Privacy.
A clearer view.

Who is responsible

Operator and data controller

Αντώνης Παπαγγελής του Αλεξάνδρου, a sole trader operating under the trading name Max Digital.

Operator trading name

Max Digital

Country

Greece

Privacy requests and contact email

support@lookalytic.com

We determine how account, billing, support and service-security data is used. If your organisation determines the purposes of processing personal data in workspace content, it is responsible for those purposes and instructions. Contact us about requests involving that content so we can identify the responsible organisation and assist.

Information the service handles

• Account and workspace information, such as an email address, name and profile picture, sign-in identifiers and session records, memberships, roles and settings.
• The public URLs and supported fields you choose to monitor, extracted observations, change history and run diagnostics.
• Notification destinations, including recipient email addresses and configured webhook endpoints, along with delivery attempts and status.
• API credentials and integration configuration. Secrets are handled by the service and should never be added to public monitoring URLs.
• Billing identifiers, selected plans, checkout, invoice and payment-status records. Stripe processes payment details; payment credentials are not collected by the marketing pages.
• Operational and security logs needed to diagnose failures and protect the service. Hosting and infrastructure providers also process request information under their own service arrangements.
• Messages and information you send to support, including privacy requests and information needed to verify and answer them.

Information comes from you, authorised workspace members, the sign-in and payment providers, and the public pages selected for monitoring. We also generate observation, delivery and security records when the service runs. Account identifiers are needed to provide an account; payment information is needed only when you make a purchase. Without the necessary information we cannot provide the corresponding service.

Account sign-in

WorkOS AuthKit provides hosted sign-in, account verification and session management. When you choose Google sign-in, Google shares your email address and basic profile information, including your name and profile picture, with WorkOS. WorkOS makes the verified profile and sign-in identifiers available to lookalytic. We use them to identify you, create or access your account, display your profile in your workspace and protect account access.

Convex stores your local account identity, including the verified profile and sign-in identifiers, workspace memberships, roles and local session records. lookalytic uses these records in Convex to enforce workspace access permissions.

WorkOS processes Google sign-in data for authentication, Vercel processes it to serve the application and handle the sign-in callback, and Convex stores it for the account and access-control purposes described above. Your name, email address and profile picture may be visible to authorised members of your workspace according to their permissions. When you make a purchase, your account email address is also passed to Stripe for billing. If you use that email address as a notification recipient, Resend processes it to deliver the configured messages. The roles of these providers are described below.

Your Google email address, name, profile picture and sign-in identifiers are not included in optional analytics events. Choosing Google sign-in does not enable optional analytics; analytics requires the separate consent described below.

Google sign-in requests email and basic-profile permissions. It does not request access to your Gmail messages, Google Drive files or contacts. You can review or revoke the connection in your Google Account. Revoking that connection does not itself delete your lookalytic account or workspace data; use the deletion and privacy request options described below.

Why information is used

Accounts, monitoring, alerts, purchases and product support

We use the information necessary to provide the service you request, take steps at your request before a contract, and perform our contract with you (GDPR Article 6(1)(b)). For members and contacts acting for a business customer, we rely on our legitimate interests in administering that customer relationship and providing authorised workspace access (Article 6(1)(f)).

Security, reliability and prevention of abuse

Our legitimate interests are protecting accounts and customer data, preventing fraud and unauthorised access, diagnosing failures, and maintaining a reliable service (Article 6(1)(f)). Access controls, limited logging and retention rules restrict this processing to what is needed for those purposes. You may object as described below.

Accounting, tax and data-rights obligations

We process necessary records to meet applicable Greek and EU legal obligations, including accounting and tax recordkeeping and responding to GDPR requests (Article 6(1)(c)). Relevant records may also be needed to establish, exercise or defend legal claims under our legitimate interests (Article 6(1)(f)).

Optional analytics

Optional measurement relies on your consent (Article 6(1)(a)). It operates only when enabled and allowed. Refusing or withdrawing consent does not prevent use of the service; withdrawal does not affect processing that was lawful before withdrawal.

Public-page observations are supplied as information for your review. lookalytic does not automatically reprice products, make purchasing or bidding decisions, or make decisions with legal effects about individuals.

Service providers

Vercel

Web application hosting and request handling.

Convex

Local account identity and verified profile, workspace memberships and roles, local session records and access control, along with transactional application data and scheduled work.

WorkOS

Hosted authentication, account and session management, social sign-in and authentication messages such as verification and password-reset emails.

Google

Optional Google sign-in, sharing the email address and basic profile described above. This is separate from optional Google Analytics.

Resend

Product transactional email, including configured email notifications.

Papaki / Enartia

Email hosting for support and privacy correspondence, using the securemail.pro service. This is separate from product email sent through Resend.

Stripe

Hosted payment processing, invoices and subscription management.

OVHcloud

Hosting for the extraction worker and associated operational infrastructure.

The extraction worker processes the public URLs selected for monitoring. Configured webhooks send relevant event data to the destinations selected by the workspace. Their operators determine how data is handled after receipt. Payment and sign-in providers may also process data for their own purposes under their privacy notices.

For further details, see the privacy notices from Vercel, WorkOS and Convex, and Resend's data protection and retention information. These documents supplement this notice. Contact lookalytic at our privacy email for requests about your lookalytic data, including requests that require us to coordinate with a provider.

Google Analytics is an optional future analytics destination. It is not required to use the service and is not active unless the operator configures it and you allow optional analytics.

Where information is processed

The application is configured to run Vercel server functions in Frankfurt, Germany. Vercel also operates a global delivery network; this function region does not mean all request handling, logs or provider operations remain in Germany. The production Convex database and application backend are hosted in US East, Northern Virginia, United States. The extraction worker is hosted on OVHcloud infrastructure recorded in Frankfurt, Germany.

Authentication, email and payment providers also process data outside the European Economic Area, including in the United States. Resend stores email data in the United States even when an EU sending region is selected. The service does not provide an EU-only data-residency commitment.

Transfers outside the EEA require an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and supplementary measures where needed. Provider transfer terms are available from Vercel, Convex, WorkOS, Resend and Stripe and Papaki. You can request information about the safeguards applicable to your data at our privacy email, including the provider terms relevant to your request.

Retention and deletion

Retention depends on the data category and the workspace’s retention policy. Purchasing a check allowance does not itself promise a longer retention period. Shorter workspace settings can apply to run, delivery, audit and artifact records.

• Observation history has a default 30-day age policy. Existing workspace policies can instead use 365 days or retain history without automatic age-based expiry while the workspace is kept. Current values and observations referenced by retained changes or active alert baselines may remain longer because the service still depends on them.
• Source HTML artifacts have a policy limit of 7 days and screenshots 30 days, subject to shorter run-retention settings.
• Run and related operational history uses a 365-day default, with a 730-day policy for some existing workspaces. Completed delivery and dependent notification records use 30 days by default, or 90 days under an extended policy. API request logs use 30, 90, 180 or 365 days. Workspace audit logs use 365 days by default, or 2,555 days under an extended policy. Active work and required dependencies can delay cleanup.
• Account and workspace information is kept while needed to provide the account and workspace. Workspace deletion removes workspace data through background cleanup; it does not automatically delete your sign-in identity or every payment-provider record. Contact our privacy email for account deletion and requests spanning providers.
• Local sign-in session records become eligible for cleanup 24 hours after expiry. Authentication webhook receipts use 90 days and authentication rate-limit bookkeeping uses ten minutes. Minimal revocation and deleted-identity markers have no automatic expiry because they prevent old credentials from restoring access; they are limited to that security purpose.
• Accounting books and supporting records must be retained for at least five years from the end of the relevant accounting period under Greek requirements, and longer where another applicable obligation or a legal claim requires it. This does not require retaining unrelated monitoring history. Stripe’s own regulatory retention is governed by its privacy policy.
• We review support correspondence at least once a year. We keep it only while needed to support an ongoing customer relationship, resolve open requests or disputes, or meet specific legal obligations. At each review, we delete or anonymise personal data that is no longer needed. You can request deletion before the next review; we assess each request individually. Data-rights correspondence is retained as needed to document our response and compliance with applicable obligations, with access restricted to that purpose.

Age limits determine eligibility for scheduled cleanup, rather than guaranteeing deletion at the exact expiry time. Deletion may be restricted where records remain necessary for legal obligations or claims. We assess privacy requests individually instead of requiring you to wait for every routine retention period to expire.

Providers maintain their own recovery and deletion schedules. Resend currently publishes 30-day email/log retention on its standard plans, seven-day backups, and deletion of remaining customer data within 90 days after termination of the operator’s Resend account. That account termination period is separate from deletion of an individual lookalytic account. WorkOS excludes backups and archives from immediate contract-end deletion and removes them under its retention schedule. Other provider recovery and archive copies follow the applicable provider deletion and backup schedules. Those schedules are separate from cleanup of active application records and copies under our control. Details are available in the linked provider terms, the Convex backup and restore documentation and the Papaki email hosting terms. Contact our privacy email for deletion requests; we coordinate with the relevant providers where needed and explain any applicable retention exceptions.

Storage and optional analytics

Authentication uses essential session mechanisms. Browser storage also supports workspace preferences, onboarding drafts and the local demo. Demo workspaces stay in the browser and are not included in real acquisition reports.

When allowed and enabled, analytics uses a random session identifier and recognised event categories to connect a landing page with observed signup and monitoring milestones. Attribution is limited to recognised source and medium categories; arbitrary query parameters are discarded. The session record expires after 30 minutes and the consent choice after 180 days. There are no third-party analytics scripts or advertising cookies in this implementation.

When analytics is enabled and allowed, a first-party cookie mirrors your consent choice until its original expiry. After a new account is created, a separate first-party cookie carries that completion for up to five minutes and is removed when read. These cookies contain only a version and timestamp. Withdrawing consent clears them and the session attribution record.

First-party event logs follow the hosting log-retention configuration. If optional Google Analytics forwarding is enabled, Google receives the permitted event fields and random session identifier. Google Analytics remains optional and must not be enabled until its destination, retention settings and disclosures have been verified. When optional collection is disabled, no optional analytics events are sent.

Your choices and rights

Depending on the applicable law, you may request access, correction, deletion, restriction, portability or objection to processing, and withdraw optional analytics consent. You may also complain to a competent data-protection authority. Some requests depend on workspace permissions or obligations that require continued retention.

For privacy and data-rights requests, including deletion requests, email support@lookalytic.com. Workspace owners can use the application’s export and deletion controls where available. You can continue to use the service with optional analytics off.

We may request proportionate information to verify your identity. We respond without undue delay and normally within one month. Where the GDPR permits an extension for complexity or the number of requests, we explain the reason within that first month. You may complain to the Hellenic Data Protection Authority or another competent supervisory authority, without contacting us first.

Read Pricing for check allowances and billing details.