Privacy policy
This policy explains how Parallel Labs, S.L. ("Logika", "we", "us") handles personal data when you visit logika.host, sign in to the console at app.logika.host, use the logika CLI and the API, or send us telemetry from your applications. It is written for the EU General Data Protection Regulation (GDPR) and Spain's Organic Law 3/2018 (LOPDGDD).
1. Who we are
The controller of your account data is the provider of Logika: Parallel Labs, S.L., a Spanish company, NIF B05585526 (VAT ESB05585526), with registered office at Calle Calabria 171, 5º-3ª, 08015 Barcelona, Spain, registered in the Registro Mercantil de Barcelona, hoja B-664202, inscripción 1ª. Contact: support@logika.host.
For anything in this policy, write to support@logika.host. Security issues go to security@logika.host.
2. Two roles
We handle two kinds of personal data, in two different roles.
- Account data is about you as a user of Logika: your sign-in, your projects, your billing, the emails we send you. We decide how it is used, so we are its controller, and this policy governs it.
- Customer data is what your applications send to Logika (spans and log records) and what we derive from it (analytics, anomalies and their evidence). If it contains personal data, for example your own users' identifiers, your organisation is the controller and we are its processor, acting only on your instructions under the data processing agreement. This policy describes how the service treats customer data so you can describe it to the people it concerns; questions from them should go to you.
3. What we collect as controller
| Data | What exactly | Where it comes from |
|---|---|---|
| Identity | your verified email address; your name if the sign-in provider gives one; which provider you used (GitHub or Google) and that provider's account id for you | the sign-in provider, when you sign in |
| Sessions | a session record per signed-in browser: when it was created and last used, when it expires, and the browser's user-agent string, so you can recognise and revoke it from your account page | your browser |
| Tokens | the CLI and API tokens you create: a label, the project, when each was last used. The secret itself is shown once and stored only as a hash | you |
| Activity | a record of every API call made with your token or session: the time, method, route, a digest of the parameters, and the result status. This is how the agent loop knows what a run did, and how we investigate abuse | your use of the service |
| Projects and membership | the projects you own or belong to, your role in each, the invitations you send (the invitee's email address and role), the environments you subscribe to for email, your soft spending limit for the agent | you and your collaborators |
| Monitors | when a logika monitor you run connects: that it is yours, its state and last heartbeat, and the runs it started | the CLI on your machine |
| Billing | per paid project: the Stripe customer and subscription identifiers, the tier, and whether the subscription is cancelling or on notice. Your card details, billing address and VAT number are collected and held by Stripe, not by us | you, through Stripe Checkout and Stripe's billing portal |
| Emails | each email we sent you: its kind, subject, project and environments, when it was sent, and what our email provider reported about its delivery (delivered, delayed, bounced, blocked, reported as spam); whether your address stopped receiving our email, and why (a bounce, a spam report, unsubscribing) | the service, and Scaleway Transactional Email's delivery reports |
| Help improve Logika | whether you allow us to read your projects' decision records (section 5), and when you last answered | you, at your first sign-in and in your account settings |
| Support | what you write to us | you |
We do not ask for, and do not want, special categories of personal data about you (health, beliefs and the like).
The marketing site (logika.host) sets no cookies, runs no analytics, and makes no requests to other sites: fonts are served from our own server.
Server logs. Our servers keep standard access and operational logs — IP address, time, request path, status, user agent — to run the service securely and investigate abuse (legal basis: legitimate interest). They are kept for up to 30 days and are not used for analytics or advertising.
The console (app.logika.host) sets one cookie, the session cookie, plus short-lived cookies during sign-in that protect it against forgery. They are strictly necessary for signing in, so they need no consent and there is no cookie banner. If you choose a light or dark theme in the console, the choice is kept in your browser's local storage and never sent to us.
4. Why we use account data, and on what basis
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Signing you in, running your projects, sending the emails you subscribed to, billing | performance of our contract with you (b) |
| Recording API calls, keeping server logs, keeping a record of the emails we send and whether they were delivered, no longer emailing an address that bounces or asked us to stop, preventing abuse of the free demo (one per verified email address), keeping the service secure | our legitimate interest in a working, secure service (f) |
| Invoices and accounting records | legal obligation under Spanish tax and commercial law (c) |
| Answering your messages | contract (b), or our legitimate interest (f) when you are not a customer |
| Counting decision records without reading them, to improve the product (section 5) | our legitimate interest in improving the service (f) |
| Reading the content of a project's decision records, to improve the product (section 5) | consent (a), from every owner of the project |
We send no marketing email. Every email we send carries a one-click unsubscribe link, and we never track whether you open an email or click its links. We do not sell personal data, and we do not use it for advertising or profiling.
5. Customer data: what the service does with it
What reaches Logika is decided by your code and your ledger. The service is built so that it can be told precisely:
- Personal data under
piiis encrypted in your application, with a key only you hold. Every parameter your ledger markspiiis encrypted by the Logika enhancer inside your process before it is sent (AES-SIV). With a key configured, so is everything your ledger does not describe: other attributes, the spans of libraries, and the message and attributes of log records, except a short fixed list of standard technical fields (HTTP route, method and status code, database system). We never receive those values in plaintext and cannot decrypt them; the CLI decrypts them on your machine with your key. Without a key, nothing is encrypted, and storing unmarked values in plaintext is your choice. - Only intentional events are judged. Spans your ledger declares are evaluated and summarised; everything else your application sends is stored so a journey tells the whole story, but is never evaluated or summarised. Metrics and profiles are refused.
- Everything else is stored as sent. Values that are not encrypted are readable by Logika's operators at rest, as with any logging service. Our servers use full-disk encryption, and access to them is restricted to named operators.
- Decision records, and helping improve Logika. Each project keeps a record of the decisions about its code made while using Logika: what was decided and why, the options and the recommendation when there was a choice to make, and any correction a member gave. We always count them without reading them: how many there are of each status, how often a recommendation is chosen, how often a decision is corrected, and how long a review takes. We read what they say only with consent. Your first sign-in asks whether you let Logika read the decision records of your projects to improve the product; the box is unticked, and nothing is read unless you tick it. A project's records are read only while every owner of the project has opted in, so one owner never decides for another. A record may quote your end users' personal data (an identifier or an email address in a decision's reasoning, say): before we read a project's records, that data is replaced by placeholders. Values seen in the project's data are replaced by their type, and a personal-data detector catches the rest; code snippets are kept. Your end users' personal data stays processed only on your behalf, under the data processing agreement, and we never read it for our own purposes. We use what we read only to improve Logika (for example, to give better default recommendations), never for advertising, and we do not share it outside Logika and its processors. You can withdraw consent at any time by unticking the box in your account settings, or by writing to support@logika.host; we stop reading your projects' records from then on. Withdrawing does not affect what was done before it.
- Logika calls no AI models. The coding agent that works on your anomalies is your own, running on your machine through
logika monitorwith your own provider's subscription. What it reads and sends to its provider is governed by your agreement with that provider, not by us.
6. Where data is stored
All of Logika's processing of customer data takes place in the European Union; the account data that leaves it is named in section 9.
- Servers: dedicated servers from Scaleway in Paris, France. These hold the database (accounts, projects, queues, anomalies and their evidence) and your projects' files (spans, log records, analytics).
- Backups: Backblaze B2, in its EU Central region in Amsterdam, the Netherlands: a copy of every project's files, and the database's continuous backup, which is encrypted with a key kept off the servers.
- Email: Scaleway Transactional Email, in France, sends our emails. Email you send to our @logika.host addresses is forwarded by Porkbun, our domain registrar, to mailboxes hosted by Google (Gmail / Google Workspace), both in the United States (section 9).
- Payments: Stripe. Its European entity is in Ireland; Stripe may transfer data to the United States under the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses.
The full list of companies that process data for us, with purpose and location, is on the subprocessors page.
7. How long we keep it
Customer data:
| Data | Kept |
|---|---|
| Spans and log records (raw data) | 30 days on paid tiers, 3 days on the free demo. When a project stores more than its quota the window is shorter, never below 2 days. Expired days are deleted from our servers in the nightly pass; backup copies age out within 14 days of deletion |
| Analytics summaries (counts, sums and duration histograms per event) | 5-minute summaries about 48 hours, hourly summaries about 90 days, daily summaries for as long as the project exists |
Identity tables, for parameters you mark identity (one row per value per active day, and when each value was first and last seen) | for as long as the project exists, so retention and funnel analytics can look back further than the raw data |
| Anomaly evidence | for as long as the anomaly exists, which is as long as the project exists. When the evaluator raises an anomaly it stores an evidence bundle with it: the failing span with its parameters, its journey (related spans), the exception, the ledger definitions involved, and the detail of the most recent few dozen occurrences. This evidence outlives the raw data it was taken from: it is the anomaly's record, so the 30-day or 3-day rotation does not delete it |
| Everything above, on deleting a project | see below |
Deleting a project, cancelling, or a missed payment. A project whose subscription is cancelled (including by deleting the project or your account) or whose payment is missed is "on notice": it keeps working normally for 30 days, and on day 30 everything it holds is deleted from our servers: its files and its database rows, evidence included; backup copies age out within 14 days of deletion. Renewing during the 30 days keeps it.
Account data:
| Data | Kept |
|---|---|
| Your account, identities, tokens and memberships | while your account exists. Deleting your account revokes every token at once and deletes the account 30 days later, unless you sign in and keep it |
| Sessions | until they expire or you revoke them |
| Server logs (IP address, time, request path, status, user agent) | up to 30 days |
| The email log (each email we sent and its delivery reports) | 90 days |
| That an address no longer receives our email, and why | until it receives email again: you re-subscribe, or, after a bounce, a project owner re-subscribes you |
| Invoices and billing records | as long as Spanish tax and commercial law requires, currently up to six years |
| Support messages | as long as needed to answer them and keep a record of the exchange |
8. Who receives it
- Our processors, listed on the subprocessors page, each bound by a data processing agreement. For account data they include Stripe (payments), Porkbun (forwarding email sent to our @logika.host addresses) and Google (Gmail / Google Workspace, the mailboxes that receive that email and send our replies).
- The sign-in provider you choose, GitHub or Google. You have your own relationship with them; they tell us your verified email address, and we tell them nothing beyond the sign-in request.
- Other members of your projects, who see your name or email address, your role, and what you did in the project (for example, whose agent fixed an anomaly); its owners also see the emails we sent you about it, whether they were delivered, and whether your address stopped receiving our email.
- Authorities, where the law obliges us.
- A buyer of the business, if it is ever sold, under the same commitments.
The logika CLI's install script downloads it from GitHub, which receives your IP address as with any download.
9. Transfers outside the EU
Customer data is stored and processed only in the EU. Account data reaches the United States in two cases: Stripe, under the EU–US Data Privacy Framework and Standard Contractual Clauses; and email you send to our @logika.host addresses, and our replies to it, which is forwarded through Porkbun, our domain registrar, and delivered to mailboxes hosted by Google, both in the United States — Porkbun under Standard Contractual Clauses, Google under the EU–US Data Privacy Framework.
10. Your rights
You can ask us to give you a copy of your account data, correct it, delete it, restrict or object to its use, or hand it over in a portable format. Write to support@logika.host; we answer within one month. Much of it you can do yourself: the account page lists your sessions and tokens to revoke, and deleting your account deletes it.
If you are one of our customers' users and your data is in their telemetry, ask that customer: they are the controller, and we help them answer you.
You can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es), or to the authority where you live or work.
11. Security
Traffic to every Logika host is encrypted with TLS. Servers use full-disk encryption; access is limited to named operators with individual keys. Tokens, SDK keys and sign-in codes are stored only as hashes. SDK keys can only send data, never read it. Each project's files are kept apart from every other's, and queries run in a sandbox scoped to one project. Report a vulnerability to security@logika.host.
12. Children
Logika is a tool for software developers and is not meant for anyone under 18.
13. Changes
When this policy changes materially we will email account holders before the change takes effect. The current version is always at logika.host/privacy.
This is a summary in plain words. The full text is the one that binds; where the two differ, the full text applies.
We hold two kinds of data. Your account: your email, your sign-in, your projects, your billing. We look after that ourselves. Your telemetry: what your applications send us. That is your data; we only store and check it for you, under the data processing agreement.
We keep only what running the service needs. Our servers keep ordinary access logs (IP address, time, page, browser) for up to 30 days, to keep things secure, and never use them for analytics or ads. The marketing site sets no cookies and tracks nothing; the console uses one cookie to keep you signed in. We send no marketing email, and we never sell your data.
Personal data you mark in your ledger is encrypted in your own application with a key only you hold, so we never see it. Your telemetry stays in the EU: on our servers in Paris, with backups in Amsterdam. A little account data leaves the EU: Stripe, which handles payments, may pass it to its US company, and email you send us passes through Porkbun and Google in the United States.
Raw telemetry is kept for 30 days on paid tiers (3 on the free demo), then deleted. When a project is deleted, its data is deleted from our servers on day 30 of its notice. Either way, backup copies age out within 14 days of deletion. Summaries and the evidence behind an anomaly are kept as long as the project exists.
We count the decisions your agent records in your projects, but we only read them if every owner of the project says yes, and before we do, anything about your end users is replaced by placeholders. You can change your mind any time in your account settings.
You can ask for a copy of your data, or ask us to fix or delete it: write to support@logika.host and we answer within a month. If you're unhappy with how we handled something, you can complain to the Spanish data protection authority (AEPD) or your local one.
Last updated 21 October 2026.