Privacy policy
This is a translation for convenience. The binding version of this document is the Spanish one: the Spanish version. In case of discrepancy, the Spanish text prevails.
Aseptic is a desktop application that orchestrates microservices on your machine. Most of the product works without sending anything anywhere. This policy explains the cases in which information does leave, exactly what leaves in each, and how to control it.
1. Data controller
- Controller: Juan García Valero, Spanish tax ID [NIF], address [DOMICILIO].
- Contact: info@aseptic.dev
2. First things first: what NEVER leaves your machine
Applies to all of the product, on every plan:
- The code of your microservices and the contents of your repositories.
- The output and logs of the services you orchestrate.
- The data in your databases, neither their contents nor their dumps.
- Your credentials, tokens and secrets. Before anything is sent, a scrubbing mechanism redacts your home folder path and the values of known credentials.
- The values of the arguments you call a tool with (their names do travel; see §4.2).
- Your conversations with the copilot. They go straight from your machine to the AI provider you choose, with your key: Aseptic neither brokers nor stores them. That provider's policy governs them, not this one.
3. A clarification about the word “anonymous”
Earlier versions of this policy described the installation identifier as anonymous. It is more accurate to call it pseudonymous: it is a random value that contains neither your name nor your email, but it does allow one installation to be told from another and its events to be grouped. Under the GDPR that is still personal data (recital 26) and it is treated as such here. This is corrected because a policy that calls anonymous something that is not protects nobody. The same applies to your account identifier when you sign in.
3 bis. And a substantive correction: diagnostics no longer default to on
Up to version 2.0 of this policy, diagnostics were on by default and relied on legitimate interest. From version 3.0 they are off, and first launch asks you.
The reason is not cosmetic. Legitimate interest under the GDPR covers processing data, but sending it from your machine also means reading and storing information on your terminal equipment, and that is governed by article 5(3) of the ePrivacy Directive, which requires consent unless it is strictly necessary to deliver the service you asked for. An installation identifier used to group error reports is not strictly necessary to orchestrate microservices on your machine.
So the legal basis for sections 4.1 and 4.2 becomes consent (art. 6(1)(a)), which you can give and withdraw in one click, and withdrawing it costs you no functionality. We spell this out rather than change it quietly, because a policy that corrects what it said before is worth more than one that pretends it was never wrong.
4. What processing takes place
4.1 Error diagnostics (Sentry)
| What | Exception message and trace, version, operating system, pseudonymous installation identifier, IP address during transmission |
|---|---|
| What for | Fixing defects |
| Legal basis | Consent (art. 6(1)(a)), asked for on first launch and withdrawn in one click |
| Default | Off. Nothing is sent until you turn it on |
| Processor | Functional Software, Inc. (Sentry) |
| Where | European Union region (Germany) |
| How long | 90 days |
| Turn on or off | Settings → Send diagnostics, or aseptic telemetry on|off |
Sentry's automatic collection of personal data is not enabled
(sendDefaultPii is off).
4.1 bis. The reports you write yourself
The section above is automatic capture: a failure happens and its trace is
sent. There is also a path where the content is yours, and that is why it is stated
separately even though the destination, the switch and the retention are the same: the
Settings → Privacy and diagnostics → Report a problem form, also used by
aseptic telemetry report and by the copilot when you ask it to report a bug.
| What | The text you write —subject and description, verbatim— and the pseudonymous installation id. Nothing else: your services' logs and your project's contents are not attached |
|---|---|
| Why | To understand and fix what you tell us |
| Legal basis | Consent (art. 6.1.a), the same switch as section 4.1. On top of that you have to write the report and press send: nothing goes out on its own |
| Processor, where and how long | The same as section 4.1: Sentry, European Union region, 90 days |
The report goes through the same scrubbing as everything else, but it is worth knowing what scrubbing can and cannot do: it recognises formats —a password inside a URL, a token with a known prefix, your home folder path—, it does not guess. If you paste a client's name or a business detail into the report, that travels as written, because you wrote it.
4.1 ter. When the copilot reads a file from your repo
This is not processing of ours —nothing reaches us— but it leaves your machine by your decision, so it is stated here rather than left in the small print.
The copilot and the MCP server can read files from the repo of a micro you have
already registered to understand how it is set up: its
angular.json, an application.yml, a package.json.
It saves it from guessing; the price is that the content becomes part of the
conversation with your AI provider.
| What | The text of the file that is read, or the list of paths requested. Only inside the micro's folder: a path with “..” or an absolute one is rejected, and node_modules, .git and build artefacts are not even walked |
|---|---|
| Who receives it | Your AI provider, the one you configured and with your key. Aseptic does not broker it, store it or see it |
| When | Only if you authorise it: the app asks every time, naming the file, and you can refuse |
| Legal basis | It is your own instruction about your own data; what happens next is governed by the policy of the provider you chose |
Scrubbing does not protect you here, and that matters. The
Scrubber recognises formats —a password inside a URL, a token with a known
prefix, your home folder path— but it cannot guess what is secret in an arbitrary file:
a .env with credentials, a client's name or your business logic go out as
written. Authorise what is needed and no more.
4.2 Usage records for the AI surface
Only if you use the MCP server or the copilot, and only with telemetry on: the same switch governs both.
| What | Operation name, whether it succeeded, error class, first line of the error (scrubbed), duration, response size, argument names, installation identifier, and account identifier if you are signed in |
|---|---|
| What for | Tuning which tools are offered to agents and which ones fail |
| Legal basis | Consent (art. 6(1)(a)), the same switch as above |
| Processor | Cloudflare, Inc. |
| Where | Database in Western Europe |
| How long | 90 days, with automatic daily deletion |
Argument values, results, paths, and scenario or microservice names never travel.
4.3 Account and free-allowance control
Only if you sign in. It is needed for the paid surfaces and for the daily free allowance; not to use the application or the CLI.
| What | Email, name and the identifier assigned by the identity provider; and your organisation if you belong to one |
|---|---|
| What for | Authenticating you, applying your plan and keeping the free-allowance counter per account (not per installation: otherwise reinstalling would hand out quota) |
| Legal basis | Performance of a contract (art. 6(1)(b)) |
| Processors | Kinde Inc. (identity) and Cloudflare, Inc. (counter) |
| How long | As long as the account exists; the counter, 90 days |
4.4 Team scenario catalogue (Team plan, hosted option)
Only if your organisation subscribes to the Team plan and chooses the hosted option. With the own-git-repository option, Aseptic stores nothing. Here Aseptic acts as processor and your organisation as controller: it is governed by the data processing agreement, which prevails over this policy for that data.
| What is stored encrypted | The complete scenario, end-to-end encrypted with a key belonging to your team that never leaves your machines |
|---|---|
| What is stored in the clear | Scenario name and description, organisation code, who published it, date and size |
| Where | Storage under European Union jurisdiction: Cloudflare guarantees that objects are stored and processed within the EU |
| How long | For the duration of the contract; deleted on request or at the end |
Aseptic cannot read the contents of your scenarios. This is not a promise of good behaviour: we do not have the key, and we could not hand them over readable under a legal request either. What we do see is your organisation's name and the scenario titles: encrypting those too would leave a useless list of opaque identifiers, and we would rather say so than have it discovered.
4.6 Payments and invoicing
Only if you subscribe to a paid plan. There is a wrinkle worth understanding: the seller is not us.
| Who handles your payment data | Paddle.com Market Ltd, as Merchant of Record |
|---|---|
| What | Name, billing address, email, country, tax details and payment method. Your card details never pass through Aseptic |
| Their role | Independent controller, not our processor: Paddle is the seller, issues your invoice and settles the taxes. Their processing is governed by their own policy |
| What we receive | Confirmation of the subscription and what is needed to activate it: subscription identifier, plan, seats, email and country. We never receive the payment method |
| Legal basis | Performance of the contract (art. 6(1)(b)) and legal obligation for tax record-keeping |
| How long | Billing records, 4 years under Spanish tax law; at Paddle, whatever their own policy sets |
5. Processors and international transfers
| Third party | Role | What for | Where |
|---|---|---|---|
| Functional Software, Inc. (Sentry) | Processor | Error diagnostics | EU (Germany) |
| Cloudflare, Inc. | Processor | Usage records, counter, hosted catalogue | EU (Western Europe; storage under EU jurisdiction) |
| Kinde Inc. | Processor | Identity | See their documentation |
| Paddle.com Market Ltd | Independent controller | Sale, payment and invoicing | United Kingdom, under an adequacy decision |
Sentry and Cloudflare are US companies. Although storage is in the EU, access by their staff may constitute an international transfer; both rely on Standard Contractual Clauses and on the EU-US Data Privacy Framework. Up-to-date list at sub-processors.
6. How to exercise your rights
You have the right of access, rectification, erasure, objection, restriction and portability.
Erasure, without writing to anybody. The service exposes an endpoint that deletes your data on the spot:
-
Signed in:
curl -X POST -H "authorization: Bearer <your id_token>" https://mcp.aseptic.dev/erase -
Without an account, by installation identifier (given by
aseptic telemetry info):curl -X POST "https://mcp.aseptic.dev/erase?install=<id>"
It is built this way on purpose: a right that requires opening a ticket and waiting a month is a right almost nobody exercises.
For the other rights, or if you prefer to write: info@aseptic.dev. You may also complain to the Spanish Data Protection Agency (www.aepd.es).
7. Minors
Aseptic is a professional development tool, is not aimed at people under 16, and we do not knowingly collect their data.
8. Security
Encryption in transit (TLS) for everything sent; end-to-end encryption in the hosted team catalogue; credential scrubbing before anything is sent; token-restricted access to the usage dashboard; and the principle that what does not leave your machine cannot leak from ours.
In the event of a security breach posing a risk to your rights, we will inform you and notify the supervisory authority within the GDPR deadlines (72 hours).
9. Changes
We will publish the version in force with its date. If a change materially affects how we process your data, we will say so in the application before applying it.