Privacy Policy

1. Who we are

The controller of your personal data is:

• Service: PartnerStandard Business Case
• Operator: Bernhard Friedrichs, sole proprietor (autónomo) registered in Spain, trading as PartnerStandard
• Address: Cowork Up! Puerta del Mar, C/ Cronista Carreres 10, Bajo, 46003 València, Spain
• VAT (NIF-IVA): ESX7526216H
• Email: hello@partnerstandard.com

We have not appointed a Data Protection Officer. Please send any privacy question to the email address above.

2. What this policy covers

This policy covers personal data we process through:

• the web app at pbs.partnerstandard.com;
• signing in with Google or Notion;
• opening a share link someone sent you;
• creating, reading and editing your work in your Google Drive or in Notion;
• emails you send us for support.

This policy does not cover how Google or Notion process your data in their own products. Their own privacy policies apply to that.

3. How the Service works, in brief

You sign in with a Google or a Notion account. Your work is kept in your own Google Drive, in the folder PartnerStandard / Business Cases, or in your own Notion workspace, under a private page PartnerStandard. Only you work on it in the Service. The only way anybody else sees a case is a share link that you create (section 5).

In Google Drive, the Service keeps one spreadsheet, Business Cases, with the tabs Offer, Products, Partner types, Cases, Costs, Our case and Strategic reasons. In Notion, it keeps a Business Cases database and a Business Case setup page. It holds a standard offer that new cases start from, and your cases. Each case holds its own offer (products, prices, partner types and their terms), its inputs, its cost lines and "our case": your own side of the case (figures such as your gross margin, your own cost lines, your reasons beyond revenue, your strategic reasons, the alternatives and a recommendation). A share link shows the case as it is now. Our case never reaches the person who opens a share link, neither on the page nor on the partner's PDF. It leaves the Service only as a PDF that you download.

When you view or change your work, our servers read or write your files or Notion pages on your behalf. The content passes through our servers but is not saved in our database.

4. Personal data in our database

Our database is hosted in the EU (section 11). It holds:

4.1 Account data

When you sign in, we receive and store:

• your name and email address;
• your Google or Notion account ID;
• the URL of your Google profile picture, if Google provides one (we do not store Notion profile photos);
• whether Google says your email is verified;
• the permissions you granted (see sections 6 and 7);
• the dates your account was created and last updated.

4.2 Connection data

To work with your files, we store the access token and refresh token that Google or Notion issues to the Service. These tokens are encrypted at rest. The encryption key is kept separately from the database. Tokens are never sent to your browser.

4.3 Sign-in sessions

For each sign-in session we store a session token, its expiry date, and the IP address and browser user agent from which you signed in. We use these to keep you signed in and to protect your account.

4.4 Where your work is

We store the ID of your "PartnerStandard / Business Cases" folder and of its spreadsheet or, for Notion, the IDs of your PartnerStandard page, your Business Cases database and its data source, your setup page and its databases, and the ID and name of their workspace, so the Service finds them again without searching.

4.5 Share links

When you share a case, we store the ID of the case, a hash of the link, the date the link was created and, if you turn it off, the date it was turned off. In our database we never store the link itself, only a hash that cannot be turned back into it, so we cannot tell you your link again. Apart from our hosting provider’s short-lived request logs (section 4.6), which record each visit to a share link like any other page, we store nothing about the people who open it: no names, no email addresses and no record of who looked.

4.6 Technical records

Our hosting provider keeps short-lived technical request logs (such as IP address, time and requested page) to run and secure the Service. Our own server logs contain IDs only, never your content, names or email addresses.

4.7 Data we do not collect

• We do not store the content of your work in our database or logs.
• We do not use analytics, advertising or tracking tools.
• We do not use AI or machine-learning services to process your data.
• We do not process payment data. The Service is free.

5. Your content

Your content lives in your Google Drive or Notion workspace. When you use the Service, our servers read it, show it in the app and write changes back. While this happens, the content is held in server memory. It is never written to our database or to logs.

5.1 Share links

You can share one case by link. Anyone who has the link can open that case’s one-page business case, without an account, until you turn the link off. They see the figures, the partner type, the costs and the offer of that case as it is now. They never see our case. They cannot change anything, and they see no other case and no other part of your files. When someone opens the link, our servers read the case from your Google Drive or Notion workspace with your connection and show it. Nothing is saved in our database.

Turning the link off ends it at once: the link no longer shows the case and says it does not work any more. Deleting your account ends all your links. If you share a link with someone, they can pass it on, so share it only with people you trust.

The Service sends no emails.

6. Google user data

6.1 What we access

When you sign in, Google asks you to grant these permissions:

• openid, email, profile: your name, email address, profile picture URL and Google account ID. We use these to create your account and sign you in.
• Google Drive, files used with this app (https://www.googleapis.com/auth/drive.file): access only to files that the Service created. The Service cannot see, list, open or change any other file in your Drive.

With that access, the Service uses the Google Drive API to:

• create a "PartnerStandard / Business Cases" folder and the spreadsheet for your work;
• create, read and update the files the Service keeps there;
• check that its folder and files still exist;
• move a file that the Service itself made to your Drive trash, never deleting it for good.

6.2 How we use it

We use Google user data only to provide and improve the features you see in the Service.

6.3 How we store it

We store your name, email address, profile picture URL, Google account ID, the granted permissions and your encrypted access and refresh tokens (sections 4.1 and 4.2), the IDs of your folder and spreadsheet (section 4.4) and your share links (section 4.5). We do not store the content of your files (section 5).

6.4 How we share it

We do not sell Google user data. We share it only:

• with the service providers in section 10, so they can host the Service and store our records;
• when the law requires it (section 14).

6.5 Limited Use

PartnerStandard Business Case’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• We do not use Google user data for advertising, including retargeting or personalised ads.
• We do not use Google user data to train or improve artificial intelligence or machine-learning models, ours or anyone else’s.
• We do not sell Google user data or pass it to data brokers.
• No person at PartnerStandard reads your Google user data, unless you give us explicit consent for specific data (for example, when you ask for help), it is needed for security reasons (for example, to investigate abuse), it is needed to comply with the law, or the data has been aggregated and anonymised for internal operations.

6.6 How to revoke access

You can remove PartnerStandard’s access at any time on Google’s Third-party connections page. After that, the Service cannot read or write your files until you sign in again. Deleting your account in the Service does not remove this access, because the same Google sign-in is shared with other PartnerStandard tools. To delete the data we store, see section 13.

7. Notion user data

This section applies if you sign in with Notion.

7.1 What we access

When you sign in, Notion asks you to allow PartnerStandard Connector in one of your workspaces, with these capabilities:

• User information with email addresses: your name, email address and Notion user ID, to create your account and sign you in.
• Read, update and insert content: to create PartnerStandard Business Case’s own pages, and to read and update them.

Notion then offers a template provided by PartnerStandard, pre-selected, or lets you select pages. When you connect, Notion can copy a PartnerStandard page from our template into your workspace. The Service keeps your work under a private PartnerStandard page, which it shares with other PartnerStandard tools, and only uses that. If a later sign-in makes a copy you never used, we move that copy to Notion’s trash.

7.2 What the Service does with it

The Service keeps its own pages under a private page PartnerStandard in your workspace: a Business Cases database with one row per case, and a Business Case setup page with the databases Offer settings, Products, Partner types, Costs, Our case and Strategic reasons. Each case's own offer, cost lines and our case are rows in those databases. The Service only:

• creates the PartnerStandard page, the Business Cases database and the Business Case setup page, and the pages your work needs in them;
• when it has no PartnerStandard page on record for you, searches the pages the connection can reach for a PartnerStandard page the connection made (which another PartnerStandard tool may have made) or that Notion copied from our template, and adds its Business Cases database there. The search runs only when the connection’s Notion bot belongs to the person signed in;
• reads and updates the pages it created, and moves rows it made to Notion’s trash when they are no longer needed (for example a row you removed).

Notion lets the Service reach the pages the PartnerStandard Connector created, the PartnerStandard page Notion copied from our template when you connected, and the pages you pick in Notion’s page picker. The Service reads and changes only its PartnerStandard page (the one the connection made, or the copy Notion made from the template) and the pages under it. After a sign-in it may move an unused extra copy of that template page to Notion’s trash. If you share a page with other people in Notion, that sharing is under your control.

7.3 What we store

We store your name, email address, Notion user ID and encrypted access and refresh tokens (sections 4.1 and 4.2), and the IDs of your PartnerStandard page, Business Cases database and setup page with the ID and name of their workspace (section 4.4), and your share links (section 4.5). We do not store the content of your pages (section 5).

7.4 Sharing and revoking

We share Notion user data in the same way and under the same limits as Google user data (sections 6.4 and 6.5). We do not use it for advertising or to train AI models, we do not sell it, and no person reads it except in the cases listed in section 6.5. Notion hosts your workspace under its own terms and privacy policy.

The Service never revokes its access in Notion, not when you sign out and not when you delete your account, because the same Notion connection is shared with other PartnerStandard tools. To remove PartnerStandard Connector’s access to Notion, open Settings → Connections in Notion. This also removes access for the other PartnerStandard tools. After that, the Service cannot reach your pages until you sign in again.

8. Purposes and legal bases

Where we rely on legitimate interests, you can object at any time (section 15).

9. Cookies and browser storage

The Service uses only what is strictly necessary to run it. We do not use analytics, advertising or tracking cookies, so we do not show a cookie banner (Article 22.2 of Spanish Law 34/2002, LSSI-CE).

All cookies are HTTP-only, sent only over secure connections and limited to pbs.partnerstandard.com.

When you sign in, you are taken to Google’s or Notion’s sign-in page. Google and Notion may set their own cookies there under their own policies.

10. Service providers

We use these providers to run the Service. They process personal data on our behalf, under data processing terms with appropriate safeguards.

Google and Notion are not our service providers. They are the sign-in and storage services you choose to connect, and they process your data under your own agreement with them.

11. International transfers

Our database is in the EU, and our server functions run in an EU region. Some providers are US companies and may access data from outside the European Economic Area, for example for support or security. Where this happens, we rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed.

12. How long we keep data

Your files and Notion pages are not ours to keep or delete. They stay in your Google Drive or Notion workspace until you delete them.

13. Deleting your account

You can delete your account in the app’s settings, or by emailing hello@partnerstandard.com. When you delete your account, we delete:

• your account, sign-in sessions and Google or Notion tokens;
• the IDs of your folder and spreadsheet, or of your Notion pages and database;
• your share links, which ends them: nobody can open a case with them any more.

Your files and Notion pages stay in your Google Drive or Notion workspace. They remain yours, and we do not delete them. Delete them there if you want them gone. To end a single share link without deleting your account, turn it off in the app.

Deleting your account does not remove PartnerStandard’s access to your Google or Notion account. To remove it entirely, use Google’s Third-party connections page (section 6.6) or Notion’s Settings → Connections (section 7.4).

14. Disclosure in response to legal process

We may disclose personal data if the law requires it or in response to valid legal process, including:

• court orders or judicial proceedings;
• subpoenas or regulatory investigations;
• requests from law-enforcement authorities;
• legal claims, where disclosure is needed to establish, exercise or defend legal rights.

We check each request for validity and scope. Where the law allows, we tell the affected users before we disclose their data. We disclose only the minimum needed. Because we do not store the content of your work, we usually cannot provide it.

15. Your rights

Under the GDPR you have the right to:

• Access: get a copy of your personal data.
• Rectification: correct inaccurate data.
• Erasure: ask us to delete your data.
• Restriction: limit how we use your data in certain cases.
• Portability: receive your data in a structured, machine-readable format. Your work is already in your own files or Notion pages.
• Object: object to processing based on legitimate interests.
• Withdraw consent: where we rely on consent, at any time.

16. How to exercise your rights

Email us at hello@partnerstandard.com. We may ask you to confirm your identity. We answer verified requests within 30 days.

You can also complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) at aepd.es, or to the data protection authority where you live or work.

17. Security

We protect your data with:

• encryption in transit (HTTPS) for all traffic;
• encryption at rest for Google and Notion tokens, with the key kept apart from the database;
• permission checks on our servers for every read and every change;
• logs that contain IDs only.

No system is perfectly secure. If a personal data breach affects you, we will tell you and the supervisory authority as the GDPR requires.

18. Children

The Service is a business tool. It is not meant for anyone under 18, and we do not knowingly collect children’s data.

19. Changes to this policy

We may update this policy. We will announce material changes in the Service. The effective date at the top shows the latest version.

20. Contact

• Email: hello@partnerstandard.com
• Mail: Bernhard Friedrichs, Cowork Up! Puerta del Mar, C/ Cronista Carreres 10, Bajo, 46003 València, Spain