Data export and account deletion¶

You can download a copy of your account data and request account deletion from the dashboard.

Downloading your data¶

1. Open Profile in the dashboard.
2. Open the Account tab.
3. In the Data & Privacy section, click Download my data.

Your browser downloads a JSON file with your profile, every workspace membership (and sites per membership), owned workspaces. Passwords and API keys are not included. Billing address and VAT are not exported from Patcherly by default (billing_identity: managed_by_stripe); manage those in Stripe Checkout or the Customer Portal.

Requesting account deletion¶

Workspace owners and invited team members use the same Profile control, but the effect differs:

1. Open Profile → Account.
2. If you own multiple workspaces, delete extras under Your workspaces first.
3. In Delete Account, follow the prompts to request deletion.

When you request deletion, your account is marked as pending deletion and scheduled for removal (maximum 7 business days). You can still sign in until processing starts, but processing can begin at any moment. Owners with a paid subscription on an owned workspace: renewal is set to cancel at the period end. Invited team members do not change billing on workspaces they joined. You’ll receive a confirmation email with this timeline and a support contact in case the request was a mistake. Once deletion processing starts, recovery cannot be guaranteed and data can be permanently lost. What is deleted, retained, or exported is described in our legal policies: https://patcherly.com/legal/privacy-policy

Error and analysis data¶

How operational error and analysis data is handled - including retention and what appears in exports - is covered in our legal policies: https://patcherly.com/legal/privacy-policy

For a plain-language summary of what is kept indefinitely (your aggregated metrics and AI usage history) versus what is pruned by your plan's audit-retention window (raw error and analysis history, with a 30-day grace after downgrades), see Data retention on your workspace.

Audit logs in the product: The dashboard Audit page lists events with an Actor column showing a resolved name or email when available (or labels such as System / Connector / Patcherly Support), not a bare numeric user id. Email addresses stay stored with your account as part of Patcherly's normal records and are only shown in the Actor column when no display name is set. App-level rows show object type and object ID for the audited resource; operational rows may include extra context in metadata and (when recorded) IP address / user agent in the event detail view. See Audit Logs for the filters, columns, and CSV export.

What gets deleted, and when¶

Account deletion in Patcherly happens in two phases - at the moment you click Delete, and again at finalisation (within seven business days, or at the end of your paid period if you have a paid subscription). Each phase touches different things:

At the moment you request deletion¶

• Your account is flagged deletion pending. You can still sign in - and cancel - until processing starts.
• Connector OAuth tokens are revoked within seconds so your connectors stop pulling fixes immediately. See What happens to your connectors when you delete your account below.
• If you have a paid subscription, Stripe is told to cancel renewal at the end of the current billing period. You keep the paid features until then.
• If you don't have a paid subscription, your workspace is moved to the Personal (free) plan immediately.
• A confirmation email goes out with the deletion timeline and a support contact in case it was a mistake.

Your name, email, billing details, errors, analyses, audit history, and AI usage are all still present at this point - they are removed in the next phase.

At finalisation (within ≤7 business days, or paid-period end)¶

• Your account is hard-deleted from Patcherly's primary stores (Postgres account/workspace/sites/OAuth tokens; Mongo in-app notification inbox for deleted users).
• Your name, email, phone, IP, user-agent, and other personally identifying fields (including any residual address/VAT keys on operational records) are unset from every operational record (errors, analyses, audit history, patch outcomes), which are stored on a separate operational store/database. The records themselves stay - keyed by pseudonymous numeric IDs only - so Patcherly overall metrics history remain accurate over time. Invoicing identity on Stripe is separate and follows Stripe’s retention.

Deferred physical deletion¶

• After ~180 days from finalisation - those operational records (errors, analyses, audit history, patch outcomes) are physically deleted by a daily background task.
• After ~730 days (~2 years) from finalisation - AI usage records (token counts and cost per provider/model) are physically deleted. This longer window is described in our privacy policy.

This is what our privacy policy calls the operational data store: between finalisation and the deferred physical purge, the records still exist but are flagged as belonging to a deleted account and keyed by pseudonymous numeric IDs only - never by your name or email.

Long-term aggregates keep only pseudonymous numeric identifiers, timestamps, and categorical connector metadata (e.g. "WordPress", "Python"). Your name and email are never retained in that store.

Exact windows are set out in our legal policies.

Dormant free workspace policy¶

• Personal-plan workspaces can be marked dormant when both conditions are true for 12 continuous months:
• no member login activity, and
• all sites are inactive, not connected, or have no connector activity.
• Before deletion eligibility, Patcherly sends a 30-day notice email to the workspace account.
• You can control this email/in-app notice in Profile → Notifications using the Dormant Workspace Notice event preference (signed in as the workspace owner).
• If any team member logs in during that notice period, the workspace is kept and the notice is cleared.
• If no member logs in during that notice period, the workspace and related data may be deleted.
• Paid-plan workspaces are not affected while the paid subscription remains active.

What happens to your connectors when you delete your account¶

When you request account deletion, Patcherly immediately revokes every connector OAuth token issued under your account - even though the grace period for the database records is longer. This means:

• Connectors on your servers stop receiving fixes within seconds.
• Refresh-token attempts from those connectors return invalid_grant.
• If you cancel the deletion request before the grace window ends, you can re-pair each connector by running patcherly login (CLI) or re-installing the WordPress plugin.

The same immediate revocation applies when you delete a site or app or your workspace from the dashboard, or when Patcherly support performs the deletion on your behalf. Connector backup folders on your own server are not touched - those follow your own retention policy (see Where are my backups stored?).