Privacy Policy
Melyx ("we", "us") operates auth.melyx.id as the single sign-on hub for our network of applications (including GetIrishCompany, GetVatrax, ConvertLyx, Carelyx, Dublin24h, Melyx Cart, and related services). This policy explains what personal data we collect when you sign in and how we use it.
1. Data we collect
- Account data — email address, name, profile picture (when provided by you or your identity provider).
- Authentication data — password hash (bcrypt), MFA secret, passkey credentials, refresh tokens, OAuth tokens issued by Google/GitHub.
- Session data — IP address, user agent, device fingerprint, approximate location, timestamps of login and logout.
- Access grants — which applications in our network you are entitled to use, plan level, and expiry date.
- Audit log — a record of security-relevant actions (login, password change, MFA enable/disable, granting access).
2. Google account data
If you sign in with Google, we request only the openid email profile scopes. We receive your email, name, Google account ID, and profile picture URL. We do not read your Gmail, Drive, Calendar, or any other Google data. Google tokens are used only to verify your identity at sign-in and are stored encrypted at rest.
You can revoke our access at any time at myaccount.google.com/permissions.
3. How we use the data
- Authenticate you across our applications via a single shared session.
- Protect your account against credential stuffing, fraudulent logins, and unauthorized access.
- Send transactional emails: magic links, password-reset links, security alerts for new device logins.
- Provide an audit trail so you and our admins can review account activity.
We do not sell your data. We do not use it for advertising. We do not share it with third parties except as required to run the service (email delivery, infrastructure providers) or by law.
4. Retention
Account data is retained while your account is active. Sessions expire after 30 days of inactivity. Audit logs are retained for 12 months. You can request deletion of your account at any time by writing to [email protected]; we will delete personal data within 30 days except where we must keep records for legal or accounting reasons.
5. Security
Passwords are hashed with bcrypt. Traffic is encrypted end-to-end over HTTPS. Secrets and tokens are stored on encrypted volumes and never logged in plaintext. MFA and passkey support are available and recommended.
6. Your rights
You have the right to access, correct, export, or delete your personal data. Contact [email protected] and we will respond within 30 days.
7. Contact
Melyx — [email protected]