Privacy Policy
Effective Date: September 11, 2026. Last Updated: October 12, 2026. This policy details what information LaunchOnIt collects, how we safeguard it, our third-party sub-processors, and your statutory rights under GDPR and CCPA.
1. Data Controller Information
The data controller responsible for the processing of personal data on LaunchOnIt is:
Entity: LaunchOnIt
Website: https://launchon.it
Official Contact: contact@launchon.it
For any questions regarding our data practices or to submit a verified subject access request, contact contact@launchon.it.
2. Information We Collect
We collect information directly when you register an account, complete your maker profile, submit software products, cast community upvotes, participate in maker discussions, build daily streaks, or purchase launch upgrades and ad slots:
A. Account & Maker Profile Data
When you sign up or configure your profile, we collect your email address, full name, username, professional headline, biography, company name, city, country (and ISO country code), personal website URL, and social media handles (X/Twitter, GitHub, LinkedIn). Uploaded profile avatars are stored securely on Amazon Web Services (AWS S3, eu-central-1).
B. Authentication & OAuth Identifiers
When signing in via OAuth providers (Google, GitHub, or X/Twitter), we receive a unique provider account token, your verified public email address, name, and profile image. We never receive or store your third-party passwords. When signing in via Magic Link, we generate a cryptographically signed, single-use token sent to your email address by our email provider.
C. Product Submissions & Story Metadata
When submitting a software product to LaunchOnIt, you provide the product title, destination URL, tagline, description, primary category, sub-categories, platform compatibility (Web, iOS, Android, macOS, Windows, Chrome Extension), tech stack tags, use cases, target audience, problem solved, unique differentiators, product alternatives, discount codes, affiliate URLs, FAQ items, and demo/video links.
D. Community Upvoting, Comments & Streaks
To guarantee leaderboard integrity, every upvote is immutably linked to your authenticated user account and timestamped. When you participate in product discussions, your comments and maker identity are displayed publicly. Our daily streaks system records consecutive active days, upvotes, and comments to calculate streak discounts (such as Day 7 Launch 50% off).
E. Technical, Network & Outbound Click Metrics
When visitors click outbound links to maker products, we record anonymous referral data, country, and a salt-hashed representation of the IP address. We use a private cryptographic salt to ensure raw IP addresses are never retained, while still allowing click deduplication and effective-CTR reporting for makers.
3. Legal Bases for Processing (GDPR Art. 6)
We process personal data strictly under valid lawful bases recognized by the European Union General Data Protection Regulation:
- Performance of a Contract (Art. 6(1)(b) GDPR): Managing your maker account, scheduling your weekly launch slot, delivering transactional notifications (launch reminders, weekly launch completion, magic links), and fulfilling paid orders (Launch $19, Growth $39, and partner ad slots).
- Legitimate Interests (Art. 6(1)(f) GDPR): Enforcing platform security, verifying authentic community upvotes, mitigating automated bot syndicates via Cloudflare Turnstile, maintaining public directory archives, and preventing click fraud.
- Consent (Art. 6(1)(a) GDPR): Delivering our weekly newsletter digest and product recap emails. You may withdraw consent at any time via the one-click unsubscribe link in any email footer or from your dashboard settings.
- Compliance with Legal Obligations (Art. 6(1)(c) GDPR): Retaining financial transaction records for statutory tax and accounting requirements.
4. How We Use Your Information & Automated Systems
We use the data we collect solely for the following explicit operational purposes:
- To publish, index, and organize software products across our weekly lineups, permanent directory categories, and search filters.
- To deliver vital transactional emails, including magic link authentication, launch queue scheduling confirmations, 48-hour pre-launch alerts (Sunday 18:00 UTC), 36-hour launch closing sprint reminders (Friday 12:00 UTC), and weekly winner announcements (Sunday 23:59 UTC).
- To calculate authentic upvote tallies, enforce our strict one-vote-per-human policy, and disqualify bot-farmed upvotes.
- To capture automated screenshots of product landing pages via ScreenshotOne and synthesize structured SEO tags and editorial summaries via Google Generative AI (Gemini).
- To verify daily at 04:00 UTC whether Free Launch listings maintain the LaunchOnIt verification badge on their site.
- To track Domain Rating metrics for submitted maker domains via Ahrefs API.
- To measure anonymous product click-through rates (CTR) and provide makers with transparent engagement analytics in their private dashboard.
5. Third-Party Service Providers & Sub-Processors
We engage reputable infrastructure providers who act as sub-processors under Data Processing Agreements (DPAs) adhering to GDPR Article 28 standards:
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing for Launch ($19), Growth ($39), and homepage ad bookings ($9–$19/wk) | Billing address, payment method tokens, transaction amounts, Stripe customer ID | United States / European Union |
| Amazon Web Services (Amazon SES) | Transactional emails, magic sign-in links, launch schedule reminders, and weekly recaps, sent from our own email server (eu-central-1 Frankfurt) | Email address, recipient name, email content, delivery, bounce and open events | European Union (Frankfurt) |
| Resend, Inc. | Backup email delivery and a copy of the newsletter contact list | Email address, recipient name, notification delivery timestamps | United States |
| PostgreSQL Infrastructure / Neon | Serverless relational database hosting for user accounts, listings, streaks, upvotes, and comments | Application database records, user profiles, submissions, comments, upvotes, streak counts | United States / European Union |
| Amazon Web Services (AWS S3) | Secure cloud object storage (eu-central-1 Frankfurt) for maker avatars, product gallery images, and logos | Uploaded user image files, product screenshots, media URLs | European Union (Frankfurt) |
| Cloudflare, Inc. | Global edge CDN, DNS resolution, DDoS defense, and Turnstile privacy-preserving bot mitigation | Cryptographic Turnstile challenge tokens, routing headers, temporary IP address | Global Edge Network |
| Google Cloud / Google Generative AI (Gemini) | AI synthesis of structured product summaries, tags, use cases, and SEO rich snippet metadata | Public product description and URL submitted by maker | United States |
| ScreenshotOne | Automated browser screenshot capture of submitted product landing pages for directory listings | Public product destination URL | European Union |
| Ahrefs Pte. Ltd. | Weekly domain rating verification and backlink authority tracking for listed software products | Public domain hostname of submitted products | Singapore / Global |
| Bluesky (AT Protocol) | Automated social broadcasting of weekly lineup podium winners and featured launches | Public product title, URL, tagline, and rank | United States |
| Google Analytics (GA4) | Aggregated, anonymized website traffic measurement and interaction statistics | Device type, anonymized IP, page paths, referral sources | United States |
6. Payment Processing via Stripe
All paid launch packages (Launch $19, Growth $39) and homepage ad placements (Product Center Ads $9/wk, Sidebar Ads $19/wk) are processed directly by Stripe, Inc., a certified PCI-DSS Level 1 service provider. LaunchOnIt never collects, stores, transmits, or has access to your raw credit card number, expiration date, or CVC code.
8. Data Retention & Erasure Policy
We retain personal data only for as long as necessary to fulfill the purposes detailed in this policy:
- Account Information: Retained while your account remains active. Upon request for deletion, private account records, sessions, and notification history are permanently erased within 30 days.
- Public Directory Archives: Software listings launched during weekly lineups form an archival historical record of startup launches. While public listings remain indexed, personal maker identifiers can be unlinked or anonymized upon request.
- Financial Records: Transaction IDs and Stripe invoice records are retained for 7 years to comply with statutory legal and accounting requirements.
9. Your Statutory Rights (GDPR & CCPA/CPRA)
Under GDPR and CCPA/CPRA, you possess comprehensive statutory rights regarding your personal data:
Request a copy of all personal data held associated with your account.
Update inaccurate profile details directly from your dashboard settings.
Request permanent deletion of your account and personal identifiers.
Receive your personal data in a structured, machine-readable format.
To exercise your rights, email contact@launchon.it from your registered account address. We respond within 30 days without fee.
Do you sell personal data or track browsing history across external websites?
No. We never sell, rent, or trade your personal data, profile information, or browsing activity to any data brokers, marketing networks, or third-party advertisers.
How does LaunchOnIt track clicks to maker websites without invading privacy?
When visitors click outbound links to products on LaunchOnIt, we record the click event alongside a salt-hashed IP address. We never store raw IP addresses for outbound clicks. This cryptographic hash prevents bot inflation while ensuring that individual visitors cannot be tracked across the web.
What data is collected when I sign in with Google, GitHub, or X?
We only receive your verified email address, public display name, username, and profile picture from OAuth providers. We never receive, request, or store your passwords or private social accounts data.
How does the automated badge crawler work?
Our automated system crawls submitted Free Launch product URLs once daily at 04:00 UTC using safe SSRF-protected requests. It checks solely for the presence of the official LaunchOnIt badge or a direct outbound link. It does not collect private website content, cookies, or internal visitor data from your website.
How can I request permanent deletion of my account?
You can request account erasure at any time by emailing contact@launchon.it from your registered address. Within 30 days, we will permanently purge your user profile, session records, personal identifiers, and private notifications in compliance with GDPR and CCPA.
How can I customize my email notification preferences?
You can configure individual notification settings (upvotes, comments, weekly lineup rankings, weekly digests, streak alerts, product updates) directly in your Dashboard Settings. Marketing and digest emails also include a secure, one-click unsubscribe link in every footer.
Contact Our Privacy Team
For privacy inquiries, data subject access requests, or general support, contact contact@launchon.it.