1. Introduction

Welcome to FilterGate. We are committed to protecting your personal information and your right to privacy. This policy explains how we handle your data when you use our service to connect and share Notion database views.

This Privacy Policy complies with the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other applicable data protection laws.

2. Information We Collect

Notion Data

FilterGate accesses your Notion workspaces via the official Notion API. We only access the pages and databases that you explicitly grant us permission to see. We do not store the content of your databases on our servers permanently; we act as a secure gateway to filter and present your live Notion data.

Authentication & Access Credentials

We securely store:

Notion OAuth tokens (encrypted at rest)
Email addresses for email-authenticated views
Password hashes for password-protected views (never stored in plain text)
Magic link tokens (hashed and time-limited)

Workspace & Branding Data

We store workspace configurations including:

Workspace names and settings
Custom logos and favicons uploaded to our storage (Supabase Storage)
Theme preferences and branding configurations
Portal and view configurations you create

Usage & Analytics Data

We collect:

IP addresses (hashed for privacy) for access logging and security
View access timestamps and patterns
Browser and device information for compatibility
Error logs for debugging and service improvement

Cookies & Session Data

We use essential cookies for:

Authentication session management (sv_auth_* cookies)
Admin dashboard access (session tokens)
Security and fraud prevention

We do not use advertising or tracking cookies. For detailed cookie information, see our Cookie Policy.

3. How We Use Your Information

We use the data collected to:

Provide and maintain the FilterGate service
Authenticate and authorize access to secure views and portals
Filter and present your Notion data according to your configurations
Store and deliver custom branding assets (logos, favicons)
Monitor and prevent unauthorized access
Improve service performance and reliability
Communicate service updates and security notifications
Comply with legal obligations and enforce our Terms of Use

Legal Basis for Processing (GDPR): We process your data based on:

Contract performance: To provide the services you requested
Legitimate interests: Security, fraud prevention, and service improvement
Consent: Where explicitly required (e.g., optional analytics)
Legal obligations: Compliance with applicable laws

4. Data Sharing & Third Parties

We share your data only as necessary to provide our service:

Service Providers (Subprocessors)

Notion API: To access and retrieve your workspace data
Supabase: Database hosting and file storage for branding assets
Vercel/Hosting Provider: Application hosting and delivery

All third parties are contractually bound to protect your data and use it only for the specified purposes.

We Never:

Sell your personal data
Share your Notion database content with third parties
Use your data for advertising or marketing to third parties

5. Data Retention

We retain your data as follows:

Active accounts: Data retained while your account is active
Deleted items: Soft-deleted views and portals retained for 30 days, then permanently deleted
Authentication tokens: Refreshed or expired according to OAuth standards
Access logs: Retained for 90 days for security and debugging
Branding assets: Deleted when no longer referenced by any workspace, portal, or view

Upon account deletion, we permanently delete all associated data within 30 days, except where retention is required by law.

6. Your Rights

You have the following rights regarding your personal data:

GDPR Rights (EU/EEA Users)

Right to Access: Request a copy of your personal data
Right to Rectification: Correct inaccurate data
Right to Erasure: Delete your data ("right to be forgotten")
Right to Restrict Processing: Limit how we use your data
Right to Data Portability: Receive your data in a portable format
Right to Object: Object to processing based on legitimate interests
Right to Withdraw Consent: Where processing is based on consent

CCPA Rights (California Users)

Right to Know: What personal information we collect and how we use it
Right to Delete: Request deletion of your personal information
Right to Opt-Out: We do not sell personal information
Right to Non-Discrimination: Equal service regardless of privacy choices

To exercise any of these rights, contact us at support@filter-gate.com. We will respond within 30 days.

7. Data Security

Security is our top priority. We implement industry-standard security measures:

Encryption in Transit: All data transmitted via TLS 1.3
Encryption at Rest: OAuth tokens and sensitive data encrypted in database
Password Security: Passwords hashed using bcrypt (never stored in plain text)
Access Controls: Role-based permissions and workspace isolation
Regular Security Audits: Ongoing monitoring and vulnerability assessments
Secure Infrastructure: Hosted on SOC 2 compliant providers

While we implement strong security measures, no system is 100% secure. If you discover a security vulnerability, please report it to support@filter-gate.com.

8. International Data Transfers

Your data may be transferred to and processed in countries outside your residence. We ensure adequate protection through:

Standard Contractual Clauses (SCCs) for EU data transfers
Adequacy decisions where applicable
Compliance with applicable data protection frameworks

9. Children's Privacy

FilterGate is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, contact us immediately at support@filter-gate.com.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a prominent notice in the application. Your continued use after changes constitutes acceptance.

11. Contact & Data Protection Officer

For privacy-related questions, requests, or complaints:

Email: support@filter-gate.com

EU/EEA residents may also lodge a complaint with your local data protection authority.