Legal

Privacy policy

Last updated: September 2026

This policy describes how Elerine processes personal data when you use the Pathly site, console and APIs.

Controller: Elerine, autónomo established in Spain, C/ Almazara n° 232, 30153 Corvera (Murcia), Spain — CIF Y7168667H — VAT ESY7168667H. Brand: Pathly. Contact: privacy@pathlyhq.com.

Data processed: account identity (email), organisation details, monitor and scenario configuration (Ping, Flow, Chain), technical logs, Flow failure screenshots, failure videos (Pro and Business plans), usage metrics and billing data for paid plans.

Purposes: providing Pathly, authentication, billing, support, security, fraud prevention and product improvement. We do not sell personal data.

Legal bases (GDPR): contract performance (art. 6.1.b), legitimate interest in security and reliability (art. 6.1.f), and legal obligations where applicable.

Social sign-in: if you choose “Continue with Google” or “Continue with Microsoft”, you are redirected to that identity provider to authenticate. We then receive a technical identifier, your e-mail address and your display name (scopes openid, email and profile only). Google LLC and Microsoft Corporation act as separate controllers for their sign-in screens. Any transfer outside the EU relies on their legal mechanisms (standard contractual clauses / Data Privacy Framework where applicable). You can also create an account with e-mail and password without using them.

Data residency: service data is hosted and processed in the European Union. Production infrastructure is Google Cloud, region europe-west1 (Belgium). Probes leave from a single measuring point (eu-west). There is no other operational region today. Public traffic goes through Cloudflare (DNS, CDN, WAF and Access).

Flow captures and failure videos: when a browser journey (Flow) fails, Pathly stores a screenshot of the failing step. On Pro and Business plans, a video of the failure may also be kept. These files can show the page at the moment of failure (cart, form, signed-in area). They stay in the European Union (same europe-west1 region), are only available to members of your workspace through the API, and are purged according to your plan’s retention. They are never sent to an AI model. A signed link in an alert e-mail remains valid for seven days. We recommend a dedicated test account rather than a real customer account. You remain responsible for personal data visible on the pages you ask us to watch.

AI-generated failure explanation: at your explicit request, and never automatically, Pathly may submit the facts of a failed run to a language model in order to suggest a hypothesis. Only those facts are sent: journey name and address, error message, failing step, response codes of failed calls and console errors. Screenshots, videos and page content never leave our infrastructure for this purpose, and values recognised as sensitive (credentials, tokens, e-mail addresses, phone numbers) are replaced before sending. Processing is carried out by Google Cloud Vertex AI (Gemini model) in region europe-west1 (Belgium): no data leaves the European Union for this purpose, and Google contractually undertakes not to use this content to train its models. The resulting hypothesis is stored with the run, reused for at most 14 days for an identical failure, then deleted with the run according to your plan's retention. It is labelled in the interface as AI-generated and may be wrong: it is neither a diagnosis nor an automated decision within the meaning of Article 22 GDPR. Legal basis: performance of the contract (Art. 6.1.b). If you would rather not use it, simply do not trigger it.

Retention: account data while the account is active; logs and runs according to your plan; billing data as required by accounting law.

Your rights: access, rectification, erasure, restriction, portability and objection. Contact: privacy@pathlyhq.com. You may lodge a complaint with the AEPD (Spain) or CNIL (France).

Audience measurement: the public site may load Google Analytics 4 (ID G-R29Z8DZS0F) to understand traffic. Google LLC (United States) is a processor; extra-EU transfers rely on standard contractual clauses. Nothing is loaded before you agree: until you accept, no tag is set and no data is sent. You can change your mind at any time through the “Cookies” link in the footer, or by writing to privacy@pathlyhq.com. Your choice is kept for 13 months at most. The /platform console is never measured. Separately, we count page views on our own servers, with no identifier, no cookie and no third-party transfer; that measurement honours your browser’s “Do Not Track” signal.

Walkthrough videos: videos are hosted on YouTube (Google Ireland Limited, with transfers to Google LLC in the United States covered by standard contractual clauses). No player is loaded before you agree: by default the page only shows an image served from our own domain plus a button, and nothing reaches Google until you use it. We use the youtube-nocookie.com domain, which sets no advertising cookie. You can accept this purpose once and for all, or decline it and load each video individually; that choice is separate from audience measurement and can be changed through the “Cookies” link in the footer.

Transfers: we prefer processors with appropriate safeguards. Any extra-EU transfers are covered by applicable legal mechanisms.

Business prospecting: when we contact a professional, we process their name, work email address, company and the public website concerned, collected from public sources whose origin we record. Legal basis: legitimate interest (art. 6.1.f), limited to messages related to the recipient's professional activity. Every message carries the publisher's identity and postal address and allows immediate refusal, including one-click unsubscribe from the mail client. Any opt-out request is recorded the same day at pathlyhq.com/unsubscribe as a non-reversible fingerprint kept for the sole purpose of never writing to you again. Prospect details are deleted after 3 years without a reply.