1. Roles and instructions
The customer is the controller or APP entity responsible for customer content. Bluebird Technologies Pty Ltd, ABN 57 628 676 764, trading as PatchFlow, acts as processor or contracted service provider for personal information contained in service data and customer content. PatchFlow processes that information only to deliver, secure, support, meter, and delete the ordered service, or as legally required.
2. Processing details
3. Security and personnel
PatchFlow applies the controls described in the Security Statement, limits production access to personnel who need it, requires confidentiality, and does not weaken customer branch protection or named Check requirements. Customer acknowledges the published private-pilot limitations.
4. Subprocessors and overseas processing
Customer authorizes the subprocessors listed on the Data & Subprocessors page. PatchFlow will not materially add a new category of private-repository processor for an active pilot without notifying the named customer contact. AWS regional service data is primarily in Sydney, while GitHub, Cursor, npm, and CloudFront may process information overseas.
5. Assistance and incidents
Taking account of the service and information available, PatchFlow will reasonably assist with access, correction, deletion, security, breach assessment, and regulator enquiries relating to PatchFlow processing. PatchFlow will notify the customer without undue delay after confirming a personal-information breach affecting that customer and will provide known impact, containment, and remediation information. The customer remains responsible for determining its legal notification obligations.
6. Return and deletion
On verified request or pilot end, PatchFlow will provide an available structured export and delete active tenant records according to the published deletion runbook. Database backups expire within seven days, logs within 30 days, and retained webhook payloads within 90 days unless law requires longer retention. GitHub pull requests and repository history remain under customer control.
7. Evidence and audit
PatchFlow will provide the Trust Centre, relevant Migration Proof Reports, and reasonable answers to a pilot security questionnaire. On-site audits, certifications, penetration tests, and customer-specific control testing are not included in the standard A$750 pilot and require a separate written scope. PatchFlow will disclose a material known control failure relevant to the ordered service.
8. Contact and execution
Send processing questions to privacy@patchflow.run. These terms become binding only when incorporated into an order form signed by the legal entities identified there.