Privacy

What we keep

• Your email and nameThe email you sign in with, and the first and last name you give us or Google gives us when you sign up with Google.
• Your pictureA profile picture if you add one, or the photo on your Google account, copied once when you sign up with Google. Anyone with its address can see it, as with a picture on most sites.
• How you sign inWhich sign-in methods you use; for Google, Google's identifier for your account. For each passkey, its name, its public key and when it was added. Passkeys never leave your device; we only hold the public part.
• SessionsWhen each sign-in started and ends, and the IP address and browser it came from, and how you signed in: email code, passkey or Google.
• Your time zoneYour browser's time zone, such as Europe/Madrid, saved when you open your profile, so times can be shown to you in it. Until then, the time zone Cloudflare works out from where you connect at sign-in. Deleted with your account.
• ConnectionsEach app or AI assistant you approved to act for you: its name, the address it returns to, what you allowed, and when it was used.
• Activity and noticesWhen you last signed in or a connection last renewed. Notices we sent to the apps about your email change or deletion.
• Short-lived safety dataSign-in codes, stored only as a hash; counters of attempts per email (as a hash) and per IP address, used to stop abuse.

Why, and on what basis

• To give you an account and sign you inNeeded to provide the service you asked for (GDPR Article 6(1)(b)). This covers your email, name, picture, sign-in methods, sessions and connections.
• To keep accounts safeOur legitimate interest in preventing abuse and break-ins (Article 6(1)(f)): IP addresses and browsers on sessions, attempt counters, and a bot check by Cloudflare on the sign-in form.
• To keep the apps in stepNeeded to provide the service: the apps are told when you change your email or delete your account, so they can do the same.

No advertising, no profiling, no selling of data, and no analytics or tracking on these pages.

Who receives it

• Perk Maximizer labWhen you sign in to an app, it receives your identifier, email, name and the address of your picture.
• Apps and assistants you connectOnly what you approve on the consent screen, until you revoke it on your profile.
• CloudflareRuns this service and its database, and the bot check on the sign-in form.
• ResendSends the sign-in code emails.
• GoogleOnly if you choose to sign in with Google.

Data from Google

If you sign in with Google, we ask Google only for your email address and whether it is verified, your name and your profile picture, and we receive Google's identifier for your account. We use them only to sign you in, to link Google to your account, and to fill in your name and picture when your account is created. We keep them in the EU database described below and delete them with your account. We share them only with the apps you sign in to and with assistants you connect and allow to see your name and email, never sell them or use them for advertising, and never post to or change your Google account.

Where it is stored

Your account data is stored in the European Union, in a Cloudflare database bound to the EU. Code emails are sent through Resend's EU region. Cloudflare and Resend are US companies and act on our instructions under their data processing agreements; Cloudflare handles each request at the data centre nearest you, which can be outside the EU.

How long we keep it

• Your accountUntil you delete it, or one year after your last sign-in or connection renewal. An inactive account is then deleted without a warning, and the apps are told.
• Your pictureUntil you remove it or replace it, or your account is deleted.
• Sessions, with IP address and browserUntil the session ends, at most 7 days, then removed within a day.
• Sign-in codes5 minutes, then removed within a day.
• Connection tokensUntil they expire or are revoked: one hour for access, 30 days for renewal. Then removed within a day.
• Notices to appsTheir content is cleared once delivered; the record goes 30 days later.
• Attempt countersRemoved a day after their window ends.
• Backups and email logsThe database keeps a point-in-time history for up to 30 days, so deleted data leaves it within 30 days. Resend keeps its log of sent emails for a limited period set by Resend.

Our own logs never contain your email, name, codes or tokens.

Your rights

• See and take your dataWrite to privacy@perkmaximizer.com and we send you everything we hold about you.
• Correct itWrite to privacy@perkmaximizer.com.
• Delete itWrite to privacy@perkmaximizer.com; your account is deleted and every app is told.
• Object, restrict, or ask for helpWrite to privacy@perkmaximizer.com.
• ComplainYou can complain to the data protection authority where you live or work.

Cookies

Only cookies needed for what you asked for: your session, the sign-in you are in the middle of, and the light or dark theme if you choose one. That is why there is no cookie banner.

Contact

Innesta LLC is responsible for this data (the controller). Its representative in the EU (GDPR Article 27) is Martijn Loderus, Barcelona, Spain. Write to privacy@perkmaximizer.com about anything on this page; we answer within one month.