This policy explains what personal data GG Labs (SASU, 138 avenue Victor Hugo, 75016 Paris, "we") collects when you use Periphery at periphery.exposed, why, and what rights you have. We are the data controller for the data described here, under the EU General Data Protection Regulation (GDPR) and the French Loi Informatique et Libertés. Contact for anything privacy related: contact@periphery.exposed.
1. Data we collect about you
| Data | Source | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Email address | You, via the magic-link form or your Google account | Identify your account, send login links, apply your plan and quota, contact you about the Service | Contract (art. 6(1)(b)) | Life of the account |
| Session cookie | Set by us when you log in | Keep you logged in | Contract; strictly necessary cookie | 30 days, or until you log out |
| Plan tier, API keys and connected apps (each app's name and when it was connected and last used) | Created when you subscribe, issue a key or connect an app | Enforce quotas and authenticate API and MCP calls (keys and tokens are stored hashed) | Contract | Life of the account; a connected app until you disconnect it, it goes 30 days unused, or 90 days pass |
| Billing records: Stripe customer and subscription identifiers, subscription status, plan price and interval, trial end and renewal date | Created when you subscribe | Apply your paid plan | Contract | Life of the account; invoices are kept by Stripe for as long as accounting law requires |
| Activity events: search queries and filters, logins, account creations and deletions, magic-link requests, app connections and the name of the app that ran a search, with timestamp and your email | Generated by your use of the Service | Understand how the product is used and improve it; detect abuse | Legitimate interest (art. 6(1)(f)) in product analytics and security | 90 days, deleted automatically |
| Monthly search count | Generated by your use of the Service | Enforce your plan's quota | Contract | Calendar month (UTC), then reset |
| Feature votes: your answers to "Would you use…?" | You, when you answer | Decide what to build next | Legitimate interest (art. 6(1)(f)) in planning the product | Life of the account |
| Server logs: IP address, request path, user agent, status, timing | Your browser or API client | Operate, secure, and debug the Service; rate limiting | Legitimate interest in security and reliability | Kept only as long as needed for operations and security, then discarded |
| Usage statistics: pages viewed, how you got here, device and browser type, approximate location | Google Analytics, in your browser, only if you accept analytics cookies | Understand how the site is used and improve it | Consent (art. 6(1)(a)), which you can withdraw at any time | At most 14 months in Google Analytics; its cookies expire after 13 months |
When you connect an AI assistant or another app to the MCP server, what it reads from Periphery is sent to that app, and to the AI provider behind it, at your direction; their terms and privacy policies apply to it from there.
We run Google Analytics only if you agree to it (see Cookies below). We do not run advertising trackers and we do not sell personal data. Google login gives us only your verified email address; we do not request access to your Google data.
2. Data in the index
Periphery indexes applications that are publicly reachable on hosting providers. The index can contain personal data that those applications expose to any visitor, such as email addresses appearing in page text, names in page titles, and screenshots. We process this data on the basis of our legitimate interest, and that of the wider security community, in making accidental public exposure visible so it can be fixed (art. 6(1)(f)). We only retrieve what an unauthenticated visitor would see, we re-crawl periodically so removed content drops out of the index, and we honour removal requests as described in our Terms. If you believe the index contains your personal data and you want it removed, write to contact@periphery.exposed.
3. Processors and recipients
We share personal data only with providers that process it on our behalf under a data processing agreement:
- OVH SAS (France): hosting of the application, database, and screenshot storage. Data stays in the European Union.
- Resend, Inc. (United States): delivery of magic-link login emails. Your email address is transferred under the EU Standard Contractual Clauses.
- Stripe Payments Europe, Ltd. (Ireland): payment processing, invoicing and tax calculation for paid plans. Card details are entered on Stripe's pages and never reach us. Stripe also processes this data as an independent controller for fraud prevention and its own legal obligations, under its privacy policy.
- Google LLC: only if you choose "continue with Google"; Google's own privacy policy governs its processing of your login.
- Google Ireland Limited (Ireland) and Google LLC (United States): Google Analytics, only if you accept analytics cookies. Data can be transferred to the United States under the EU-US Data Privacy Framework.
We may also disclose data when the law requires it or to establish, exercise, or defend legal claims.
4. Cookies
We set a single cookie, the session cookie, which is strictly necessary to keep you logged in and therefore does not require consent. It is HttpOnly, sent only over HTTPS, and expires after 30 days or when you log out. During Google login a short-lived state cookie protects the OAuth exchange and is deleted as soon as login completes. A cookie named prph_consent remembers your cookie choice for 6 months; it is strictly necessary too. With your consent, and only then, Google Analytics sets its own cookies (_ga and _ga_*) to count visits; they expire after 13 months. Rejecting analytics deletes them. There are no advertising cookies. You can change your choice at any time with Cookie settings, also in the footer of every page. The site also remembers two display choices in your browser's local storage, the list or grid view and the light or dark theme. They never leave your browser.
5. Your rights
Under the GDPR you can ask us to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate data;
- erase your data, including by closing your account;
- restrict or object to processing based on our legitimate interests, including product analytics;
- receive the data you provided in a portable format.
Send requests to contact@periphery.exposed from the email address on your account; we answer within one month. You can also lodge a complaint with the French supervisory authority, the CNIL (cnil.fr), or the authority of the EU country where you live.
6. Security
Sessions and API keys are stored as hashes, connections are encrypted with TLS, login links expire after a short time and can be used once, and access to production systems is limited to the people who operate the Service. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the CNIL as the GDPR requires.
7. Children
The Service is intended for professionals and is not directed at anyone under 18. We do not knowingly collect data from children.
8. Changes
We will post any changes to this policy here and update the date at the top. Material changes are also announced by email to account holders.
Data controller: GG Labs, 138 avenue Victor Hugo, 75016 Paris, contact@periphery.exposed. See also our Terms of Service.