Privacy Policy

This policy explains what personal data Malpera (malpera.com) collects, why, who receives it and what your rights are. Malpera is a tool that builds websites and web apps with AI and hosts them. The data controller is Ferhat Çaldıra, Norway. Contact: malpera33@gmail.com. We follow the EU/EEA General Data Protection Regulation (GDPR) and Norwegian law.

Two different roles. If you have a Malpera account and build things with it, we are the controller of your data and this policy applies to you directly. If you are a user or visitor of a website or app that someone else built with Malpera, that app’s owner decides what is collected and why (they are the controller) and Malpera only stores and processes the data for them; ask the app’s owner first, and see section 3.

1. Data we collect about Malpera account holders

• Account: your e-mail address; your name (from Google if you sign in with Google, otherwise derived from your e-mail address); how and when you sign in; your language preference; your plan, credit balance and a history of how credits were used.
• Sign-in codes: if you sign in by e-mail we send a six-digit code and keep only a one-way hash of it, for 10 minutes. Malpera accounts have no password.
• Your projects: the descriptions, chat messages and plans you write; images you upload; the source code, pages and files generated for you; version history; publishing settings and, if you add one, your own domain name and a contact e-mail for the project. Images you attach “for reference only” are sent to the AI model for that request and are not stored with the project.
• Keys you add: if you give a project an API key for an outside service (for example your own AI key), it is stored encrypted and is never shown again or sent to browsers.
• Payments to Malpera: your plan, subscription status, billing dates, purchase and refund history, and the customer and subscription identifiers Stripe gives us. Card details are entered on Stripe’s pages and never reach us.
• Team members: the e-mail addresses you invite to work on a project with you.
• Technical logs: for security, abuse prevention and troubleshooting. Our web server’s access log holds the IP address, request path, time and response status (no cookies or request contents; sign-in and preview tokens in addresses are masked) and is deleted after 30 days. Application logs and records hold your account ID, the time and errors but no IP address and no e-mail address; they are kept for up to 30 days or are limited in size. A record of publishing, domain and project-deletion actions (account ID, time and what changed — no e-mail address) is kept for as long as your account exists, limited in size.
• Product usage events: to see where people get stuck and to improve Malpera, we record which steps you reach in the app (for example: account created, project created, request sent, result ready, a change made, a window opened, published, came back the next day), with the time, your account ID, your plan and short status codes. These events never contain what you write, your e-mail address, your IP address, keys or file contents, and no cookie is used for them. Only Malpera’s administrators can see them. They are kept for 13 months and are deleted when your account is deleted.
• Sign-up protection: to limit abuse of free accounts we count new accounts per day per connection and per browser. For this we keep a one-way hash of the IP address (not the address itself) and a random browser identifier, for the current day only; we do not link them to your other data or use them for anything else.

2. Signing in with Google

You can sign in to Malpera with “Continue with Google”. We ask Google only for the basic sign-in permissions (openid, email, profile).

• What we receive: your e-mail address, your name and whether Google has verified the address. We do not receive your Google password, and we get no access to Gmail, contacts, Drive, calendar or any other Google data.
• What we store: your e-mail address and name, and the fact that you signed in with Google. We do not store your profile picture, and we do not keep Google access tokens: the one-time token is used during sign-in and then discarded.
• What we use it for: only to create your account, sign you in, show your name in the app and send you service e-mails (for example receipts or security notices).
• What we do not do: we do not sell Google user data, use it for advertising, use it to train AI models, or share it with anyone except the service providers in section 5 that are needed to run Malpera.
• “Continue with Google” inside an app built with Malpera: Malpera operates this sign-in on behalf of the app, which is why Google’s screen shows the name Malpera. We receive the same e-mail address and name and use them only to create or open your account in that one app. The app’s owner can see them like any other registration. Accounts in different apps are separate, even with the same Google account.
• Removing access and deleting: you can remove Malpera from your Google account at any time at myaccount.google.com/permissions. Deleting your Malpera account (section 7) deletes the data we received from Google.

Malpera’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Data in the websites and apps you build (we act as your processor)

• Your app’s users: if your app has accounts, we store for each user their e-mail address, name, sign-in times and how they signed in (password or Google). Passwords are stored only as salted hashes by the database’s sign-in service; neither you nor we can read them.
• Your app’s content: whatever your users and visitors enter (form messages, bookings, listings, orders, uploaded files and so on) is stored in a database and file storage that Malpera runs for your app, separated from every other app. If you connected your own Supabase account instead, the data is stored in your Supabase project under your own agreement with Supabase.
• E-mails your app sends: account e-mails (confirmation, password reset) and notifications are delivered through our e-mail provider. We keep a delivery log (time, template, status, masked recipient).
• AI features in your app: the text a user enters into such a feature, and a file the user gives it to read (for example a photo, a receipt or a PDF document), is sent to an AI provider to produce the answer (section 5). A file is read only with the rights of the person who asks, so a user cannot have another user's private file analysed. We do not store these texts or files beyond what your app itself saves.
• Notifications your app receives (webhooks): when an outside service you connect (for example a form or booking tool) sends your app a notification, we check that it really comes from that service, keep its content encrypted until your app has processed it, and keep a log entry without the content (time, type, status) for 7 days.
• Payments in your app: if you turn on payments, your customers pay through Stripe on your own Stripe account. We store the payment or subscription status, amount, currency and Stripe identifiers so the app can show what was bought; card details never reach us or you.
• Outside services you connect: if you connect a service with your own key (for example OpenAI, Google Gemini, Resend, Google Maps, Slack or Discord), the data your app sends to it — such as the text a user submits or a notification message — goes to that service under your own account and its terms. Your keys are stored encrypted, are only sent to the service they belong to and never reach the browser. We keep a daily count of calls, errors and an estimated cost per service, and the last error message, so you can see what your app uses.
• Activity logs and usage: technical logs of your app’s server functions (time, result, errors) and daily usage counts, limited in size.
• Visit statistics for published apps: a small script in the published page reports each page view to the app’s own address. We keep only daily totals: visitors, visits, page views, pages, the referring website or campaign (for example “Google” or “Instagram”), device type (phone, tablet or computer) and browser language, plus results such as form submissions and sales. To count a visitor only once per day, the IP address and browser description are mixed with a secret key that changes every day and is then deleted; neither the IP address, the browser description nor this mix is kept after that day, and no cookies or other identifiers are placed in the visitor’s browser. Visitors whose browser sends “do not track” (Global Privacy Control or Do Not Track) and automated browsers are not counted, nor are the app’s owner and team. Because nothing identifies a visitor, these statistics normally do not require a cookie banner.

For this data you are the controller: you decide what your app collects and you are responsible for telling your users (for example in your own privacy notice) and for answering their requests. We process it only to run your app, keep it secure and follow your instructions through the product.

4. Cookies and local storage

We use one session cookie to keep you signed in (30 days), short-lived cookies (10 minutes) while you sign in with Google or connect a Supabase account, and one browser identifier cookie (a random value, 1 year) used only to limit how many new accounts are created from the same browser. Your browser’s local storage remembers preferences such as language and the last request you typed before signing in. In apps built with Malpera, the signed-in user’s session is kept in that user’s browser storage. We do not use advertising or analytics cookies and we do not track you across other websites.

5. Why we process data (legal bases)

• To provide the service you asked for — sign-in, building and hosting your projects, running your apps, delivering e-mails, managing your plan and payments (performance of a contract).
• To keep the service secure, prevent abuse, measure usage and fix problems (legitimate interest).
• To send service e-mails such as sign-in codes and receipts (contract). We do not send marketing e-mails without your consent.
• To comply with legal obligations such as bookkeeping.

6. Who receives data (service providers and third parties)

• AI providers: Anthropic (Claude) and Google (Gemini). Your descriptions, chat messages, images and the current project files are sent to them to build and edit your project. They process this data on our behalf under their API terms and do not use it to train their models under those terms. If an app built with Malpera has an AI feature that runs on Malpera’s built-in AI, the text its users enter into that feature is sent to Google (Gemini) in the same way; if the app’s owner uses their own AI key, it is sent to the provider the owner chose, under the owner’s account.
• Hosting: Hetzner Online GmbH (servers in the EU — Finland/Germany). Malpera, your projects and daily backups are stored there.
• Database and file storage for apps: Supabase, Inc., in an EU region (Frankfurt, Germany). The accounts, data and files of apps built with Malpera are stored there, and an encrypted copy of our backups is kept there. If you connect your own Supabase account, we use Supabase’s management interface on your behalf and the data lives in your project.
• Payments: Stripe (Stripe Payments Europe Ltd. and its affiliates). For Malpera plans bought through Stripe Managed Payments, Stripe is the merchant of record and handles your payment details as an independent controller under its own privacy policy. For payments inside your apps, Stripe opens and verifies your own account and collects your identity and bank details directly; we do not see them.
• E-mail: Resend, Inc. delivers sign-in codes, service e-mails and the e-mails your apps send.
• Google: if you or your app’s users choose “Continue with Google” (section 2).
• Stock photos: Pexels and Openverse are queried with search keywords only; no personal data is sent.
• Small helpers loaded by your browser: the QR code on the “share” card is drawn by a QR service (goqr.me) that receives only the public address of your published app; design previews load a styling library from a public content network; maps in apps built with Malpera load map images from OpenStreetMap (or from Google, if the app's owner chose Google Maps). These services see your IP address like any website you visit and receive no account data. If our sign-up protection asks for a short automated check, it is provided by Cloudflare Turnstile, which processes technical browser signals for that check.

Some providers are in the United States or are US companies. Transfers rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. We do not sell personal data, and we share it with authorities only when the law requires it.

7. How long we keep data, and how to delete it

• Projects: kept until you delete them. Deleting a project in Malpera removes its files, history and published copy and, for apps on Malpera’s managed database, the app’s database, files and user accounts. If the app runs in your own Supabase account, delete that project in your Supabase dashboard.
• Your account: kept until you ask us to delete it. Write to malpera33@gmail.com from the account’s e-mail address; we delete the account, its projects and its apps within 30 days.
• Users of an app built with Malpera: ask the app’s owner to delete your account and data. If you cannot reach them, write to us and we will pass the request on and help where we can.
• Backups: deleted data disappears from backups within 14 days.
• Sign-in codes: 10 minutes. Web server access log (with IP addresses): 30 days. Application logs and records: up to 30 days or limited in size. Product usage events: 13 months. Visit statistics of published apps: daily totals for 13 months; the daily key and that day’s mixes are deleted when the day ends (they are not included in backups). App activity and e-mail logs: limited in size, the oldest entries are overwritten, and they are deleted with the project.
• Payment and invoice records: as long as bookkeeping law requires (currently five years in Norway), even if you delete your account.

8. Your rights

You can ask us to access, correct, export or delete your personal data, to restrict or object to processing, and you can withdraw consent at any time. You can download your project’s files from the app yourself. Write to malpera33@gmail.com; we answer within 30 days. You may also complain to the Norwegian Data Protection Authority (Datatilsynet) or the authority in your country.

9. Security

Data is encrypted in transit (HTTPS). Malpera sessions use signed cookies and there are no Malpera passwords to leak; passwords of app users are stored only as salted hashes. Access tokens and keys are encrypted at rest (AES-256-GCM). Each app’s data is separated by access rules in the database; an app’s secret keys are never sent to browsers; the server-side code of apps runs in an isolated process without access to keys; and apps are only published after an automatic check of their access rules. Backups stored outside our server are encrypted. Access to servers is limited to the operator. No system is perfectly secure; if a breach affects you we will inform you and the authorities as the law requires.

10. Children

Malpera is not directed at children under 16. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes

We will post updates here and, for material changes, notify you in the app or by e-mail.

12. Contact

Ferhat Çaldıra, Norway — malpera33@gmail.com.