Security and privacy
Peiley is a Dutch startup, built on European infrastructure. Below we explain honestly what is already in place, what is in progress, and what is not (yet) available.
Where does your data live?
Your polls, responses and account data live inside the EU on Google Cloud / Firebase. Only login (Firebase Authentication) is processed by Google in the US. The database (Firestore) runs in region eur3, a European multi-region across the Netherlands and Belgium. Server logic (Cloud Functions) runs in europe-west1 (Belgium). Hosting (App Hosting) in europe-west4 (Netherlands). Traffic runs over HTTPS (TLS 1.2+) and Google Cloud encrypts stored data (AES-256).
What we do to prevent hacks
Concrete measures — no vague marketing language.
Encrypted connections (HTTPS/TLS)
LiveAll traffic between your browser and Peiley runs over HTTPS. The Firebase platform enforces TLS 1.2+ and manages certificates.
Encryption at rest
LiveGoogle Cloud automatically encrypts all data stored in Firestore (AES-256).
Strict access rules (Firestore Rules)
LiveEvery read and write is server-side enforced. Owners see only their own surveys, contacts, and responses. Admin actions are gated separately.
Keys kept out of the code
LiveAPI keys (Stripe, Resend) are not in the code or the repository. The Stripe keys are in Google Secret Manager; the email key is a setting of the functions on the server.
Stripe webhook signature verification
LiveIncoming Stripe events are cryptographically verified with the signing secret. Replays and tampered events are rejected.
Validation on every backend endpoint
LiveAll Cloud Functions validate input with Zod schemas. Oversized fields, invalid enums, or type mismatches are rejected immediately.
Audit log for admin actions
LiveAdmin grants, plan changes, and cleanup runs are logged in Firestore so they remain auditable after the fact.
Security headers (CSP, HSTS, X-Frame-Options)
LiveEvery page is sent with a Content-Security-Policy, HSTS and clickjacking protection. Only pages meant for embedding may appear in a frame on another site.
Limits against abuse
LiveSending invitations, anonymous responses and system emails have their own daily limits, on top of Firebase's default limits.
Two-factor authentication (MFA)
Not yet availableYou sign in with your email address and password. Signing in with a second step, such as an authenticator app, isn't available yet.
Your rights under GDPR
You stay in control of your own data. Here's how.
Cookie banner with granular choices
LiveOn your first visit you choose for analytics and marketing cookies. Essential cookies (login, security) stay on. Change your mind any time at /privacy/cookies.
Right to access
LiveEmail privacy@peiley.net and you'll receive a full overview of your data within 30 days.
Right to be forgotten (self-service)
LiveDelete your account directly from /dashboard/account → Danger zone. A confirmation modal asks for your email and the word "DELETE". After that your personal surveys with their responses, your contacts, email templates and email log are removed immediately; surveys you made in someone else's team stay with that team. Inactive free accounts are deleted after 12 months, after two warning emails. That clean-up still runs as a trial: the warnings go out, the deleting is still switched off.
Exporting everything at once
Not yet availableA button that downloads all your polls, responses and contacts at once isn't available yet. Per poll you can export the responses as CSV. If you want everything, request it at privacy@peiley.net; you'll get it within 30 days.
Right to rectification
LiveYou change your profile data (name, language, photo) yourself. For other corrections, email privacy@peiley.net.
Sub-processors
Third parties Peiley relies on for parts of its service. All under a Data Processing Agreement (DPA).
| Party | Purpose | Location | DPA |
|---|---|---|---|
| Google Cloud / Firebase | Hosting, database, functions | EU (eur3 multi-region NL + BE; functions europe-west1; hosting europe-west4) | Link |
| Firebase Authentication (Google) | Login (email address, password hash, sign-in times) | US (SCCs) | Link |
| Stripe | Subscriptions and payments | Ireland (EU) + US (SCCs) | Link |
| Resend | Transactional email (welcome, invitations, reminders) | US (SCCs) | Link |
| OpenAI / Anthropic (Bring-Your-Own-Key) | AI survey generation — you use your own API key | US (SCCs) | n/a |
For parties outside the EU, processing happens under the European Commission's Standard Contractual Clauses (SCCs).
How long do we keep what?
- Free account (inactive)
- 12 months, then deletion after 2 warning emails. Still a trial for now: the warnings go out, the deleting is still switched off.
- Paid account
- For as long as the subscription runs. After cancelling you become a free account; the rule above then applies.
- Surveys and responses
- Until you delete them yourself (or close the account)
- Email log (sent invitations)
- Limited to what is needed for delivery and debugging
- Stripe events (idempotency)
- Indefinite — only event id and type, no card data
- Server logs (Cloud Functions)
- 30 days (Firebase default)
What we explicitly do NOT do
- No selling of data to third parties. Period.
- No tracking pixels in transactional emails (welcome, invitations, reminders).
- No Facebook Pixel or LinkedIn Insight Tag — unless you actively turn on marketing cookies.
- No credit card data in our database. Stripe handles payments; we only receive plan status.
- No Peiley staff access to your survey responses, except on explicit support request.
Questions, DPA, or found a leak?
Email privacy@peiley.net for privacy questions or to request a DPA. For security issues (responsible disclosure) reach us at security@peiley.net — we try to respond within one working day.