Privacy policy
Version 2026-10-24. PALLASITE OÜ, registry code 17348411, Ahtri tn 12, 15551 Tallinn, Estonia ("Palbase", "we") is the controller of the personal data described here: of the people who use Studio, its API and tools, and who pay for an organization. Write to us about it at info@pallasite.net.
The data your projects keep about their own users is theirs: for it, the project's organization is the controller and we process it on its behalf, as the terms of service say. If you are a user of an app built on Palbase, ask that app.
1. What we collect
- Your account: your name, email address and picture, from you or the provider you sign in with (GitHub or Google), and the organizations and projects you belong to and your role in each.
- Billing: the organization's billing name and address, VAT number if it gives one, each environment's top-ups, credit, credit moved between its environments and invoices, what its bank transfers left, and who accepted the terms and when. Your card is entered on Stripe's page; we keep only its brand and last four digits.
- Use of the service: requests to Studio and the API with their IP address, browser, time and result; the actions taken in Studio, for each organization's audit log; and each project's metered usage.
- What you send us: emails and requests for access or support.
Studio sets only the cookies it needs to keep you signed in (__Host-palbase.access and __Host-palbase.refresh). It uses no advertising or third-party tracking cookies.
2. Why, and on what basis
- To provide the service, your account and your organization's billing — the contract with you (GDPR article 6(1)(b)).
- To keep invoices and payment records and calculate tax — our legal obligations (article 6(1)(c)).
- To secure the service, prevent fraud and misuse, and fix and improve it — our legitimate interests (article 6(1)(f)), which you may object to.
- To email you about your account, your environments' credit, security and changes to these terms — the contract and our legitimate interests. We send no marketing without your consent.
3. Who it is shared with
We do not sell personal data. We share it with the service providers who run parts of Palbase for us, under contracts that bind them to our instructions, with authorities where the law requires, and with a buyer if Palbase is sold, under this policy. Our sub-processors:
| Provider | What for | Where |
|---|---|---|
| Microsoft Ireland Operations Ltd. (Azure) | Hosting, databases, storage, logs and email delivery (Azure Communication Services) | EU (West Europe) |
| Stripe Payments Europe Ltd. | Taking payments, tax calculation and invoices | EU; transfers under Stripe's safeguards |
| Cloudflare, Inc. | DNS and email routing for our addresses | Global; EU–US Data Privacy Framework |
| GitHub, Inc. and Google LLC | Signing in, only if you choose them | US; EU–US Data Privacy Framework |
| OpenAI, Anthropic, Google, xAI | Palbase AI's models, only for a project that uses them on Palbase's keys: what the project sends them | US; standard contractual clauses or Data Privacy Framework |
Where data leaves the European Economic Area, it is protected by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
4. How long it is kept
- Your account, while you have it; it is deleted when you delete it, save what follows.
- Invoices, payment and ledger records, for 7 years, as Estonian accounting law requires.
- Request logs, for 30 days; database backups, for 14 days.
- An organization's audit log and its projects' data, until the organization or project is deleted.
5. Your rights
You may ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to its use, and to have it in a portable form. Write to info@pallasite.net; we answer within a month. You may also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the authority of the country you live in.
6. Security and changes
Data is encrypted in transit and at rest, and access to it is limited to those who need it to run the service. Palbase is not meant for children under 16. We will tell you by email of a change to this policy that matters before it takes effect.