Last updated 11 October 2026.
Infranautic is made and run by Flook Tech Ltd, a company registered in England and Wales, company number 12500968, registered office Belmont Suite, Paragon Business Park, Chorley New Road, Horwich, Bolton, BL6 6HG. In this notice “we” means Flook Tech Ltd. We are the data controller for the personal data described here, except where this notice says we act as a processor.
If you have a question about this notice or about your data, email hello@infranautic.com.
This notice covers three groups of people.
When you load a page on infranautic.com, our server writes one line to its log for each request. That line holds the time, the page requested, the response code, how long it took, and your IP address. If you are signed in it also holds your GitHub login. We keep these logs for 30 days and use them to run the service, to find faults and to investigate abuse. Our lawful basis is our legitimate interest in keeping the service working and secure.
The website sets no cookie until you start to sign in. It does not use analytics or advertising services. docs.infranautic.com is a static site and keeps no access log.
Signing in uses your GitHub account. When you sign in, GitHub tells us your GitHub login, your display name, the address of your avatar image, and the names of the GitHub organisations you belong to. We use these to work out which Infranautic organisation to show you and what you are allowed to do in it.
We hold this information in a session cookie in your browser. The cookie is signed so it cannot be altered, is only sent over HTTPS, and is deleted when you close your browser. We also record your GitHub login and the time you last used Infranautic, so that we can keep your permissions up to date without slowing down your requests. We stop refreshing your permissions 30 days after you last used the product.
We do not receive or store your GitHub password, and we do not receive your email address from GitHub.
Our lawful basis is our legitimate interest in providing the service your organisation has asked us to provide, and in making sure only the right people can see and change its infrastructure.
Infranautic records who did what. When you approve or reject a plan, create a credential set, set a freeze, or write a toleration, we store your GitHub login against that action so that your organisation can see who took it. These records stay for as long as your organisation’s account is open.
Our lawful basis is our legitimate interest in providing the service and in keeping an accurate record of infrastructure changes for the organisation that owns them.
Your organisation’s GitHub App installation sends us events about repositories it has connected: pushes, pull requests, reviews, and changes to who has access. From those events we store the title, number and author login of each pull request, and the login of the account that installed the App. We also ask GitHub for your role on a repository and whether you own the organisation, so that Infranautic mirrors the access you already have on GitHub.
Each incoming event is kept in a queue until it has been processed, then discarded. The pull request record, and the plans and approvals made against it, stay for as long as your organisation’s account is open, so that the organisation can see what was proposed, reviewed and applied.
If you are in this group you may never have visited Infranautic. We are telling you about this processing here because we have no way to contact you directly. Our lawful basis is our legitimate interest in providing the service to your organisation.
When Infranautic runs a plan or apply for your organisation, the output of that run (the plan text, the apply output, the state file and the run’s logs) is stored so that your organisation can review it. This output is your organisation’s data. It contains personal data only if your infrastructure code or cloud resources contain it, and for that data we act as a processor on your organisation’s instructions under the agreement we have with it.
Run output is deleted 30 days after the run. The runner’s own logs are deleted after 7 days.
If you email hello@infranautic.com, we keep your message and our reply so that we can deal with your question and refer back to it. Email is provided by Zoho. We keep correspondence for two years after our last exchange with you. If it relates to a contract with your organisation, or to an invoice or a dispute, we keep it for six years after that relationship ends. Our lawful basis is our legitimate interest in answering you.
If your organisation pays for Infranautic, we hold the name and email address of its billing contact and pass them to Stripe, our payment provider, to issue invoices. We keep invoices for six years because UK tax law requires it. We do not see or store card numbers; Stripe holds those.
Our lawful basis for holding the billing contact is our legitimate interest in being paid, and for keeping invoices it is our legal obligation to keep accounting records.
Infranautic runs on Amazon Web Services in London. Your data is stored there and does not leave the United Kingdom, with three exceptions.
GitHub and Stripe process this data under their own data processing terms, which include the safeguards UK data protection law requires for transfers outside the United Kingdom. The United Kingdom recognises the European Union as giving personal data adequate protection, so email stored there needs no further safeguard.
We use no other third party to process personal data.
Your organisation’s database is copied continuously to backup storage in London. Backups let us restore the service after a failure. We keep 30 days of restore points. When your organisation’s account closes, we delete its database and its backups.
| Data | Kept for |
|---|---|
| Web server logs, including IP addresses | 30 days |
| Session cookie | Until you close your browser |
| Your login and last-used time | Until your organisation’s account closes |
| Records of actions you took in the product | Until your organisation’s account closes |
| Pull request title, number and author | Until your organisation’s account closes |
| Incoming GitHub events | Until processed |
| Plan and apply output | 30 days |
| Runner logs | 7 days |
| Backup restore points | 30 days |
| Email correspondence | 2 years after the last exchange; 6 years if it relates to a contract, invoice or dispute |
| Invoices | 6 years |
Under UK data protection law you can ask us to:
You can also object to processing we do on the basis of legitimate interests. To use any of these rights, email hello@infranautic.com. We will reply within one month.
Some data we cannot change or delete on your request alone. Records of who approved an infrastructure change belong to the organisation that made the change, and we will refer your request to it.
If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
We do not sell personal data. We do not use it for advertising. We do not send marketing email to people who use the product. We do sometimes email people at businesses we think Infranautic would suit, using contact details from public sources or from our own research. Every such email says how to opt out, and we stop when you ask. Our lawful basis is our legitimate interest in telling businesses about the product. We do not make automated decisions about you that have legal or similarly significant effects. The product’s automatic decisions are about infrastructure changes, not about people. Infranautic is not for children and we do not knowingly collect data about anyone under 18.
When we change this notice we update the date at the top. If a change matters to how we use your data we will tell signed-in users in the product.