Privacy notice
Last updated 12 October 2026.
Procket records the prompts engineers send to AI coding tools and links them to the code they produced. This notice explains what personal data we handle, why, and your rights. It is written for people who use Procket, people whose prompts a workspace records, and visitors to this website.
Who we are
Procket is run by [Company name] Ltd, company number [number], registered office [registered office]. We are registered with the Information Commissioner's Office, number [ICO registration number]. Emailprivacy@procket.dev about anything in this notice.
Two roles: your organisation's data, and ours
Prompts recorded for an organisation are the organisation's data. When a company's workspace records your prompts, the company is the controller: it decides why they are recorded and who can read them. We are its processor, acting only on its instructions under ourdata processing agreement. Ask your employer about that recording; their own privacy notice should explain it. We pass any request we receive about it to them.
We are the controller for the rest: your account, billing, security records and emails, set out below, and everything in a personal workspace you use for yourself rather than for a business.
What we collect and why
| Data | Why we use it | Lawful basis |
|---|---|---|
| Your GitHub identity. When you sign in with GitHub: your GitHub user ID and username, the GitHub organisations and installations you can reach, and which of their repositories you can read. | To sign you in, and to show you only what GitHub lets you read. | Contract |
| Your workspace membership. Which workspaces you belong to, your role in each, and whether you agreed to be recorded as a collaborator. | To run the workspace and apply its permissions. | Contract |
| Contact email. The email address a workspace owner gives us for the workspace. | To send notices about the workspace: seat limits, billing, deletion and security. | Contract and legitimate interests |
| Billing. The workspace's plan, seats and subscription status, and its Stripe customer ID. Card details go to Stripe and never reach us. | To charge for seats and keep tax records. | Contract and legal obligation |
| Security records. A log of who read prompt data, and of changes to workspaces, with the GitHub username of the person who did it. Your IP address is used to answer each request and to apply rate limits, held in memory for a few minutes; our logs do not record it. | To protect the service and investigate misuse. | Legitimate interests |
| Emails you send us. Your message and email address. | To reply. | Legitimate interests |
Where we rely on legitimate interests, they are keeping the service secure and answering the people who contact us. You can object to that use; see your rights below.
Personal workspaces
If you use a workspace for your own GitHub account, for yourself rather than for a business, we are the controller of what it records: your prompts after secrets are removed, token counts, and the commit details thesecurity page lists. We use them only to provide the service you asked for, on the basis of our contract with you. If collaborators agree to be recorded in your workspace, their prompts are visible to you as its owner.
What we never do
- We do not sell personal data.
- We do not use prompts to train AI models, and we do not send them to AI providers.
- This website sets no cookies, runs no analytics and loads nothing from third parties.
Cookies
The Procket web app at app.procket.dev uses only strictly necessary cookies, so we do not ask for consent: short-lived ones that keep a sign-in safe while you are sent to GitHub and back (they expire within 15 minutes), and one that keeps you signed in (12 hours). Neither tracks you, and nothing else is stored in your browser.
Who we share it with
- Amazon Web Services hosts the service and sends its email, in Ireland. AWS processes data only on our instructions.
- Stripe takes payments. It processes card and billing details as a controller in its own right, under its privacy policy.
- GitHub signs you in, and receives the pull request comments a workspace asks Procket to post. GitHub's own privacy statement covers what it does with your account.
- Anyone the law requires us to tell, such as a court or a regulator, and professional advisers bound by confidentiality.
Where it is stored
In Ireland, in the European Union. UK law treats the EU as giving adequate protection, so data about people in the UK needs no extra safeguards to be held there. Stripe and GitHub may process data in the United States, under their own safeguards, including the UK–US data bridge and the EU Standard Contractual Clauses.
How long we keep it
| Sign-in sessions | 12 hours in the browser. A laptop stays signed in until it goes 90 days without using Procket. |
|---|---|
| GitHub identity and membership | Until an admin erases your data, or the workspace is deleted. Removing you from a workspace ends your access but keeps the record of what you did there. |
| Security records | For as long as the workspace exists. |
| Billing records | 6 years after the end of the financial year they relate to, as UK tax law requires. |
| Service logs | 30 days. |
| Emails you send us | Up to 2 years after we last hear from you. |
| Personal workspaces | Prompt text for the retention period you choose (12 months unless you change it); the rest until you delete the workspace. |
Your rights
You can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Emailprivacy@procket.dev. We will answer within one month. For prompts an organisation records, we will pass your request to that organisation, which decides.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office atico.org.uk, or to the data protection authority where you live. We would like the chance to put things right first.
Changes
We will update this notice when what we do changes, and change the date at the top. If a change matters to how your data is used, we will tell workspace owners by email first.