Who we are (data controller)
Dashlee is a personal dashboard for Google users. This privacy policy explains how we handle your personal data when you use the public site at www.dashlee.app and the application at www.dashlee.app/user.
The data controller is Mirko Montecchiani. You can find out more at mirkomontecchiani.com, or contact us at any time by email at mirkomontecchiani@gmail.com.
We aim to be honest and clear about what we do with your data. In short: the content that lives in your Google account stays in Google and is only read on demand, while the extras you create inside Dashlee are stored by us so that we can give them back to you.
What we access via Google and why
You sign in to Dashlee with Google (Google OAuth). When you sign in, we ask your permission for the following scopes, each of which is used only to make the dashboard work:
- Gmail (read, plus modify labels and stars) — so we can show your starred emails and let you manage labels and stars from within Dashlee.
- Google Tasks (read and write) — so you can view, create, order and update your tasks.
- Google Calendar (read-only) — so we can display your upcoming events.
- Google Drive (read-only) — so we can display your starred Drive files.
- Basic profile (email, name, picture) — to identify your account and personalise your dashboard.
Your Google content — tasks, calendar events, starred emails and Drive files — is read live from Google on demand, using your token, at the moment you view it. This content is not copied to or retained on Dashlee's servers; it stays in your Google account. You can review or withdraw these permissions at any time from your Google Account settings.
What we store on our servers
Dashlee stores in its own database the extras you create inside the app, so that they are there when you return. These are:
- sticky post-it notes;
- quick links and bookmarks;
- task labels;
- task ordering and positions;
- custom boards;
- task templates;
- list colours;
- shared-list settings.
In addition, we store your account email, your licence (type, status and expiry) and your order history. This information is what we need to run your account, manage your subscription and provide support.
Payments
You can pay by card through Stripe or via PayPal. Your card details are handled entirely by Stripe or PayPal and are never stored by Dashlee.
We store only the order record: the plan, the amount, the payment gateway reference and the status, together with the resulting licence. Dashlee also offers a 15-day free trial, for which no card is required.
Legal bases for processing
We process your personal data on the following legal bases under the GDPR:
- Performance of a contract — to provide the dashboard, access your Google content on your behalf, store the extras you create, and manage your account, licence and orders.
- Consent — for the Google permissions (scopes) you grant when you sign in, which you may withdraw at any time.
- Legitimate interests — to keep the service secure (for example, CSRF protection) and to operate and improve it, balanced against your rights.
- Legal obligation — to keep records such as order and payment information where the law requires it.
Data retention
We keep the extras you create and your account email for as long as your account is active. If you close your account or ask us to erase your data, we delete these from our database, subject to any records we must keep by law.
Licence and order records are retained for as long as needed to manage your subscription and to meet our legal and accounting obligations. Your Google content is not retained by us at all — it is read live and never stored, so there is nothing on our side to delete.
Third parties and international transfers
We share personal data only with the third parties needed to run the service:
- Google — for authentication and the APIs described above.
- Stripe and PayPal — for processing payments.
- Our hosting provider — which hosts the Dashlee application and database.
We do not sell your personal data. Some of these providers may process data outside the European Union. Where that happens, the transfer is protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- rectify data that is inaccurate or incomplete;
- erase your data (“the right to be forgotten”);
- data portability — to receive your data in a portable format;
- object to or restrict certain processing;
- withdraw any consent you have given, at any time;
- lodge a complaint with a supervisory authority.
To exercise any of these rights, email us at mirkomontecchiani@gmail.com. If you are in the EU or EEA, you also have the right to complain to your local data protection authority. You can withdraw Dashlee's Google permissions directly from your Google Account settings.
Children
Dashlee is not intended for children. The service is designed for adult Google users, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
Changes to this policy
We may update this privacy policy from time to time, for example to reflect changes to the service or to legal requirements. When we make material changes, we will update the date shown on this page and, where appropriate, let you know. Please review this page from time to time to stay informed.
Contact
If you have any questions about this privacy policy or about how we handle your data, please contact the data controller, Mirko Montecchiani:
- Email: mirkomontecchiani@gmail.com
- Website: mirkomontecchiani.com
We will always do our best to answer promptly and to put things right.