Privacy Policy

When you interact with our platform, you may provide us with the following information:

• Email addresses - collected with your explicit consent when you sign up for early access notifications or create an account
• Communication data - messages you send us through contact forms or support channels

Legal Basis: We process this data based on your consent (for email signups) and contractual necessity (for account creation and service delivery).

When you use our platform, we automatically collect certain technical information:

• IP addresses - used for security purposes, fraud prevention, and threat detection
• Browser type and version - helps us optimize our platform for different browsers
• Device information - device type, operating system, and screen resolution for responsive design
• Usage data - pages visited, features used, and interaction patterns via privacy-friendly analytics
• Error logs - technical information about errors to help us debug and improve the platform

Legal Basis: We process this data based on our legitimate interest in providing a secure, functional, and optimized service.

Your data is stored securely using enterprise-grade cloud infrastructure with data centers located in the United States and European Union. We use industry-leading database hosting services that comply with GDPR and other international data protection standards.

• Encryption in transit - all data transmission uses TLS 1.3 or higher
• Access controls - strict authentication and authorization mechanisms limit data access
• Regular backups - automated backups ensure data recovery capabilities

We implement comprehensive security measures to protect your personal data:

• Advanced threat detection - automated security monitoring identifies and blocks malicious activity
• Bot protection - machine learning-based systems prevent automated abuse
• Rate limiting - protects against brute force attacks and service abuse
• Input validation - all user inputs are validated and sanitized to prevent injection attacks
• Security audits - regular security assessments and penetration testing
• Incident response - documented procedures for handling security incidents

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant supervisory authorities within 72 hours as required by GDPR.

• Right to Access - request a copy of all personal data we hold about you
• Right to Rectification - request correction of inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten") - request deletion of your personal data
• Right to Restrict Processing - request that we limit how we use your data
• Right to Data Portability - receive your data in a machine-readable format to transfer to another service
• Right to Object - object to processing based on legitimate interests or for direct marketing
• Rights Related to Automated Decision-Making - we do not use automated decision-making that produces legal effects

To exercise any of these rights, please contact us using the information in the Contact section below. We will:

• Respond to your request within 30 days (or explain why we need more time)
• Verify your identity to protect your data from unauthorized access
• Provide the requested information or action free of charge (unless requests are excessive or unfounded)
• Explain our reasoning if we cannot fulfill your request

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data appropriately.

• Analytics & Performance Monitoring - Vercel Analytics and Vercel Speed Insights provide privacy-friendly, cookie-free analytics to help us understand platform usage and performance
• Security Services - Advanced security platforms protect against bots, abuse, and malicious activity
• Error Monitoring - Error tracking services help us identify and fix technical issues quickly
• Database Hosting - Secure, enterprise-grade database infrastructure stores your data with encryption and access controls
• Infrastructure Services - Cloud hosting and content delivery services ensure fast, reliable platform access

We share data with third-party service providers only when necessary for platform operation:

• We share only the minimum data required for each service to function
• All service providers are bound by data processing agreements that ensure GDPR compliance
• We do not sell your personal data to third parties for marketing or any other purpose
• Service providers are prohibited from using your data for their own purposes
• We regularly review our service providers to ensure continued compliance

Important: Vercel Analytics and Speed Insights are GDPR compliant by default and do not use cookies, which is why we do not require a cookie consent banner.

We have deliberately chosen analytics tools that respect your privacy:

• Vercel Analytics - does not use cookies, does not track users across sites, and is GDPR compliant by design
• Vercel Speed Insights - monitors performance without cookies or personal data collection
• No third-party advertising cookies - we do not use any advertising or marketing cookies
• No cross-site tracking - we do not track your activity on other websites

We use minimal browser storage for essential functionality:

• Theme Preference - localStorage stores your light/dark mode preference for a better user experience
• Session Management - sessionStorage may be used for temporary session data (when logged in)

You can clear this data at any time through your browser settings. Clearing this data will reset your theme preference but will not affect your account or data.

You have full control over tracking and data collection:

• Browser Settings - configure your browser to block cookies or clear storage
• Do Not Track - we respect the Do Not Track (DNT) browser signal
• Ad Blockers - our platform functions normally with ad blockers enabled
• Privacy Extensions - browser privacy extensions will not interfere with core functionality

• Email Signups - retained until you unsubscribe or request deletion
• Account Data - retained while your account is active
• Analytics Data - aggregated and anonymized data retained indefinitely for statistical purposes
• Security Logs - IP addresses and security-related data retained for 90 days for incident investigation
• Error Logs - technical error information retained for 30 days for debugging purposes
• Communication Records - support inquiries and correspondence retained for 3 years for quality assurance

When data reaches the end of its retention period or you request deletion:

• Automated deletion processes remove data from active systems
• Backup data is securely overwritten during the next backup cycle
• Anonymized data may be retained for statistical purposes (cannot be linked back to you)
• Legal obligations may require us to retain certain data longer (e.g., financial records)

You can request immediate deletion of your data at any time by contacting us.

Your data may be transferred to and processed in:

• European Union - primary data storage location for EU users
• United States - cloud infrastructure and service providers
• Other countries where our service providers operate

When we transfer data outside the EU/EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) - EU-approved contracts that ensure GDPR-level protection
• Adequacy Decisions - transfers to countries deemed adequate by the European Commission
• Service Provider Certifications - providers with recognized data protection certifications
• Additional Security Measures - encryption, access controls, and monitoring for international transfers

By using our service, you consent to these international data transfers under the safeguards described above.

• Last Updated Date - we display the last updated date prominently at the top of this policy
• Platform Notification - we may display a notice on our platform when significant changes are made
• Version History - we maintain a record of policy versions and major changes

When we update this policy:

• Continued Use - your continued use of our platform after the effective date constitutes acceptance of the updated policy
• Right to Object - you can object to material changes by contacting us or discontinuing use of the service
• Account Closure - if you disagree with changes, you can close your account and request data deletion

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

• Initial Response - we will acknowledge your inquiry within 3 business days
• Full Response - we will provide a complete response within 30 days
• Complex Requests - if we need more time, we will explain why and provide an estimated timeline
• Identity Verification - for data access or deletion requests, we may need to verify your identity to protect your privacy

If you are located in the European Union and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection supervisory authority.

You can find your local supervisory authority contact information at: https://edpb.europa.eu/about-edpb/board/members_en