Privacy Policy

1. Who we are

The controller of your personal data is:

• Service: PartnerStandard Program Designer
• Operator: Bernhard Friedrichs, sole proprietor (autónomo) registered in Spain, trading as PartnerStandard
• Address: Cowork Up! Puerta del Mar, C/ Cronista Carreres 10, Bajo, 46003 València, Spain
• VAT (NIF-IVA): ESX7526216H
• Email: hello@partnerstandard.com

We have not appointed a Data Protection Officer. Please send any privacy question to the email address above.

2. What this policy covers

This policy covers personal data we process through:

• the web app at program.partnerstandard.com;
• signing in with Google or Notion;
• creating, reading and editing your work in your Google Drive or in Notion;
• emails you send us for support.

This policy does not cover how Google or Notion process your data in their own products. Their own privacy policies apply to that.

3. How the Service works, in brief

You sign in with a Google or a Notion account. Your work is kept in your own Google Drive, in the folder PartnerStandard / Programs, or in your own Notion workspace, under a private page PartnerStandard with a Programs database. Only you work on it in the Service. Nothing is shared with anyone. The Service has no share links.

In Google Drive, the Service keeps a folder for each company, with a spreadsheet Company facts and one spreadsheet for each programme. In Notion, it keeps a Programs database and a Program Designer setup page with the databases Companies, Reasons, Entry, Benefits, Requirements and Performance bar, and the Programs database has one row for each programme. They hold your companies (their facts, such as what a typical customer pays), your programmes (partner types, what each earns, reasons, benefits and requirements), the Program Sheet and the text of the public page. The Service does not publish the public page for you: you copy the text and use it where you choose.

When you view or change your work, our servers read or write your files or Notion pages on your behalf. The content passes through our servers but is not saved in our database.

4. Personal data in our database

Our database is hosted in the EU (section 11). It holds:

4.1 Account data

When you sign in, we receive and store:

• your name and email address;
• your Google or Notion account ID;
• the URL of your Google profile picture, if Google provides one (we do not store Notion profile photos);
• whether Google says your email is verified;
• the permissions you granted (see sections 6 and 7);
• the dates your account was created and last updated.

4.2 Connection data

To work with your files, we store the access token and refresh token that Google or Notion issues to the Service. These tokens are encrypted at rest. The encryption key is kept separately from the database. Tokens are never sent to your browser.

4.3 Sign-in sessions

For each sign-in session we store a session token, its expiry date, and the IP address and browser user agent from which you signed in. We use these to keep you signed in and to protect your account.

4.4 Where your work is

For Google Drive, we store the ID of your "PartnerStandard / Programs" folder and the ID of the folder of each company. For Notion, we store the IDs of your PartnerStandard page, your Programs database and its data source, your Program Designer setup page and its databases, and the ID and name of your workspace. The Service uses them to find your work again without searching. We store only these IDs, never the name or the content of a company or a programme.

4.5 Technical records

Our hosting provider keeps short-lived technical request logs (such as IP address, time and requested page) to run and secure the Service. Our own server logs contain IDs only, never your content, names or email addresses.

Our database also keeps short-lived locks (an ID and an expiry time, nothing else) so that renewing your Notion access runs once at a time, that your saves to Notion run one at a time, and that each Program Sheet rewrite in Notion runs once at a time (IDs only). A lock is removed when it expires.

4.6 Data we do not collect

• We do not store the content of your work in our database or logs.
• We do not use analytics, advertising or tracking tools.
• We do not use AI or machine-learning services to process your data.
• We do not process payment data. The Service is free.

5. Your content

Your content lives in your Google Drive or Notion workspace. When you use the Service, our servers read it, show it in the app and write changes back. While this happens, the content is held in server memory. It is never written to our database or to logs.

When you delete a company or a programme in the Service, it moves to your Google Drive trash or to Notion’s trash. It is never deleted for good, and you can restore it there.

The Service sends no emails.

6. Google user data

6.1 What we access

When you sign in, Google asks you to grant these permissions:

• openid, email, profile: your name, email address, profile picture URL and Google account ID. We use these to create your account and sign you in.
• Google Drive, files used with this app (https://www.googleapis.com/auth/drive.file): access only to files that the Service created. The Service cannot see, list, open or change any other file in your Drive.

With that access, the Service uses the Google Drive API to:

• create a "PartnerStandard / Programs" folder for your work;
• create, read and update the files the Service keeps there;
• check that its folder and files still exist;
• move a file or folder that the Service itself made to your Drive trash (when you delete a company or a programme), never deleting it for good.

6.2 How we use it

We use Google user data only to provide and improve the features you see in the Service.

6.3 How we store it

We store your name, email address, profile picture URL, Google account ID, the granted permissions and your encrypted access and refresh tokens (sections 4.1 and 4.2), and the IDs of your folders (section 4.4). We do not store the content of your files (section 5).

6.4 How we share it

We do not sell Google user data. We share it only:

• with the service providers in section 10, so they can host the Service and store our records;
• when the law requires it (section 14).

6.5 Limited Use

PartnerStandard Program Designer’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• We do not use Google user data for advertising, including retargeting or personalised ads.
• We do not use Google user data to train or improve artificial intelligence or machine-learning models, ours or anyone else’s.
• We do not sell Google user data or pass it to data brokers.
• No person at PartnerStandard reads your Google user data, unless you give us explicit consent for specific data (for example, when you ask for help), it is needed for security reasons (for example, to investigate abuse), it is needed to comply with the law, or the data has been aggregated and anonymised for internal operations.

6.6 How to revoke access

You can remove PartnerStandard’s access at any time on Google’s Third-party connections page. After that, the Service cannot read or write your files until you sign in again. Deleting your account in the Service does not remove this access, because the same Google sign-in is shared with other PartnerStandard tools. To delete the data we store, see section 13.

7. Notion user data

This section applies if you sign in with Notion.

7.1 What we access

When you sign in, Notion asks you to allow PartnerStandard Connector in one of your workspaces, with these capabilities:

• User information with email addresses: your name, email address and Notion user ID, to create your account and sign you in.
• Read, update and insert content: to create PartnerStandard Program Designer’s own pages, and to read and update them.

Notion then offers a template provided by PartnerStandard, pre-selected, or lets you select pages. When you connect, Notion can copy a PartnerStandard page from our template into your workspace. The Service keeps your work under a private PartnerStandard page, which it shares with other PartnerStandard tools, and only uses that. If a later sign-in makes a copy you never used, we move that copy to Notion’s trash.

7.2 What the Service does with it

The Service keeps its own pages under a private page PartnerStandard in your workspace, in a Programs database. The Service only:

• creates the PartnerStandard page, the Programs database and the Program Designer setup page, and the pages your work needs in them;
• when it has no PartnerStandard page on record for you, searches the pages the connection can reach for a PartnerStandard page the connection made (which another PartnerStandard tool may have made) or that Notion copied from our template, and adds its Programs database there. The search runs only when the connection’s Notion bot belongs to the person signed in;
• reads and updates the pages it created, and moves rows it made to Notion’s trash when you delete a company or a programme.

Notion lets the Service reach the pages the PartnerStandard Connector created, the PartnerStandard page Notion copied from our template when you connected, and the pages you pick in Notion’s page picker. The Service reads and changes only its PartnerStandard page (the one the connection made, or the copy Notion made from the template) and the pages under it. After a sign-in it may move an unused extra copy of that template page to Notion’s trash. If you share a page with other people in Notion, that sharing is under your control.

7.3 What we store

We store your name, email address, Notion user ID and encrypted access and refresh tokens (sections 4.1 and 4.2), and the IDs of your PartnerStandard page, Programs database and Program Designer setup page with the ID and name of your workspace (section 4.4). We do not store the content of your pages (section 5).

7.4 Sharing and revoking

We share Notion user data in the same way and under the same limits as Google user data (sections 6.4 and 6.5). We do not use it for advertising or to train AI models, we do not sell it, and no person reads it except in the cases listed in section 6.5. Notion hosts your workspace under its own terms and privacy policy.

The Service never revokes its access in Notion, not when you sign out and not when you delete your account, because the same Notion connection is shared with other PartnerStandard tools. To remove PartnerStandard Connector’s access to Notion, open Settings → Connections in Notion. This also removes access for the other PartnerStandard tools. After that, the Service cannot reach your pages until you sign in again.

8. Purposes and legal bases

Where we rely on legitimate interests, you can object at any time (section 15).

9. Cookies and browser storage

The Service uses only what is strictly necessary to run it. We do not use analytics, advertising or tracking cookies, so we do not show a cookie banner (Article 22.2 of Spanish Law 34/2002, LSSI-CE).

The sign-in cookies are HTTP-only, sent only over secure connections and limited to program.partnerstandard.com.

When you sign in, you are taken to Google’s or Notion’s sign-in page. Google and Notion may set their own cookies there under their own policies.

10. Service providers

We use these providers to run the Service. They process personal data on our behalf, under data processing terms with appropriate safeguards.

Google and Notion are not our service providers. They are the sign-in and storage services you choose to connect, and they process your data under your own agreement with them.

11. International transfers

Our database is in the EU, and our server functions run in an EU region. Some providers are US companies and may access data from outside the European Economic Area, for example for support or security. Where this happens, we rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed.

12. How long we keep data

Your files and Notion pages are not ours to keep or delete. They stay in your Google Drive or Notion workspace until you delete them.

13. Deleting your account

You can delete your account in the app’s settings, or by emailing hello@partnerstandard.com. When you delete your account, we delete:

• your account, sign-in sessions and Google or Notion tokens;
• the IDs of your folders, or of your Notion pages and databases.

Your files and Notion pages stay in your Google Drive or Notion workspace. They remain yours, and we do not delete them. Delete them there if you want them gone.

Deleting your account does not remove PartnerStandard’s access to your Google or Notion account. To remove it entirely, use Google’s Third-party connections page (section 6.6) or Notion’s Settings → Connections (section 7.4).

14. Disclosure in response to legal process

We may disclose personal data if the law requires it or in response to valid legal process, including:

• court orders or judicial proceedings;
• subpoenas or regulatory investigations;
• requests from law-enforcement authorities;
• legal claims, where disclosure is needed to establish, exercise or defend legal rights.

We check each request for validity and scope. Where the law allows, we tell the affected users before we disclose their data. We disclose only the minimum needed. Because we do not store the content of your work, we usually cannot provide it.

15. Your rights

Under the GDPR you have the right to:

• Access: get a copy of your personal data.
• Rectification: correct inaccurate data.
• Erasure: ask us to delete your data.
• Restriction: limit how we use your data in certain cases.
• Portability: receive your data in a structured, machine-readable format. Your work is already in your own files or Notion pages.
• Object: object to processing based on legitimate interests.
• Withdraw consent: where we rely on consent, at any time.

16. How to exercise your rights

Email us at hello@partnerstandard.com. We may ask you to confirm your identity. We answer verified requests within 30 days.

You can also complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at aepd.es, or to the data protection authority where you live or work.

17. Security

We protect your data with:

• encryption in transit (HTTPS) for all traffic;
• encryption at rest for Google and Notion tokens, with the key kept apart from the database;
• permission checks on our servers for every read and every change;
• logs that contain IDs only.

No system is perfectly secure. If a personal data breach affects you, we will tell you and the supervisory authority as the GDPR requires.

18. Children

The Service is a business tool. It is not meant for anyone under 18, and we do not knowingly collect children’s data.

19. Changes to this policy

We may update this policy. We will announce material changes in the Service. The effective date at the top shows the latest version.

20. Contact

• Email: hello@partnerstandard.com
• Mail: Bernhard Friedrichs, Cowork Up! Puerta del Mar, C/ Cronista Carreres 10, Bajo, 46003 València, Spain