Legal
Privacy Policy
Last updated 7 November 2026
WorksOnMyMachine ([LEGAL ENTITY], business ID [VAT/BUSINESS ID], [REGISTERED ADDRESS], Finland) operates PriceDrift. This policy explains what personal data we collect, why, who processes it for us, and what you can ask us to do with it. We are the controller for that data.
1. What we collect
| Data | When | Why |
|---|---|---|
| Email address | When you subscribe to alerts or create an account | To send the alerts you asked for, to confirm you own the address, and to contact you about your account |
| Watchlist — the models and providers you follow | When you choose them | To decide which changes are relevant to you |
| Account data — password hash, confirmation state, session, organisation name | When you register | To keep you signed in and to know which plan applies |
| Billing identifiers — customer and subscription ids, plan, renewal date | When you subscribe to a paid plan (via Creem) | To run your subscription. We never receive or store card details |
| API key metadata — a name, the key’s first characters, last use, request counts | When you create or use an API key | To authenticate requests, meter usage and let you revoke a leaked key |
| Technical logs — IP address, user agent, request path, timestamps, error details | Automatically, on every request | To keep the service secure and working, and to diagnose faults |
| Messages you send us | When you email us | To answer you |
We do not ask for your name, address or phone number, and we do not buy data about you from brokers. We do not use the Service to build advertising profiles.
2. What we do not do
- No advertising or cross-site tracking cookies. The only cookie we set is the session cookie that keeps a signed-in user signed in. The public site works without it.
- No third-party analytics that fingerprint you. When we measure traffic it is from our own server logs, in aggregate.
- No selling or renting personal data. Ever.
- No training models on your data. We do not train AI models on subscriber data, and we do not pass your addresses to model providers.
3. Legal bases
- Contract — sending the alerts you subscribed to, running your account, and providing a paid plan;
- Consent — marketing or product emails beyond your own alerts. You can withdraw it at any time, and every alert carries a one-click unsubscribe link;
- Legitimate interest — keeping the service secure, preventing abuse and fraud, and understanding at an aggregate level how the site is used;
- Legal obligation — accounting, tax and responding to lawful requests.
4. Who processes data for us
We use a small number of processors, each bound by a data-processing agreement:
- Creem — merchant of record for payments, invoices and tax. Creem handles the payment relationship and is a controller for the payment data it is required to keep.
- Mailpace — the SMTP relay that delivers alert and account email. It processes the recipient address and message contents for delivery.
- Our hosting provider — the servers and managed database where the Service runs, including backups if enabled.
We do not share personal data with model providers, advertisers or data brokers. We may disclose data where we are legally required to, or to establish or defend a legal claim.
5. Where data lives and how long we keep it
The Service and its database are hosted in the EU. Email is delivered through the relay above, and payment data is held by Creem in accordance with its own policy.
- Alert subscriptions are kept while the address is subscribed and for a short period afterwards, so an unsubscribe is respected rather than forgotten. A suppressed address stays on our do-not-mail list so we cannot accidentally mail it again.
- Account data is kept while the account exists, and deleted (or anonymised where accounting law requires retention) after an account is closed.
- Email logs — the record of what was sent to an account — are kept so you can see your own alert history, and for deliverability troubleshooting.
- Server logs are kept for a short operational window, then rotated away.
- Invoices and tax records are kept for the period required by Finnish accounting law.
6. Your rights
Under the GDPR you can ask us to:
- confirm what personal data we hold about you and give you a copy;
- correct data that is wrong;
- delete data (subject to records we must keep by law, such as invoices);
- restrict or object to processing based on legitimate interest;
- withdraw consent for optional email;
- port data you gave us in a machine-readable format.
Email [PRIVACY EMAIL] and we will respond within 30 days. You can also complain to your local supervisory authority; in Finland that is the Office of the Data Protection Ombudsman (tietosuoja.fi).
7. Security
Passwords are stored as salted hashes, connections are encrypted with TLS, access to production data is limited to the operator, and API keys are stored only as hashes. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the GDPR requires.
8. Children
The Service is for businesses and professionals and is not intended for anyone under 18.
9. Changes to this policy
If we change how we handle personal data, we update this page and, for material changes, email account holders before the change takes effect.
10. Contact
Data protection questions: [PRIVACY EMAIL]. Postal address: [REGISTERED ADDRESS], Finland.