Pabbly

GDPR overview

Partial and unevenly documented. The GDPR is invoked once, incidentally, about anonymous analytics tracking. What does exist is substantial: a dedicated section listing six data subject rights (access, rectification, erasure, restriction, objection, portability), a named Data Protection Officer with a direct phone number, breach notification promised to authorities and affected individuals within 72 hours, a public subprocessor list naming fourteen providers, and third-party audited SOC2 Type 2 and ISO 27001:2022 certifications. What is missing matters as much: no Data Processing Agreement, no Article 27 EU representative, no Standard Contractual Clauses and no international transfer mechanism described. The policy is visibly oriented towards Indian law, with a dedicated section on the Digital Personal Data Protection Act 2023. Last updated 18 February 2026.

Who owns the data?

The customer keeps ownership. The privacy policy states the vendor owns none of the data, information or materials that you or your authorised users upload, and that you retain title to and all interest in your Customer Data. You grant a limited licence allowing the vendor to access, disclose, process, transmit and use that data solely to deliver the service and comply with the terms. Third-party credentials and access tokens are held encrypted. Separately, the vendor reserves the right to use aggregated, anonymised, non-personal usage data internally, without disclosure and without identifying you. On a team account, the account holder can see each member's name, email, avatar and usage.

Reuse rights

Your own data stays yours to reuse freely: nothing in the terms requires the vendor's permission to export, move or repurpose your Customer Data, and the platform exists precisely to push that data between third-party applications you connect. Deletion of account data is self-service from the dashboard. The reverse direction is narrower. The vendor collects usage information, server logs, device identifiers and, with consent, location data; it stores the login credentials of every application you authorise and reads whatever content an action needs. Google Analytics and Heap Analytics are named as third-party trackers. Aggregated anonymised data may be reused internally without limit. On the AI side, the AgenticAI product page states that workflow data is never used to train models. Data processed on behalf of your own customers remains your legal responsibility.

Data retention & training

Hosting summary

No hosting country or region is disclosed anywhere on the site, so no jurisdiction can be asserted. The security page says all data is stored in localised AWS instances and that fully compliant data centres are maintained in partnership with AWS; the privacy policy adds that third-party application credentials sit in AES-256 encrypted storage on AWS RDS. The public subprocessor list names three infrastructure providers rather than one: Amazon Web Services for hosting and databases, Hetzner Online GmbH for the same purpose, and Webwerks for data centre services. Cloudflare handles DNS, firewall and DDoS protection, which means the resolved IP address is an anycast node and says nothing about where data actually lives. Encryption is 128-bit TLS in transit with an A+ Qualys SSL Labs rating, AES at rest, and hashed passwords. Production access requires multi-factor authentication and is restricted to authorised staff on a need-to-know basis. SOC2 Type 2 and ISO 27001:2022 certifications are third-party audited, and the underlying AWS infrastructure is itself accredited to SOC 2, ISO 27001 and FISMA Moderate.