GDPR

Last changed: 2026-10-16.

This page is also in Polish. Both versions are equal; for a consumer in Poland, the Polish version prevails.

Graphlog Career holds your career, as one document, in a database of its own inside the European Union; your email address, stored only as a keyed hash, to recognise you next time, and as itself only for an account a free code made free; and which subscription pays for your account. You can export the lot whenever you like and delete it yourself from a page, without asking anybody and without giving a reason. This page says who is responsible for it, on what basis we hold it, who else can touch it, how long it is kept and what you can demand.

What is stored, field by field, is on the privacy page. The agreement itself is in the terms.

Who is responsible

We are the controller of everything described here, and nobody's processor.

foster.systems Przemysław Łuniewski, a sole proprietorship registered in Poland, at Chorzowska 214/50, 40-101 Katowice, Poland. REGON 386216258.

Write to support@graphlog.ai, answered within two working days. No data protection officer has been appointed, so that address is the whole of the route.

Graphlog Career is for your own career: the terms forbid storing another person's details.

Where your data is, and what leaves

Your career, and everything the service holds that is a fact about it, is in the European Union:

1. Your career record — one database of its own, inside a container of its own. The service runs on Cloudflare, and each person gets one Durable Object created in Cloudflare's eu jurisdiction: placed on hardware in the EU, and the same identifier asked for anywhere else resolves to a different, empty object. It is the platform's addressing, not a setting we could forget to apply.
2. The daily copy of it — a Cloudflare R2 bucket restricted to the same EU jurisdiction, in the same account, private, reachable only with the operator's own credentials.
3. The list of enrolled people — a second container in the same place, holding your person id, a label, a digest of an access code where there is one, when you enrolled, whether the account is free, and the keyed hash of your email address, the only form the address is stored in, apart from an account a free code made free: its row also holds when the free year ends and the address proved with the code, for that year's notices. A sign-in or a deletion in progress adds a row that holds the same keyed hash, a digest of the code you were sent and of a free code you entered, and it expires within minutes. The operator's free codes are kept there as digests, with the person id that spent each one.

One store sits outside that addressing, and it is better said than implied: the records for the tokens issued to your client are in the platform's key-value store, which takes no jurisdiction, so where Cloudflare keeps them is not something we can promise. A record holds a digest, an expiry, and, encrypted with the grant, the person id and the client id it belongs to. Never the token itself, and nothing about your career.

Away from these there is no second database, no analytics pipeline and no export anywhere else. That includes the log of what the service did for you, which lives inside your own container.

Your email address leaves the service to Resend, in their EU region, and to Link. To Resend when you ask for a sign-in code, start a deletion, a subscription or a withdrawal, or link an address to an account that was given an access code. It carries one message: two short sentences, the six digits and that they work for ten minutes. No name, no link, nothing about your career. To Link when you continue to payment, when connecting or on the subscribe page: the checkout opens with the address you proved there, which the pages keep in their forms, in your browser, until then. Otherwise the address exists in the server's memory for the request that carries it and nowhere else, apart from an account a free code made free, whose row keeps it. A notice these pages name is also sent through Resend, from a graphlog.ai address, to the email address your subscription was bought with, read from Stripe for that message, or for a free code's year to the address kept for it; the checkout opens with the address you proved.

Paying happens at Link, not here. What you type at the checkout — your payment method, your email address, your billing address — goes to Link (Sold through Link, LLC, a Stripe company, in the United States), the merchant of record, and never passes through the service. The service tells Stripe which account a checkout is for and the address you proved for it, and keeps on your account which Stripe subscription pays for it, its status and until when, and, once payment stops, since when and which notices about it have gone out.

Two things about the providers are worth saying plainly. Cloudflare, Inc. is established in the United States and runs the EU jurisdiction your data sits in; support or operational staff at any provider can reach what that provider holds, under its own terms and the transfer safeguard "Who else touches it" names for it. And your IP address is read: every form that can make us send you a code — signing in, deleting, subscribing, withdrawing, linking an address — carries a Cloudflare Turnstile check, which receives it, and the rate limiter uses it as a counting key. We store it nowhere, and no log of ours has a field it could go in.

On what basis we hold it

• Storing your career and handing it back to your client — Article 6(1)(b), performance of the contract you entered by signing up. It is the service.
• Sending your sign-in code, and keeping the keyed hash that recognises you next time — Article 6(1)(b) as well: without it there is no way in.
• Writing to the email address your subscription was bought with, for the notices these pages name and nothing else — Article 6(1)(b), as part of the contract; a breach notice, Article 6(1)(c), as Article 34 requires it.
• Keeping the address you proved with a free code, to write to it before the free year ends and, if it ends without a subscription, the notices of a lapse — Article 6(1)(b): the free code's year and how it ends are part of the contract.
• Handing the address you proved to Link when you open the checkout — Article 6(1)(b): it is the address the subscription is bought with and the notices go to.
• Keeping which subscription pays for your account — Article 6(1)(b): it is how the service knows the account is paid for. Keeping the record of the sale — Article 6(1)(c), the tax law that requires it. What you give Link at the checkout Link holds as a controller in its own right, on its own basis.
• The activity log, the rate limits and the Turnstile check — Article 6(1)(f), our legitimate interest in keeping the service working and in not being used to send mail to strangers. The log holds no content of your career and no address of any kind, and a caller refused by a limit is not recorded at all, which is what keeps that interest a light one.

We ask for no consent because we rely on none. There is no advertising, no profiling and no automated decision with legal effect. We never use what you store to train a model, and the service never calls one. Your assistant sends what it reads to its own provider, under that provider's terms and your settings there.

Special categories

The document has no field for health, beliefs, trade union membership or anything else Article 9 covers. A career break is typed study, travel, layoff, relocation, sabbatical or other, and there is no health type among them.

Free text is still free text. The guidance your assistant reads says that a break taken for your own health, or to care for somebody, is typed other and described in your own words — so a description can carry an Article 9 fact if you put one there, and you decide whether to. The server reads your text only for its shape: whether a result line contains a number, whether an entry has a date. It hands those notes back to your assistant, interprets nothing, and sends nothing to a model.

What you can ask for

• Access and portability — self-service. Ask your assistant for everything as a file and it hands you your whole career as one machine-readable document, at any time, with nobody in the loop; the same file restores into another account. That is Article 20 answered without a queue. The file is the current document only: the seven kept versions are not in it, but your assistant can list them and put any one of them back, so they are yours to reach as well. The daily copies are not — write to support@graphlog.ai for one of those, or for what your row in the enrolled list holds.
• Rectification — you correct your career yourself, through your assistant. Every write is a new version and the seven newest are kept.
• Erasure — the next section. No reason needed, and nobody to ask.
• Restriction and objection — write to support@graphlog.ai. In practice the only processing there is to object to is the activity log, and the way to stop it is to stop using the service or to delete the account.
• A human, not a machine — no decision about you is made automatically here.
• Complaint — you can complain to the supervisory authority of the country where you live or work. We are established in Poland only, so our lead supervisory authority is Poland's: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), at uodo.gov.pl.

Deleting everything, yourself

The way out is a page: https://career.graphlog.ai/account/delete. Type the email address you sign in with, type back the six-digit code that arrives, read the page listing what is about to go, and press one button. There is no form, no queue and no step designed to talk you out of it. A wrong or expired code deletes nothing, and typing an address that has no account here walks the same pages to the same last page, so nobody can use it to find out whether somebody else is enrolled.

Everything the service holds about you goes at once and without waiting: your document and every kept version, the activity log inside your container, your row in the enrolled list together with the keyed hash of your address, every token ever issued to any client of yours — so every app you connected stops working straight away — every daily copy in the bucket, and the record of which subscription paid for the account; the subscription itself is cancelled. There is no soft delete, no grace period and no recycle bin, and signing in with the same address afterwards makes a new, empty account rather than finding the old one. The privacy page lists it item by item, and says what the last page tells you when a step does not finish.

The enrolled list's own log records that a deletion happened, and it names nobody.

Mail is the fallback, and the only route for an account that was enrolled by hand with an access code and has never linked an address, because there is no address for the page to send a code to: write to support@graphlog.ai. It runs the same deletion. An access-code account that did link an address deletes itself from the page like any other.

Of what the service holds, one thing outlives it, and this is the whole of it. Cloudflare keeps up to thirty days of point-in-time history of the storage inside your container. Deleting empties that storage, and that history is the one way a deletion made by mistake can be undone; after thirty days there is nothing to restore. We say this rather than rounding it off, because it is the honest answer to "is it really gone". The privacy page says what it holds, who reads it, and what to write to support@graphlog.ai with if you need a deletion reversed.

Your address and your account

This is structural, and it cuts both ways. Nothing in the service turns an email address into the account it belongs to: what is stored is a keyed hash, under a key held outside both the list and your container, and there is nothing to look up.

A free code is one exception. An account a free code made free keeps the address proved with the code on its row, until it subscribes or is deleted, so it can be matched to that address.

Paying is the other. The Stripe account behind Graphlog Career shows whoever runs the service each subscription with the email address it was bought with, and each subscription is linked to an account. So a paying account can be matched to the address it paid with, through Stripe, and that match can settle a rights request about it.

• The delete page settles whose account it is by sending a code to the address and taking it back, not by searching for you.
• A request sent by mail — access, restriction, objection — has to be matched to an account by hand before anything can be done, and the reply will ask what ties you to it. Signing in from the address you are writing about is the usual answer.
• If you lose the address you sign in with, you lose the account. There is nothing to look up and nowhere to send a recovery. Where we cannot identify you, we cannot act on a rights request either.

How long things are kept

1. Your career record — while your account exists, and for 12 months after payment stops or a free code's year ends without a subscription, then deleted with the account. Seven versions are kept; the eighth write deletes the oldest.
2. The activity log — thirty days, then deleted, capped at one megabyte with the oldest entries dropping off at the cap.
3. The daily copies — 7 days each, then deleted by a rule on the bucket; all of them go in the deletion run.
4. Your row in the enrolled list, and the free code your account spent — while your account exists; the address kept for a free code's year, until the account subscribes or is deleted. A sign-in or deletion in progress expires within minutes; the code itself dies ten minutes after it is sent and works once.
5. The enrolled list's own log — thirty days, on the same one-megabyte cap. It survives a deletion, which it records as having happened, and whether every part of it finished. It names nobody, so there is nothing of yours in it.
6. The facts about your connected apps (the tool list version each was last given) — while your account exists; they go in the deletion.
7. Token records — access tokens an hour, refresh tokens ninety days, and a deletion revokes them all at once.
8. The platform's point-in-time history — thirty days, as above.
9. The messages at Resend, sign-in codes and notices — their log retention is set to the shortest option their account offers.
10. Mail you send to support@graphlog.ai — kept at Resend for thirty days, then deleted. It is never put into the service.
11. Which subscription pays for your account — while your account exists. The sale itself, with the email address it was bought with, stays in the Stripe account behind Graphlog Career, and with Link under its privacy policy, for as long as the tax law they keep records for requires.

Who else touches it

Three, and this is the list:

1. Cloudflare, Inc. — runs the service, your database, the daily-copy bucket, the token store, the rate limiting and the Turnstile check on every form that can make us send you a code. Cloudflare also operates the network your request crosses before it reaches us, and what they keep for their own operation is theirs, under their terms and their retention. Cloudflare is certified under the EU–US Data Privacy Framework, and its data processing addendum, part of its terms, adds the Standard Contractual Clauses.
2. Resend — delivers your sign-in code and our notices, sent from their EU region, and receives your email address for each message. It also receives what you write to support@graphlog.ai: every request made by mail goes through it, so your address and whatever you write reach Resend. Nothing from your stored career is sent there. Resend is in the United States; it is certified under the EU–US Data Privacy Framework, and its data processing addendum, part of its terms, adds the Standard Contractual Clauses.
3. Link and Stripe (Sold through Link, LLC, a Stripe company, in the United States) — Link sells you the subscription as merchant of record, takes the payment, charges the tax and sends the receipts; the service tells Stripe which account a checkout is for and the address you proved for it, hears back from it when a subscription starts, renews or ends, and reads from it the address a notice goes to. It is a controller in its own right for what you give it at the checkout, under its own privacy policy at https://stripe.com/privacy, not our processor. What the service tells Stripe reaches Stripe, LLC, certified under the EU–US Data Privacy Framework, under Stripe's data processing agreement with its Standard Contractual Clauses. It learns which account a checkout is for and the address you proved for it, and nothing of your career.

Away from those three there is no other: no analytics provider, no error tracker, no CRM, no model provider. If one is ever added, we write to the email address your subscription was bought with, and this page says so, dated, before the new provider is used.

One more access is worth stating rather than implying: the operator's own credentials can read a daily copy out of that bucket — a daily copy is your career in plain text — and can put a document back into your container or roll it back to an earlier moment. That is what makes a recovery possible, and the privacy page describes each of them. Other than that, your document is read by your own client and by nothing else.

What keeps you apart from everybody else

One database per person is the whole of it: there is no shared table of careers with a column saying which row belongs to whom, and a question asked on behalf of somebody else runs inside their container and cannot reach yours. There is no password to steal. Access codes are stored as digests, email addresses as keyed hashes under a key held elsewhere, and tokens as digests with expiries. Somebody holding a copy of all of it has your career record, your label and your activity log, and no usable credential of yours.

The log itself records what your client program says about itself — its name and version, the protocol date it speaks, and whether it declared that it can draw a page in place, which changes nothing about what it is served — and that is a fact about the program, not about you.

If something goes wrong

A personal data breach is reported to the supervisory authority within 72 hours of us becoming aware of it, as Article 33 requires. Where the risk to you is high, Article 34 says you have to be told: we write to the email address your subscription was bought with, and post the notice, dated, on this site and on the page you sign in on, where it stays. If you have written to support@graphlog.ai about it, you get a reply as well.

Report a security problem to support@graphlog.ai, as https://graphlog.ai/.well-known/security.txt says.