Privacy Policy
Last updated: October 12, 2026
Perdura ("we", "us", "our") operates the Perdura chess opening preparation tool ("the Service"). This policy explains what data we collect, why, and how we handle it.
1. Data Controller
The data controller responsible for your personal data is Perdura. For questions or requests, contact us at hello@perdura.app.
2. What We Collect
Data you provide
- Email address: used for authentication (magic link login), essential service communications (payment confirmations, security alerts) and occasional news about Perdura, which you can turn off at any time (see "Product news emails" below).
Data collected automatically
- Usage data — pages visited, searches performed, features used. Collected via PostHog analytics. Used to improve the Service. No personally identifiable information is shared with third parties.
- IP address — logged in server access logs and used for rate limiting. Not stored long-term or used for tracking.
- Cookies — we use a single HTTP-only authentication cookie to keep you signed in. No advertising or tracking cookies are used.
Data we do NOT collect
- We do not collect passwords (the Service uses passwordless authentication).
- We do not store payment card details. All payment processing is handled by Stripe, who acts as an independent data controller for payment data.
3. Why We Process Your Data
| Purpose | Legal basis (GDPR) |
|---|---|
| Account authentication | Contract performance (Art. 6(1)(b)) |
| Payment processing | Contract performance (Art. 6(1)(b)) |
| Product news emails to registered users | Legitimate interest (Art. 6(1)(f)); Art. 21.2 LSSI |
| Service improvement analytics | Legitimate interest (Art. 6(1)(f)) |
| Rate limiting / abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
Product news emails
If you have an account, we occasionally email you news about Perdura and the weekly chess problem. We do this on the basis of our legitimate interest (Art. 6(1)(f) GDPR) and, because you are already a user and the emails are about our own similar products, Art. 21.2 of the Spanish LSSI (Ley 34/2002).
You can stop them at any time, free of charge: use the unsubscribe link at the bottom of every such email, or turn off "Receive product news by email" in your profile. It takes effect immediately. You can also object to this processing at any time (see Your Rights below). Sign-in and payment emails are not affected.
4. Who We Share Data With
- Stripe — payment processing. Stripe receives your email and payment details. See Stripe's Privacy Policy.
- PostHog — product analytics. Receives anonymized usage events. See PostHog's Privacy Policy.
- Email service provider: delivers magic link, transactional and product news emails. Receives your email address only.
We do not sell, rent, or trade your personal data. We do not share data with advertising networks.
5. Data Retention
- Account data — retained while your account is active. Deleted within 30 days of account deletion request.
- Payment records — retained for up to 7 years as required by applicable tax law.
- Server logs — rotated and deleted after 90 days.
- Analytics data — anonymized, retained for up to 24 months.
6. Your Rights (GDPR)
If you are in the European Economic Area, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — correct inaccurate data.
- Erasure — request deletion of your data ("right to be forgotten").
- Portability — receive your data in a machine-readable format.
- Restriction — limit how we process your data.
- Object — object to processing based on legitimate interest.
- Withdraw consent — where processing is based on consent, withdraw it at any time.
To exercise any of these rights, email hello@perdura.app. We will respond within 30 days.
You also have the right to lodge a complaint with your local data protection authority.
7. International Transfers
Your data may be processed outside the EEA by our service providers (Stripe, PostHog). These transfers are protected by Standard Contractual Clauses (SCCs) or equivalent safeguards as required by GDPR.
8. Security
We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS), HTTP-only secure cookies, and hashed tokens. No system is 100% secure — if you discover a vulnerability, please report it to hello@perdura.app.
9. Children
The Service is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
10. Changes
We may update this policy from time to time. Material changes will be communicated via email or a notice within the Service. The "last updated" date at the top reflects the most recent revision.
11. Contact
Questions or requests about your data? Contact us at hello@perdura.app.