Privacy Policy

1. Who We Are

The Service is operated by:

For privacy questions or requests concerning your personal data, contact us at privacy@readlpath.com.

For personal data that we collect and process in connection with ReadlPath user accounts and operation of the Service, Implementus acts as the data controller.

Where a customer chooses to include personal data in API documentation, OpenAPI specifications, examples or other customer-controlled content, Implementus may process that information on behalf of the customer. In such circumstances, the customer is generally the data controller and Implementus acts as a data processor.

2. Personal Data We Collect

2.1 Account information

When you create and use a ReadlPath account, we may process:

• first name;
• last name;
• email address;
• authentication credentials;
• account and workspace identifiers; and
• organization or workspace membership and role information.

We use this information to create, authenticate and administer your account and provide access to the Service.

2.2 Organization and invitation information

ReadlPath allows users to create or participate in organizations or workspaces and invite other users.

If another user or organization administrator invites you to ReadlPath, we may receive your email address from that person or organization for the purpose of sending and administering the invitation.

2.3 Technical and security information

When you use ReadlPath, our systems may process limited technical information necessary to operate, secure and troubleshoot the Service. Depending on the circumstances, this may include:

• IP address;
• request and connection information;
• timestamps;
• browser or device information;
• authentication and security events; and
• application and error logs.

We do not use this information for advertising or behavioral profiling.

2.4 Customer content

ReadlPath allows users to upload, create, maintain and manage API documentation, including OpenAPI specifications, documentation versions, examples and related technical content.

ReadlPath does not require personal data to be included in API documentation. API documentation should normally use technical descriptions, schemas and appropriately anonymized or fictional examples rather than personal information.

However, customers control the content they submit to ReadlPath. It is therefore technically possible for users to include personal data in API specifications, documentation, examples or other customer-controlled content.

Implementus does not routinely inspect customer content for the purpose of determining whether it contains personal data.

Where customer content contains personal data and Implementus processes that information solely to provide the Service to the customer, Implementus generally acts as a data processor on behalf of that customer.

Customers are responsible for ensuring that personal data they submit to ReadlPath is processed lawfully and is appropriate for inclusion in their API documentation.

3. Why We Process Personal Data

3.1 Providing the Service

We process account information, authentication information and related operational data where necessary to:

• create and maintain user accounts;
• authenticate users;
• provide ReadlPath functionality;
• manage organizations, workspaces, memberships and invitations; and
• provide and administer the Service requested by users.

The legal basis for this processing is generally Article 6(1)(b) GDPR — processing necessary for the performance of a contract or to take steps at your request before entering into a contract.

3.2 Operational and transactional communications

We use your email address to send communications necessary to provide and operate the Service. These may include account-related messages, workspace invitations, authentication or password-related messages, security notifications and important service information.

We currently do not use account email addresses for marketing or promotional communications.

Depending on the communication, processing is based on performance of our contract with you or our legitimate interest in operating and securing the Service.

3.3 Security, reliability and troubleshooting

We may process limited technical information to:

• detect and investigate errors;
• maintain availability and reliability;
• prevent unauthorized access and abuse;
• troubleshoot technical problems; and
• protect ReadlPath, its users and our infrastructure.

Where this processing is not necessary for performance of the Service itself, we rely on our legitimate interests under Article 6(1)(f) GDPR in operating a secure, reliable and functional service.

4. Service Providers and Data Recipients

We do not sell personal data and do not share personal data with third parties for advertising purposes.

We use a limited number of service providers that process information on our behalf where necessary to operate ReadlPath.

4.1 Amazon Web Services (AWS)

ReadlPath is hosted using Amazon Web Services ("AWS"). Our production application infrastructure, databases and primary data storage are configured in the AWS Europe (Frankfurt) region (eu-central-1).

We also use Amazon Simple Email Service (Amazon SES) for operational and transactional email delivery.

AWS acts as an infrastructure and service provider processing relevant data on our behalf.

4.2 Sentry

We use Sentry for technical error detection, diagnostics and application monitoring.

Sentry is configured for technical error monitoring rather than the collection of customer content. Data-scrubbing and depersonalization controls are enabled to reduce the possibility of personal data being included inadvertently in technical error reports.

Nevertheless, technical telemetry may in some circumstances contain information that qualifies as personal data. Such information is processed only for technical monitoring, troubleshooting, reliability and security purposes.

4.3 Legal disclosures

We may disclose personal data where required by applicable law or a binding legal request, or where reasonably necessary to establish, exercise or defend legal claims.

5. International Data Transfers

ReadlPath's primary application infrastructure, databases and customer data storage are configured in the AWS Europe (Frankfurt) region (eu-central-1).

Some service providers we use are international organizations. Consequently, limited processing of or access to personal data may in certain circumstances occur outside the European Economic Area ("EEA").

Where personal data is transferred outside the EEA, we use appropriate safeguards as required by applicable data protection law. Depending on the circumstances, these may include an applicable adequacy decision, Standard Contractual Clauses approved by the European Commission or another lawful transfer mechanism.

6. Analytics, Advertising and Marketing

ReadlPath currently does not use third-party analytics or advertising tracking services.

We do not use personal data for behavioral advertising and do not sell personal data to advertisers or data brokers.

We currently send only operational and transactional communications. We do not use account email addresses for newsletters or direct marketing.

7. Cookies and Similar Technologies

ReadlPath may use cookies, local storage or similar technologies where necessary to authenticate users, maintain sessions, provide security and operate essential Service functionality.

We do not currently use advertising or third-party analytics cookies.

8. Data Retention and Account Deletion

We retain account information and associated Service data while your account remains active and as necessary to provide ReadlPath.

ReadlPath provides self-service account deletion. When you delete your account, your account and associated data are deleted from our active systems.

Residual copies may temporarily remain in encrypted backups created for disaster recovery and system resilience. Such backup copies are not used for ordinary business purposes and are removed according to the applicable backup lifecycle.

In limited circumstances, we may retain information for longer where required by applicable law or where necessary to establish, exercise or defend legal claims.

9. Data Security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, accidental or unlawful loss, alteration, disclosure or destruction.

These measures include controlled access to production systems, authentication controls, EU-based primary cloud infrastructure, technical monitoring and other security measures appropriate to the nature of the Service and the data processed.

No internet-based service can guarantee absolute security. We maintain and review security measures appropriate to the risks associated with our processing.

10. Your Data Protection Rights

Subject to the conditions and limitations provided by applicable law, you may have the right to:

• request access to personal data we hold about you;
• request correction of inaccurate or incomplete personal data;
• request deletion of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain personal data in a structured, commonly used and machine-readable format;
• request transmission of eligible personal data to another controller where applicable; and
• lodge a complaint with a competent data protection supervisory authority.

Where processing is based on consent, you also have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

You can exercise applicable rights by contacting us at privacy@readlpath.com.

We may need to verify your identity before responding to certain requests.

11. Supervisory Authority

As Implementus, MB is established in Lithuania, our competent supervisory authority is the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija).

You have the right to lodge a complaint with the State Data Protection Inspectorate or, where applicable, another competent data protection supervisory authority in the European Union or European Economic Area.

12. Automated Decision-Making

We do not use your personal data to make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

13. Children's Privacy

ReadlPath is a professional API documentation management service and is not specifically designed or directed at children.

If we become aware that personal data relating to a child has been provided to us in circumstances where its processing is not lawful, we will take appropriate steps to delete or otherwise address that data.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to ReadlPath, our processing activities, our service providers or applicable legal requirements.

When we make changes, we will publish the updated Privacy Policy on readlpath.com and update the effective date shown at the top of this page. Where required by law, we will provide additional notice of material changes.

15. Contact Us

If you have questions about this Privacy Policy, our processing of personal data, or wish to exercise your data protection rights, please contact: