Legal
Privacy Policy
What personal data LaunchFaro collects, why, who it is shared with, how long it is kept, and how to use your rights under GDPR, UK GDPR and CCPA.
- Version
- 0.1
- Last updated
Draft for legal review
1. Who is responsible
[to be completed: operator.legalName], [to be completed: operator.address] ("LaunchFaro", "we") is the controller of the personal data described here, except where section 8 says we act for you as a processor. Privacy contact: [to be completed: operator.privacyEmail]. Representative in the EU or UK, where one is required: [to be completed: operator.euRepresentative].
2. What we collect and why
| What | Examples | Where it comes from | Why we use it | Lawful basis |
|---|---|---|---|---|
| Account data | Email address, display name, how you sign in, when you last signed in | You | Create and secure your account, send service messages | Contract |
| Anonymous session | A random secret in a cookie, stored by us only as a hash, and the drafts and campaigns it owns | Your browser | Let you keep work before you have an account | Contract (providing what you asked for) |
| Campaign data | Product name, website, tagline, categories, description variants, logo URL, the contact name and email you choose to put on a listing | You | Run your campaign and fill directory forms | Contract |
| Campaign records | Each directory's status, listing URL, evidence, notes, task history, per-step run log, screenshots of failed steps | The Service | Show what happened and prove each listing | Contract; legitimate interest in keeping an accurate record |
| Directory accounts | A username, an email alias on our domain and a generated password for the account the Service creates at a directory for your product | The Service | Create one account per product per directory | Contract |
| Verification mail | Mail that a directory sends to that alias. The Service reads it only to find the verification link; it stores no message content, but the message stays in our mailbox until deleted (section 5) | Directories | Complete sign-up | Contract |
| Billing data | Plan, amount, currency, country, order status, provider reference. Card details go to our payment provider and never reach us | You and the payment provider | Take payment, issue receipts, keep accounts | Contract; legal obligation |
| Submissions and reminders | Product name, store address, contact email on a submission; the reminder choice you made and the exact words you saw | You | Review a submission; send the one reminder you asked for | Contract; consent for the reminder |
| Messages to us | The content of emails and reports you send | You | Answer you, handle abuse and rights requests | Legitimate interest; legal obligation |
| Technical data | IP address, request details | Your browser | Rate limiting and abuse prevention. The IP address is kept in memory for about a minute and is not written to our database; server access logs may contain it (section 5) | Legitimate interest |
| Measurement | If you arrive from a search engine or another site, a first-touch cookie records the channel and landing page. Counts of outbound clicks and submissions carry no identifier | Your browser | Understand which channels bring visitors | Consent where the law requires it (see the Cookie notice); otherwise legitimate interest |
We do not use your data to profile you, make automated decisions that have legal or similarly significant effects on you, or train machine-learning models. We do not sell personal data and do not share it for cross-context advertising.
3. Who receives it
- Subprocessors that help us run the Service, listed with their purpose and location on the Subprocessors page. We will update that page before a new one starts handling your data and give 30 days' notice of changes that affect you.
- Our merchant of record, which takes payment as the seller to you and is an independent controller of the payment data it collects.
- Directories, which receive the listing details you instruct us to submit, including the contact name and email you put on a listing. A directory is an independent controller of what it receives: its own privacy policy governs it, and we cannot recall data once a directory has it.
- Authorities and advisers where the law requires, or to protect rights, safety and the Service.
- A buyer or successor, if the business is transferred, on terms that keep this policy's protections.
4. International transfers
Our servers are hosted where the operator chose to place them, and some subprocessors operate in other countries, including outside the European Economic Area and the United Kingdom. Where personal data leaves those areas we rely on an adequacy decision or on the Standard Contractual Clauses with the UK Addendum, and we assess the destination's laws. Directories you instruct us to submit to may be located anywhere. Ask [to be completed: operator.privacyEmail] for a copy of the safeguards.
5. How long we keep it
| Data | Kept for |
|---|---|
| Drafts you did not finish | 30 days after you last touched them, then deleted with their resume links |
| Drafts you completed | 7 days, then deleted |
| Account and campaign data | While your account exists. After you delete your account we erase it after a 14-day period in which you can change your mind |
| Backups | Deleted data leaves backups within 365 days |
| Email delivery log | Address replaced with a placeholder after 90 days; a one-way hash is kept so we never mail an address that opted out |
| Failure screenshots and run logs | 30 days |
| Verification mailbox | 7 days |
| Order and invoice records | As long as tax and accounting law requires |
| Task history for a campaign | With the campaign. After your account is erased, any record that remains carries no name, email or other link to you |
| Server access logs | 30 days |
| Opt-out and suppression records | A hash only, for as long as needed to honour the opt-out |
6. Cookies and similar storage
See the Cookie notice for each cookie and browser storage item, what it does and how long it lasts.
7. Your rights
Depending on where you live (including under the GDPR, the UK GDPR and the California Consumer Privacy Act as amended), you may have the right to: know whether we process your data and get a copy; have it corrected; have it erased; restrict or object to processing, including processing based on legitimate interest; receive it in a portable format; withdraw consent at any time, without affecting what was done before; and not be discriminated against for using these rights. California residents may also ask what categories we collect and disclose and opt out of sale or sharing; we do neither.
How to use them: write to [to be completed: operator.privacyEmail] from the address on your account, or use the export and delete tools in the dashboard settings. We may need to confirm it is you. We answer within 30 days and tell you if we need more time and why. It is free unless a request is clearly unfounded or excessive. If you are not satisfied you can complain to your data protection authority; in the UK that is the Information Commissioner's Office. You can also unsubscribe from any marketing email with the link in it.
8. When we are your processor
If you give us personal data about other people, for example the name and email of a colleague or client you place on a listing, we process it only on your instructions, as your processor. You are responsible for having the right to give it to us and for telling those people. The Data Processing Addendum sets out the terms and is available on request.
9. Security
The Security page lists the controls we have. No system is perfectly secure. If a breach affects your data we tell you and the authorities as the law requires.
10. Children
The Service is for businesses and is not directed at anyone under 16. We do not knowingly collect data from children; if you think we have, contact us and we will delete it.
11. Changes
When we change this policy in a way that matters, we tell you at least 30 days before it applies and keep the earlier versions on the legal pages.
12. Contact
[to be completed: operator.legalName], [to be completed: operator.address]. Privacy: [to be completed: operator.privacyEmail]. General: [to be completed: operator.supportEmail].
Previous versions
There are no earlier versions: this is the first.