Privacy Policy

1. Who operates MPT

My Productivity Tools is operated by WEB3MEET IKE, which is the data controller for the processing described in this policy. WEB3MEET IKE is established in Greece. Postal address: Moutsopoulou 43, Piraeus, Greece. For privacy questions or requests, contact privacy@myproductivitytools.app.

2. Google data we access

Google sign-in. MPT requests openid, email, and profile to receive your Google account identifier, email address and basic profile information, and verify your access to MPT. Signing in with Google does not grant access to Gmail messages or Drive files. Those connections request separate permission when you choose to connect them.

Gmail send-only. After separate consent, MPT requests openid, email, and gmail.send. MPT verifies the configured sending identity, stores the refresh credential in encrypted form, and uses the grant for configured MPT-generated agent authentication alerts, explicitly requested delivery tests, requested one-time sign-in emails to eligible users, and owner-approved Finance package delivery links to the configured accountant. When website enquiries are enabled by the owner, the same send-only grant delivers submitted enquiry details to info@myproductivitytools.app, with the visitor’s validated email as Reply-To. Service emails use MPT’s configured sending account; receiving one or submitting an enquiry does not connect your Gmail account. This access does not let MPT read, modify, label, archive, or delete Gmail messages.

Finance Gmail. After separate consent, Finance requests openid, email, and gmail.readonly. This permission provides read-only mailbox access. MPT uses it to find and review Finance documents in the separately connected mailbox, using the configured retrieval period and processing rules. MPT reads message headers and attachment information, downloads documents for Finance review, and can display the source message body when you open it. Processing rules control how MPT handles the results; they do not narrow Google’s mailbox permission.

MPT stores imported documents privately, together with their source and review records. The Finance review queue also keeps message and attachment metadata, including sender, subject, dates, filenames and processing outcomes, for processed items, including items filtered out by a rule. A document may be retained for review before its relevance is confirmed. This connection does not send, modify, label, archive, or delete Gmail messages. Finance decisions and approvals remain in the separate Finance workflow.

Finance Drive. Finance requests only drive.file. MPT verifies the configured Google identity and uses app-created folders to file documents you approve and upload owner-approved Finance packages. MPT keeps file references and verification records to prevent duplicate uploads and check the result. The drive.file permission covers files created by MPT or explicitly selected for the app; it does not grant general access to unrelated files in your Drive.

Optional document extraction. When document extraction is enabled for Finance, eligible uploaded or retrieved images and PDFs can be processed automatically; you can also request an extraction again. MPT sends the document to OpenAI through MPT’s private processing infrastructure and stores the extraction result with the document. The result helps prepare information for review and configured classification or routing. Extraction does not itself approve, publish, or send anything. Google sign-in does not start document extraction.

3. Why we use Google data

MPT uses Google account data only to authenticate and authorize access; verify the configured Gmail or Drive identity; deliver the service emails described above; retrieve and review Finance documents; retain their source and processing records; prepare document extractions when enabled; file approved documents and upload approved packages to Drive; prevent duplicate operations; and verify their results. Connecting a Google account does not itself approve Finance records or start a document upload.

Sign-in emails. If you request a one-time sign-in email, we use your email address to send a code and link and to check your eligibility for that sign-in method. We keep request, verification and delivery records to secure sign-in and prevent repeated sends. Codes and links expire after ten minutes and can be used once; their expiry does not itself delete the request and delivery records.

Website enquiries. We use your name, work email, company, and any job role or notes you provide to respond and discuss your requested tools or services. Processing supports the steps you request before a possible agreement. Submitting an enquiry does not subscribe you to marketing or commit you to a purchase. Please avoid including sensitive personal information in your notes.

Your details are sent through our authorized Google sending account to info@myproductivitytools.app. We keep delivery references, timestamps and a keyed fingerprint to prevent duplicate sends; application receipt records and logs do not contain the form contents. The form keeps your details in memory during the visit, without saving them to browser storage. Closing the page does not delete email correspondence already sent.

4. Google API Services User Data Policy and Limited Use

My Productivity Tools’ use and transfer to any other app of information received from Google APIs will comply with the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is used only to provide the user-facing features described in this policy. MPT does not sell Google user data, use it for advertising, or share it for independent advertising or data-broker purposes. MPT does not use customer data to train general-purpose AI models. MPT personnel may read Google user data only with your affirmative agreement to view specific messages, files or other data, when necessary for security or to comply with law, or when the data is aggregated for internal operations in accordance with applicable privacy requirements.

5. How data is stored and protected

Google OAuth and refresh credentials are encrypted at rest. MPT-held finance evidence, database data, object storage, and backups use encrypted storage. Access to personal information and Google user data is limited to authorized MPT services and people under the access limits described above. Imported finance evidence is protected from ordinary alteration during its applicable retention period.

6. Sharing and service providers

MPT uses the following providers and processor categories:

• Google for Sign-In, Gmail, and Drive.
• Cloud and network delivery and security infrastructure, including Cloudflare.
• Private application hosting, PostgreSQL and database services, encrypted object storage, and encrypted backups.
• OpenAI model processing reached through MPT’s private processing infrastructure when optional document extraction is used.
• Operational monitoring, security, and user-authorized technical support.

Providers may process data only as needed to deliver their services to MPT. Some providers may process data outside the EEA. Where required, MPT uses legally recognized transfer safeguards.

7. Retention and deletion

Basic account and profile data — kept while the account is active, then deleted or anonymized within 30 days after an eligible verified deletion request or account closure, except where preservation is legally required.

Google OAuth and refresh credentials — kept only while the connection is active and deleted from active systems within 30 days after disconnect, revocation, or a verified eligible request.

Connection and security logs — normally kept for up to 30 days, and longer only when needed for a security investigation or legal obligation.

Finance evidence and records — finance evidence, derived accounting records, and owner-approved package records are kept for five years after the end of the relevant financial year. They are kept longer only when required by law, audit, dispute, or legal hold. At expiry, eligible personal data is deleted or irreversibly anonymized.

Finance review history — documents awaiting review and message, attachment and filing records are retained as needed to support review history and prevent repeated processing. Filtering an item or disconnecting Google does not delete these records. You can request deletion of eligible MPT-held data under the deletion process below; financial evidence that must be preserved follows the Finance schedule.

Gmail messages and Drive files — MPT does not store Gmail inbox contents through the send-only connection. MPT-generated alert, delivery-test, sign-in, website-enquiry and Finance-delivery emails remain in the sending and recipient accounts under those users’ email controls. Finance documents and processing metadata follow the Finance evidence and review-history provisions above, including filtered items. Google Drive files remain in the connected Drive until the authorized Drive user deletes them; MPT-held copies follow the finance-evidence schedule.

Website enquiry correspondence — kept while needed to handle your request, maintain the resulting business relationship, or meet a legal obligation. You may request deletion through privacy@myproductivitytools.app. Minimal delivery references and keyed fingerprints have no automatic expiry so that previously sent or uncertain submissions cannot be sent again through receipt cleanup; they contain no recoverable form text.

Deletion requests and backups — active-system deletion is completed within 30 days after identity verification unless a lawful extension or preservation exception applies. MPT explains any exception and restricts preserved data to the required purpose. Residual copies in encrypted backups are isolated from ordinary use, expire under the controlled backup rotation, and the deletion is reapplied if a backup is restored.

8. Your controls and Google access

You can review or revoke MPT’s Google access from your Google Account at any time. After revocation, features that rely on Google APIs stop working until access is granted again. OAuth and refresh credentials are deleted from active systems under the schedule above. To request deletion of MPT-held data, contact privacy@myproductivitytools.app.

9. Privacy rights and contact

As a controller established in Greece and the EEA, WEB3MEET IKE provides the rights to request access, correction, deletion, restriction, portability, or objection, and to withdraw consent at any time. You also have the right to complain to the Hellenic Data Protection Authority. Send privacy requests to privacy@myproductivitytools.app. MPT responds within one month, subject to a lawful extension with notice.

10. Changes and effective date

This policy is effective 1 September 2026. Material changes are posted at https://myproductivitytools.app/privacy and, where appropriate, notified in-app or by email before they take effect.