Peeklytic Privacy Policy
Status: this is an implementation-ready working draft for counsel review, not legal advice and not yet a published policy. Before publication it must name the final legal entity, a dedicated privacy mailbox, the deletion deadline, and the controller postal address.
1. Information we process
- Account and contact data: name, business name, email address, display preferences, and authentication records.
- Credential material: Google Drive and Instagram refresh/access tokens are sealed with an application key. Portal passwords are stored only as salted hashes.
- Client media and metadata: files the client selects in Google Picker, Drive item metadata, copied media, hashes, and modification timestamps.
- Instagram data: profile identifiers and media/metric data made available through the authorized Instagram API.
- Portal telemetry: a SHA-256 hash of a random first-party visitor cookie, optional account/session identifiers, named page/action events, route labels, HTTP status, and timestamps. Peeklytic does not store raw IP addresses, user agents, referrers, query strings, or third-party analytics identifiers for this telemetry.
- Email delivery data: recipient address, sender, subject, message identifier, delivery state, timestamps, and provider error details.
- AI processing data: selected media, captions, metadata, and prompts processed by the AI tools Peeklytic uses to draft recommendations and optional images.
- Support data: messages, replies, screenshots, and attachments sent to Peeklytic.
- Billing data: if payments are enabled, checkout is processed by Stripe. Peeklytic receives limited billing metadata such as customer identifier, receipt status, email, billing name, and amount. Card numbers are handled by Stripe and are not stored by Peeklytic.
2. Sources
We receive data directly from you, from your authorized Google Drive and Instagram connections, from publicly available Instagram post information for accounts you ask us to analyze, from device/request behavior in the portal, from email and cloud infrastructure processors, and from Stripe if paid plans are enabled.
3. Purposes and legal bases where Peeklytic acts as controller
- Contract: providing the portal, recommendations, media preparation, approvals, support, and paid service.
- Consent: provider OAuth authorization and optional communications where required.
- Legitimate interests: security, abuse prevention, service improvement, and first-party product telemetry conducted without third-party ad identifiers.
- Legal obligation: tax, accounting, dispute, and other applicable legal duties.
4. Google Drive and Instagram access
Google's consent screen shows the exact access you grant. For the current folder workflow, that scope can access existing Drive files even though Peeklytic confines its own requests to the items and direct folder children you select. Instagram access follows the permissions shown on Instagram's own authorization screen. You may revoke access from the provider or from Peeklytic; revocation affects future processing, while lawfully retained records may remain.
5. Payments and Stripe
Peeklytic does not take payments yet. If paid plans launch, Stripe will process payments and this section will be updated before any charge. Peeklytic does not collect or store card numbers. Stripe may receive payment details, device information, and transaction information, and processes it under Stripe's privacy policy and applicable payment rules. Purchase terms, refunds, and chargebacks should be stated separately in Peeklytic's terms of service.
Roles, processors, and transfers
For the client portal, client media, and client account metrics, Peeklytic acts as a processor acting on the client business's instructions. For the Peeklytic account, first-party telemetry, service improvement, and billing, Peeklytic acts as a controller. Current expected processors and recipients include Google Drive API, Instagram/Meta API, Cloudflare hosting/email services, a managed email provider, Google Workspace or an equivalent support provider, AI text, image, and review services, and Stripe if payments are enabled. Stripe processes payments under the Stripe Privacy Policy, Stripe Data Processing Agreement, and Stripe sub-processor list.
With the client's affirmative authorization, Peeklytic team members may view selected media and derived metadata to prepare recommendations, answer support questions, and carry out requested revisions. Peeklytic's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including Limited Use. Peeklytic does not use Drive data to develop, improve, or train generalized AI or machine-learning models, consistent with the Google API Services User Data Policy. If you ask Peeklytic to build or tune a model for your own business, the scope is confirmed in writing and your approval is recorded before any Drive data is used for it; that model is used only to serve your account and is not shared with or used for other clients. Peeklytic does not use Drive data for advertising and does not sell it. People at Peeklytic read Drive content only with your permission for selected files, for security or abuse investigation, to comply with law, or in aggregated de-identified form for internal operations. Peeklytic does not use Drive-derived media for general product improvement. Data may be processed in the United States and other countries where the processors operate. Where required, transfers rely on adequacy decisions, Standard Contractual Clauses, the UK IDTA, or the EU-U.S. Data Privacy Framework, as applicable to the processor.
California residents may exercise CCPA/CPRA rights and opt out of sale or sharing; Peeklytic does not sell personal information or share it for cross-context behavioral advertising. Where required, Peeklytic will honor Global Privacy Control as a do-not-share signal.
6. Sharing
We share data only with processors and services necessary to operate Peeklytic, currently expected to include cloud hosting, Cloudflare gateway/email services, Google Workspace or an equivalent email provider, Google Drive API, Instagram API, AI text, image, and review services, and Stripe if payments are enabled. We do not sell personal information or use Google Drive media for third-party advertising.
7. Retention
- Account, project, approval, and media records: while the client relationship is active, then for the period stated in your service agreement. Copied Drive media is deleted when you disconnect Drive or end the relationship, except records we must keep by law.
- Provider tokens: until disconnection or expiry, then deleted or replaced.
- First-party portal events: up to 24 months, then aggregated or deleted.
- Email lifecycle events: up to 24 months.
- Billing records: the period required by tax and commercial law.
8. Security
Access is restricted, secrets are stored separately from the application database, provider tokens are sealed, transport is encrypted, and telemetry is deliberately minimized. Our hosting provider processes IP addresses transiently to deliver and protect the service. No system is perfectly secure; security verification must remain current with the actual hosting architecture.
9. Your rights
Depending on your location, you may request access, correction, deletion, restriction, portability, objection, disclosure categories, and nondiscrimination. To request deletion, email jlu@resmp.dev from your account address or disconnect the integration in the portal. Before public launch, this policy must state the exact deletion deadline, a dedicated privacy contact, and any legal-retention exceptions. You may also file a complaint with a supervisory authority. California residents may limit use of sensitive personal information and opt out of sale or sharing; Peeklytic does not sell or share personal information for cross-context behavioral advertising.
10. Children
Peeklytic is intended for business users and is not directed to children under 16.
11. Changes
Material changes will be announced before the effective date where required. We will notify account holders by email before material changes take effect.
12. Contact
Email jlu@resmp.dev until the dedicated privacy mailbox is provisioned, or write to [controller postal address].
Concept generated: 2026-10-23