDPR, the agreement that gives your organization access). We process it only to run SwitchYard for your organization, and delete it when your organization is deleted. If you ask us to erase your data, that content stays with your organization, attributed to an identifier that no longer names you.
Your agents. The agents you connect, such as Claude Code, Codex, Cursor, GitHub Copilot or the Anthropic and OpenAI APIs, run on your own machines with your own accounts at those providers. What they receive is governed by your agreements with them, not by this policy.
GitHub. If your organization connects the SwitchYard GitHub App, we keep the name of the GitHub account it is installed on, which can be a person’s username.
How long we keep it.
| Data | When we delete it |
|---|---|
| Your account | When you ask us to erase it: we then delete your account at Clerk and replace your name and email address in SwitchYard with a placeholder. |
| The audit log | 365 days after each change. |
| The events and output of a run | 90 days after the run finished. |
| Alerts | 90 days after they are resolved. |
| Your organization’s content | When your organization is deleted. |
| Our emails, at Postmark | 45 days after they are sent. |
| Backups | Up to 35 days. If we ever restore one, we erase again everything that was erased since it was made. |
| Technical logs | Up to 90 days, which an erasure does not shorten. |
Who processes data for us
We do not sell your data or give it to anyone else, unless the law requires it. These providers process it for us, only on our instructions:
| Provider | What for | Where |
|---|---|---|
| Microsoft (Azure) | Hosting this website, SwitchYard, its database and its logs, and the key vault that holds organizations’ credentials. | European Union (Netherlands). This website’s pages are delivered from Microsoft’s network nearest to you. |
| Clerk, Inc. | Accounts and sign-in, and the invitations we send to approved requests. | United States. |
| Postmark (AC PM LLC) | Sending our emails: invitations, answers to rejected requests, the notices we receive when a request arrives, and alert notifications. | United States. |
Clerk and Postmark are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has decided that the United States ensures an adequate level of protection (Decision of 10 July 2023), so your data can be transferred to them without further safeguards.
Your rights
You can ask us for access to your personal data, to rectify it, to erase it, to restrict its processing, to object to it, and to receive it in a structured, machine-readable format (Articles 15 to 22 GDPR). Write to privacy@switchyardhq.io.
We answer within one month. For complex requests, or many at once, we may extend that by two more months, and we will tell you why within the first month. To make sure we answer the right person, we send our answer to the email address we hold for you and, before erasing anything, we ask you to confirm from that address.
You can correct your name and email address yourself, under Manage account in SwitchYard’s user menu; SwitchYard copies them the next time you sign in.
If you believe we have not handled your data properly, you can complain to a data protection authority, in particular in the country where you live or work. In Spain, it is the Agencia Española de Protección de Datos (www.aepd.es).
Changes to this policy
When we change this policy, we publish the new version here with its date. If a change is significant, we will also tell account holders by email before it applies.