Privacy policy
1. Data controller
The data controller is the publisher of MaxLabs, a private individual running a non-commercial website (see the legal notice). Contact: admin@maxlabs.uno.
2. Data processed
| Category | Data | Purpose | Legal basis |
|---|---|---|---|
| Account | Username, display name, email address, password (bcrypt hash, never readable), language, sign-up and last sign-in dates | Creating and managing the account | Performance of contract |
| Sign-in | Session (2 h of inactivity), one-time code (10 min), trusted devices: token fingerprint, browser, dates (30 days) | Authentication and security | Legitimate interest (security) |
| Security log | Event type (sign-in, failure, password change, application opened…), date, application concerned, full IP address for 30 days then truncated (e.g. 203.0.113.0), browser summary (e.g. “Firefox · Windows”), approximate country and city derived from the IP | Detect suspicious access, alert you, show it in “My account”; aggregated sign-in statistics for the administrator | Legitimate interest (account and service security) |
| Security alerts | Email address, date, device and approximate location of the sign-in concerned | Warn you of a sign-in from a new device or an unusual country, or of repeated attempts | Legitimate interest (security) |
| Anti-abuse | Non-reversible fingerprints (HMAC) of the IP and of the identifier typed | Limit brute force, sign-up and email spam | Legitimate interest (security) |
| Audience measurement | Page viewed, day, site, referring site (domain only), device type, browser and system summary, country; unique visitor estimated by a non-reversible fingerprint recomputed every day. No cookie, no IP address and no account stored | Anonymous traffic statistics | Legitimate interest; measurement exempt from consent (CNIL), objection possible |
| Technical errors | Cleaned error message (no email, typed value or identifier), page, browser summary, number of occurrences; no account | Fix malfunctions | Legitimate interest (proper operation) |
| Access | Role, access lists and per-application blocks | Access control | Performance of contract |
| Preferences | Favourite applications, recently opened applications, theme (in the browser) | Ease of use | Performance of contract |
| Linked applications | Data entered in Shiftr, Athleon, CarTracker, Annette, the games… | Providing each application | Performance of contract |
3. Cookies and local storage
Only trackers that are strictly necessary for the service, which need no prior consent:
MAXLABS_SESSION— secure session cookie (HttpOnly, Secure), shared on*.maxlabs.unoto move between applications; expires after 2 h of inactivity;ml_device— set only if you choose to stay signed in; 30 days; limited to maxlabs.uno;ml_noaudience— set only if you object to audience measurement; 13 months;- browser local storage: light/dark theme, dismissal of the information banner.
No advertising or audience-measurement cookies: traffic is counted without cookies and anonymously (see above), in line with the CNIL exemption conditions. Your browser’s “Do Not Track” and “Global Privacy Control” signals are honoured: you are then not counted. Fonts are hosted on maxlabs.uno: no request is sent to a third party such as Google Fonts.
This browser is counted (anonymously).
4. Retention
- Account: while active; immediate deletion from “My account”, linked applications’ data erased within 30 days.
- Never-confirmed account: deleted after 7 days.
- Session: 2 h of inactivity. Sign-in code: 10 min. Email confirmation link: 24 h. Reset link: 1 h, erased after 24 h.
- Trusted devices: 30 days after last use.
- Security log: 180 days; full IP address: 30 days, truncated afterwards. Anti-abuse traces: 24 h.
- Audience measurement: detail for 13 months, then only daily totals with no personal data; visitor fingerprint unusable from the next day (its daily key is destroyed).
- Technical errors: 90 days after their last occurrence.
- Host’s technical logs: 12 months at most.
- Shiftr schedules: 3 years after creation.
5. Recipients
Data is neither sold nor transferred. Access is limited to the MaxLabs administrator (account and access management) and the host Hostinger (servers located in the European Union), strictly for hosting purposes.
The approximate location (country, city) is computed on our servers with the free DB-IP Lite database: no IP address is sent to a third party.
6. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection (GDPR, articles 15 to 21). From My account you can edit your information, download your data (JSON) and delete your account, view your security log and report a sign-in you do not recognise (“This wasn’t me”). You can object to audience measurement below (section 3) or from “My account”. For any other request: admin@maxlabs.uno (answer within one month).
You may also lodge a complaint with the French data protection authority, the CNIL: www.cnil.fr.
7. Security
- HTTPS encryption across the platform;
- hashed passwords (bcrypt) and strength rules;
- email code on every sign-in from an unknown device;
- rate limits on sign-in attempts, sign-ups and emails sent;
- only a fingerprint of tokens (devices, email links) is stored;
- HttpOnly, Secure, SameSite cookies; content security policy (CSP);
- sessions closed and devices forgotten on every password change, with an email notice;
- email alert on a sign-in from a new device or an unusual country, and after repeated attempts;
- security log available in “My account”, with “This wasn’t me” to close every session.
8. Transfers outside the EU
No personal data is transferred outside the European Economic Area in the normal course of the service.
9. Changes
This policy may be updated; the date is shown at the top. Significant changes are announced on the home page.
Any question: admin@maxlabs.uno — answer within one month at most.