Legal

Privacy policy

Last updated 2026-10-15

Pathista keeps what it needs to run your workflows and nothing more: no advertising, no selling of data, and no analytics that runs unless you accept it. This policy says what we keep, why, for how long, who else sees it, and what you can do about it (articles 13 and 14 of the General Data Protection Regulation, “GDPR”).

1. Who is responsible

The controller of your personal data is CLEVER SPARK SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Zwycięska 3 / 127, 53-033 Wrocław, Poland (“Clever Spark”, “we”). Contact us about anything in this policy at support@pathista.com. We have not appointed a data protection officer; the law does not require one for a service like this.

2. What we keep, why, and on what basis

Data	What for	Legal basis
Your account: email address, a hash of your password (never the password itself), passkeys and two-factor settings if you add them, sign-in security counters.	To create your account, sign you in and keep it secure.	Performing our contract with you (GDPR art. 6(1)(b)).
Your content: workflows (names, steps, instructions, conditions and every saved version) and runs (title, position, variables, history, todos with their evidence, notes, and the reminder a detour leaves for the run it interrupted) — written by you or by the AI assistant you connect.	To provide the service: store your workflows and let your assistant drive runs through them.	Contract (art. 6(1)(b)).
Connected apps: the name and callback addresses an app registers, which apps you allowed to use your account, and the access tokens they hold.	To let the assistants you connect (ChatGPT, Claude and other MCP clients) act on your account, and to let you see and disconnect them.	Contract (art. 6(1)(b)).
Chat identifier: the anonymous conversation id some assistants (ChatGPT) send with each call.	To tie a run to the chat that drives it.	Contract (art. 6(1)(b)).
Usage steps: when you created your account and, if the link you came from carried them, its campaign labels (`utm_source`, `utm_medium`, `utm_campaign`) and the website address (host name only) that sent you; and the time of three steps: your first connection of an AI assistant, your first finished run and a finished run in your second week; and, if you look at the pricing page while signed in or buy Premium, the time you viewed the pricing page, opened the checkout, started a subscription and cancelled it. No cookie is used for this, and nothing is sent to a third party.	To see which channels bring people who actually use Pathista, in totals by week and source that only the operator sees. We do not use it to profile or decide anything about you.	Our legitimate interest in understanding whether the service works (art. 6(1)(f)). You can object at any time. These records are deleted with your account.
Your subscription (only if you buy Premium): the identifiers Paddle gives your customer record and your subscription, its status (active, past due, paused, cancelled), whether it is billed monthly or yearly, when the paid period ends, whether a cancellation is scheduled, whether a payment was refunded or reversed, and the times of the notices Paddle sent us about it. We never see or store your card or bank details, your billing address or your tax number: Paddle holds them.	To give your account the plan you paid for, to show it to you and to let you manage or cancel it.	Contract (art. 6(1)(b)). Paddle's own records are kept under our legal duties for tax and accounting (art. 6(1)(c)).
Visitor analytics (only if you accept): while you are signed out on Pathista's public pages (landing, pricing, templates, documentation, legal pages, sign-in and registration), how the page is used: clicks, scrolling and mouse movement, the pages you open, your device, browser and screen size, your approximate location from your IP address and a random identifier kept in cookies, which together let us replay the visit. What you type is never captured, and nothing is collected once you are signed in.	To see where visitors get stuck on the way in and to improve those pages. We do not use it to identify you.	Your consent (art. 6(1)(a) GDPR; art. 5(3) ePrivacy Directive), which you can withdraw any time with Cookie settings in the page footer. Microsoft keeps the replays for 30 days, and up to 9 months for a sample it chooses or ones we mark as favourites.
Open sessions (operator only): while a page that keeps a live connection is open (the workflow editor, the run page, the lists), the address of your account, the kind of page you are on (for example “run page”, never what is in it), when the session started and when you last clicked, pressed a key or typed. This is held in the server’s memory only: it is not written to the database or to the logs, and it is gone when you close the page or the app restarts.	So that the operator can release a new version when nobody is in the middle of work, and knows when someone is. Only the operator sees it, on an admin page.	Our legitimate interest in running the service without interrupting people at work (art. 6(1)(f)). You can object at any time.
Technical logs: the warnings and errors that our own code writes to its log, with the details listed in section 3 (for example a failed second-factor sign-in, with an internal user ID rather than your address). Informational log messages (for example about tool calls) are not kept. IP addresses are used in memory to limit abuse of sign-in, registration (of accounts and of apps) and the pages that send mail, and are not stored by Pathista; our hosting provider may record standard request data.	To keep the service secure and working, and to find and fix faults.	Our legitimate interest in a secure, reliable service (art. 6(1)(f)).

An email address and a password are needed to create an account; without them we cannot provide the service. Everything else you store is up to you. Please do not put special categories of personal data (health, beliefs and the like) or other people's personal data into workflows or runs unless you are entitled to.

We make no automated decisions about you and do no profiling. We send only the emails the account needs: one to confirm your address, one when you ask to reset your password and one when you change your address. We send no marketing or newsletters.

3. Who else sees it

Microsoft hosts Pathista on Azure, in the Poland Central region (European Economic Area), as our processor under its data processing terms.
Microsoft Azure Communication Services delivers those account emails (your address and the message) as our processor, with its data location set to Europe, under Microsoft's data processing terms. Azure also keeps a delivery record of each account email in its monitoring logs for 30 days (the recipient address, whether it was delivered, the delivery codes, the name of the receiving mail server and, if delivery failed, the error text), to find mail that did not arrive; our basis is our legitimate interest in a reliable service (art. 6(1)(f)).
Microsoft Application Insights (part of Azure Monitor) receives error and availability telemetry as our processor, stored in Poland Central (European Economic Area) under Microsoft's data processing terms. For each request it gets the path without the query string (nothing after the question mark), the status code and the duration, and for errors the exception type, its message and the stack trace (the message can occasionally contain a value the code was handling, so we keep errors free of personal data). Warnings and errors that our own code writes to its log go there too, for example a failed second-factor sign-in with an internal user ID (a random identifier, not your address) or a failed account mail with the subject of the mail. It gets no visitor IP address, no tokens in links (for example the ones in the email confirmation and password reset links) and no request bodies. We keep it for 30 days, only to detect outages and faults, never for advertising or profiling; our basis is our legitimate interest in a secure, reliable service (art. 6(1)(f)).
Paddle (Paddle.com Market Limited, with Paddle Payments Inc. and its affiliates) sells Premium as the merchant of record. When you buy, you give your payment details, billing address and, where needed, tax number to Paddle in its checkout, and Paddle is the controller of that data under its own privacy policy; it also decides, with us, only what the sale needs. We send Paddle your account's e-mail address and an internal account identifier, so that it can create your customer record and tell us which account the subscription belongs to; Paddle sends us the subscription notices listed in section 2. Paddle may send you receipts and invoices.
YouTube (Google), only if you press play on the setup video on the Start and Connect pages. The player loads from youtube-nocookie.com, Google's privacy-enhanced host, and only after you press play; until then nothing is loaded from Google. When you play it, Google receives your IP address and browser details and is the controller of that data under its own privacy policy. The link to watch the video on YouTube instead opens youtube.com.
Microsoft Clarity (Microsoft Corporation), only if you press Accept in the cookie banner on a public page while signed out. It receives the data described in section 2 and sets the cookies listed on the Cookies & storage page; Microsoft handles it under the Microsoft Clarity terms and its privacy statement. Until you accept, nothing is loaded from Clarity or Bing servers; after you reject or withdraw, nothing more is.
home.pl, in Poland, hosts our contact mailbox as our processor: it receives the messages you send to our contact address and keeps them in its mailbox, under its data processing agreement; we use them only to answer you.
The AI assistants you connect — for example OpenAI (ChatGPT) or Anthropic (Claude) — receive the workflow and run data their calls ask for. You choose to connect them and what to ask; they process that data as independent controllers under their own privacy policies, not on our behalf.
Authorities, only when the law obliges us to disclose data.

We do not sell or rent personal data, and share it only with the recipients listed above.

4. Transfers outside the EEA

Pathista stores your data in the EEA. Microsoft may process limited data outside it (for example for support) under the European Commission's standard contractual clauses and the EU–US Data Privacy Framework. When you connect an assistant whose provider is outside the EEA, data reaches it at your direction, under that provider's terms.

5. How long we keep it

Account: until you delete it (Account → Personal data → Delete). Deleting the account also deletes your workflows, runs and connected-app grants.
Subscription records: as long as your account exists, and deleted with it; if you have a paid subscription that is still billed, you cancel it before you can delete the account. Paddle keeps its own records, including invoices, for as long as tax and accounting law requires.
Workflows: until you delete them or your account. When your plan allows fewer workflows than you have, the others are frozen (kept, visible, not usable), never deleted for that reason.
Runs: deleted automatically after the last activity of the run and of any run it started: 30 days on the free plan, 12 months while you have full access (a paid plan). When full access ends, the shorter period counts from the last activity, so runs idle for longer are deleted at the next daily clean-up. You can delete runs earlier yourself.
Connected-app tokens: access tokens expire after 60 minutes, refresh tokens after 30 days; expired or revoked tokens and grants are removed 14 days later. Disconnecting an app revokes them at once.
Technical logs: Azure App Service keeps no log files of the app (we switched application logging off), so there is no log retention period of our own to state; the error and availability telemetry in Application Insights is kept 30 days (see section 3).

The database has automatic backups, which are kept for 14 days. Data you delete can remain in those backups for up to 14 days.

6. Your rights

You have the right to access your data, to have it corrected, erased or restricted, to receive it in a portable format, and to object to processing based on our legitimate interest. Much of this you can do yourself:

Download your data — account details (including your passkeys, how many recovery codes are left and your connected apps), your subscription records, workflows and runs, as JSON: Account → Personal data → Download.
Delete single runs from the runs list, workflows from the workflows list, or your whole account.
Disconnect an assistant: Account → Connected apps.

For anything else write to support@pathista.com; we answer within one month. You also have the right to lodge a complaint with a supervisory authority — in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl — or with the authority where you live or work.

7. Security

Connections are encrypted (HTTPS). Passwords are stored only as salted hashes. Each account's workflows and runs are isolated from every other account's, and assistants reach them only with a token you granted.

8. Cookies and browser storage

Pathista uses what it needs to sign you in, protect forms and remember display preferences and, only if you accept it in the cookie banner, Microsoft Clarity cookies on public pages while you are signed out. See Cookies & storage.

9. Children

Pathista is not directed at children. You must be at least 16 to create an account.

10. Changes

When this policy changes we update the date at the top; material changes are announced in the app before they apply.