1. Introduction

This Privacy Policy explains how LaunchIt ("we", "us", "our") collects, uses, and protects your information when you use our Service. We are committed to protecting your privacy and handling your data responsibly.

2. Information We Collect

Account Information:

• Email address (for authentication, notifications, and account recovery)
• Password (stored as a secure bcrypt hash — we never store plain-text passwords)

Usage Data:

• Pages created and their content
• Submission counts per page (integer only)
• Credit usage and plan information

Uploaded Content:

• Images you upload for use in your landing pages (stored on our CDN, deleted when you remove them or delete your account)

Payment Information:

• Payment processing is handled entirely by Stripe. We store only your Stripe customer ID — we never store credit card numbers or billing details.

3. Information We Do NOT Store

We do not store submitted email addresses. When visitors submit their email through your landing page, the submission is relayed directly to your email via our notification service. No visitor email addresses, names, or IP addresses are stored in our database. Only an integer submission count is tracked per page. Note that our third-party infrastructure providers (Cloudflare, Resend) may retain access logs containing IP addresses in accordance with their own privacy policies.

4. How We Use Your Information

• To provide, maintain, and improve the Service
• To send email notifications about form submissions on your pages
• To send account-related emails (verification, password reset)
• To process payments (Pro plan subscribers)
• To enforce our Terms of Service and prevent abuse

5. Cookies

We use session cookies for authentication only. These cookies are essential for the Service to function and allow you to stay logged in. We do not use:

• Tracking cookies
• Third-party analytics (no Google Analytics, no tracking pixels)
• Advertising cookies
• Cross-site tracking

Published landing pages served from our CDN do not set any cookies on visitors. Our bot protection service (Cloudflare Turnstile) may set functional cookies (e.g., cf_clearance) on the dashboard to verify you are not a bot; these are not used for tracking.

6. Third-Party Services

We use the following third-party services to operate:

• Stripe — Payment processing for Pro plan subscriptions. Subject to Stripe's Privacy Policy.
• Resend — Transactional email delivery (account emails and submission notifications). Subject to Resend's Privacy Policy.
• Cloudflare — CDN, DNS, page hosting, and bot protection. Subject to Cloudflare's Privacy Policy.
• xAI — AI content generation. Prompts sent to xAI include your page description and instructions only — no personal data is sent.

7. Data Security

We implement industry-standard security measures including:

• Encrypted connections (TLS/HTTPS) for all data in transit
• Secure password hashing (bcrypt)
• CSRF protection on all forms
• Rate limiting on authentication and API endpoints
• Content Security Policy on published pages
• Bot protection via Cloudflare Turnstile

8. Data Retention

Account data is retained while your account is active. You may request account deletion by contacting us at [email protected]. Upon deletion:

• Your account information is permanently deleted
• Your published pages are unpublished and removed
• Uploaded images are deleted from our CDN

9. Canadian Privacy Law

LaunchIt is operated from Alberta, Canada. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA). Under these laws, you have the right to access, correct, and request deletion of your personal information. To exercise these rights, contact us at [email protected].

10. Data Breach Notification

In the event of a data breach that poses a real risk of significant harm to you, we will notify affected users as soon as feasible and report the breach to the Office of the Privacy Commissioner of Canada, in accordance with PIPEDA. Notification will include the nature of the breach, the information involved, and steps we are taking to mitigate the risk.

11. Your Rights

You have the right to:

• Access your data via your account settings
• Correct your information (email, password)
• Delete your account and all associated data by contacting us
• Withdraw consent for data processing (which may require account closure)
• File a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated

12. Children's Privacy

The Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16.

13. International Users

Your data may be processed in countries where our servers and third-party service providers are located. By using the Service, you consent to the transfer and processing of your data in these locations.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated date. The "Last updated" date at the top reflects when the policy was last modified.

15. Contact

For privacy-related questions or data requests, please contact us at [email protected].