Last updated 16 September 2026
This policy explains what personal data GG Labs (SASU, 138 avenue Victor Hugo, 75016 Paris, "we") collects when you use Periphery at periphery.exposed, why, and what rights you have. We are the data controller for the data described here, under the EU General Data Protection Regulation (GDPR) and the French Loi Informatique et Libertés. Contact for anything privacy related: contact@gglabs.fr.
| Data | Source | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Email address | You, via the magic-link form or your Google account | Identify your account, send sign-in links, apply your plan and quota, contact you about the Service | Contract (art. 6(1)(b)) | Life of the account |
| Session cookie | Set by us when you sign in | Keep you signed in | Contract; strictly necessary cookie | 30 days, or until you log out |
| Plan tier and API keys | Created when you subscribe or issue a key | Enforce quotas and authenticate API calls (keys are stored hashed) | Contract | Life of the account |
| Activity events: search queries and filters, sign-ins, sign-ups, magic-link requests, with timestamp and your email | Generated by your use of the Service | Understand how the product is used and improve it; detect abuse | Legitimate interest (art. 6(1)(f)) in product analytics and security | 90 days, deleted automatically |
| Monthly search count | Generated by your use of the Service | Enforce your plan's quota | Contract | Calendar month (UTC), then reset |
| Server logs: IP address, request path, user agent, status, timing | Your browser or API client | Operate, secure, and debug the Service; rate limiting | Legitimate interest in security and reliability | Kept only as long as needed for operations and security, then discarded |
We do not run third-party analytics or advertising trackers and we do not sell personal data. Google sign-in gives us only your verified email address; we do not request access to your Google data.
Periphery indexes applications that are publicly reachable on hosting providers. The index can contain personal data that those applications expose to any visitor, such as email addresses appearing in page text, names in page titles, and screenshots. We process this data on the basis of our legitimate interest, and that of the wider security community, in making accidental public exposure visible so it can be fixed (art. 6(1)(f)). We only retrieve what an unauthenticated visitor would see, we re-crawl periodically so removed content drops out of the index, and we honour removal requests as described in our Terms. If you believe the index contains your personal data and you want it removed, write to contact@gglabs.fr.
We share personal data only with providers that process it on our behalf under a data processing agreement:
We may also disclose data when the law requires it or to establish, exercise, or defend legal claims.
We set a single cookie, the session cookie, which is strictly necessary to keep you signed in and therefore does not require consent. It is HttpOnly, sent only over HTTPS, and expires after 30 days or when you log out. During Google sign-in a short-lived state cookie protects the OAuth exchange and is deleted as soon as sign-in completes. There are no advertising, analytics, or third-party cookies.
Under the GDPR you can ask us to:
Send requests to contact@gglabs.fr from the email address on your account; we answer within one month. You can also lodge a complaint with the French supervisory authority, the CNIL (cnil.fr), or the authority of the EU country where you live.
Sessions and API keys are stored as hashes, connections are encrypted with TLS, sign-in links expire after a short time and can be used once, and access to production systems is limited to the people who operate the Service. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the CNIL as the GDPR requires.
The Service is intended for professionals and is not directed at anyone under 18. We do not knowingly collect data from children.
We will post any changes to this policy here and update the date at the top. Material changes are also announced by email to account holders.
Data controller: GG Labs, 138 avenue Victor Hugo, 75016 Paris, contact@gglabs.fr. See also our Terms of Service.