Data processing addendum
Effective date:
Machine inventory from MCP
Your agent finds the lockfiles and sends normalized package lists through MCP. The latest snapshot per organization and hostname replaces the previous snapshot. We store only package name, ecosystem, version, lockfile path, machine and timestamp; never file contents or source code.
OAuth inventory consent is off by default. You can enable it when connecting or in Agent access, and turn it off or revoke the app at any time. Turning it off stops future snapshot saving; it does not delete existing snapshots. Finding marks require separate permission.
Machine snapshots and inventory consent are customer data covered by account export, deletion and retention. Latest snapshots remain while their machine, stack or organization is active and are deleted with those objects. Shared team inventory is preserved when ownership is transferred; deleting a departed member does not erase the surviving team’s data.
What this addendum covers
This addendum applies when a business or other organization (the “Customer”) uses Patch Next team organizations, and covers the personal data the Customer’s team puts into them (“workspace data”). It forms part of the terms of service: using a team organization accepts it, with no signature needed. Patch Next is published by PixelVent, which is operated by The Huggable Corporation Incorporated, a Delaware C Corporation; see the legal notice.
Roles
For workspace data the Customer is the controller and PixelVent is its processor. For the account data PixelVent needs to run Patch Next itself, such as Google sign-in identities and the email addresses received from Google, security logs and billing,PixelVent is the controller as described in the privacy policy.
Details of the processing
- Subject matter
- Storing the Customer’s software inventories, matching them against public security advisories and tracking what the Customer’s team patches.
- Duration
- As long as the Customer’s organization exists in Patch Next, unless the Customer deletes data sooner (see Deletion and return).
- Nature and purpose
- Storage, matching, display and history of workspace data, and access for the coding agents the Customer’s members connect, all to provide Patch Next to the Customer.
- Personal data
- Members’ and viewers’ display names, email addresses and roles; invited email addresses; machine names, which may be hostnames that identify a person; repository links; triage statuses, notes, reasons and evidence links with who or which agent made each change; agent connection details.
- Data subjects
- The Customer’s members, viewers and invitees, and anyone the Customer names in the content it enters.
- Special categories
- None. Patch Next is not designed for special categories of personal data; do not enter them in names or notes.
Instructions
PixelVent processes workspace data only to provide Patch Next as the Customer sets it up in the product: the inventories their agents report, their settings and roles, and the agents they connect. These are the Customer’s documented instructions. If the law requires other processing, PixelVent informs the Customer first unless the law forbids it.
Confidentiality
People at PixelVent who can access workspace data are bound by confidentiality and access it only to run, secure or repair the service, or when the law requires it.
Security measures
- Database access rules on every private table, so each organization sees only its own data.
- Website sessions and agents are kept apart; agents see only the stacks a member grants and change nothing unless allowed.
- Agent keys and invite codes are stored only as SHA-256 hashes.
- HTTPS for every connection; Supabase states that it encrypts stored data.
- MCP snapshots store only package name, ecosystem, version, lockfile path, machine and timestamp; never file contents or source code.
- Database permissions are checked automatically on every change.
Sub-processors
The Customer authorizes PixelVent to use these sub-processors for workspace data. PixelVent remains responsible for their processing of it.
- Supabase: Database, sign-in and backend functions. Where: European Union: our project runs in AWS eu-west-1 (Ireland).
- Cloudflare: DNS for patchnext.com and the mcp.patchnext.com endpoint that forwards agent requests. Where: Global network.
- Lovable: Hosting of the patchnext.com website. Where: May process data outside the EU, including the United States.
- Google: Google sign-in. Where: May process data outside the EU, including the United States.
Stripe and Resend process account data for sponsor payments and opted-in email updates, not workspace data.
Sub-processor changes
Intended changes to the list are posted here, with their date, before they take effect. If the Customer objects to a change, it can remove its workspace data in the app as described below.
- : First published list: Supabase, Cloudflare, Lovable, Google, Stripe and Resend.
Data subject requests
The Customer answers its people’s requests with the controls in Patch Next: owners and admins can change roles, remove members and revoke invites, and members who can edit can edit or delete stacks and products. Each person can also see, correct and delete their own account data themselves, as the privacy policy explains.
Personal data breaches
PixelVent notifies the Customer without undue delay after becoming aware of a personal data breach affecting workspace data, with the information the Customer needs to meet its own obligations, and helps with its impact assessments and consultations with supervisory authorities using the information on this page.
International transfers
Workspace data is stored in the European Union. Where a sub-processor processes it outside the European Economic Area or the United Kingdom, the safeguards in that provider’s data processing terms apply: the European Commission’s Standard Contractual Clauses or, for providers certified under it, the EU-U.S. Data Privacy Framework and its UK extension.
Deletion and return
The Customer can download the Patch report as CSV and use Download my data in Account settings for a private JSON export, including machine snapshots and inventory consent. It can delete stacks and remove members whenever it chooses, and an owner can delete the whole organization under People; an organization is also deleted with its last member. Deleting a departed member preserves surviving shared team inventory. Sole owners of shared workspaces must transfer ownership before deleting their account. Provider log and backup retention periods remain NEEDS-FROM-OWNER; database deletion does not establish erasure of independent provider copies.
Information and audits
This addendum and the privacy policy, including its security section, are the information PixelVent makes available to show how it meets these obligations. Where the law gives the Customer a further right to audit, it is exercised by notice to the legal-notice address.
Precedence
If this addendum and the terms of service conflict about processing workspace data, this addendum prevails.