Privacy policy

Naman Manocha, an individual operating as LaunchEngine.dev in India, is the data controller (also called the data fiduciary under India’s Digital Personal Data Protection Act, 2023). Our contact for privacy matters is [email protected].

Postal address: B-103, Bhakti Park, New Sushil Nagar, Boisar (E), Palghar, Maharashtra 401501, India.

We process personal data under India’s DPDP Act 2023. Where the GDPR or UK GDPR applies to a user — for example because you are in the EU or UK — we act as controller there too and honour those rights. Where the CCPA/CPRA applies (California users), we do not sell or share personal information as those terms are defined, and we do not use it for cross-context behavioural advertising.

We collect the minimum needed to run the service. For each category we process data on one of these bases: performing our contract with you, your consent, or our legitimate interest in running and securing a business tool (which you can object to as set out under your rights).

• Account data. The email address and name your identity provider hands us when you sign in, and the workspace you belong to. Authentication is handled by Neon Auth; we do not store passwords. Basis: contract.
• Product data you enter. The project profiles you create — the description, target customer, and competitor names — plus the drafts you generate. Competitor names are used only to build search queries. Basis: contract.
• Usage and cost records. Which tool or scheduled job ran, whether it succeeded, how long it took, and what it spent in credits and provider cost. These carry a request id so you can correlate a call with its result. Basis: contract and legitimate interest (security, billing).
• Public conversations. The radar reads public posts on Hacker News and public search results. It reads them as a logged-out visitor: no account is created on any platform, and nothing is posted or voted on your behalf. These posts contain personal data about their authors — see the next section.
• Billing data. The customer id our payment provider assigns to your workspace, and your plan. Card details are handled entirely by the provider and never reach this application. Basis: contract and legal obligation.

• We do not sell your data, and we do not run third-party advertising or tracking pixels on the product.
• We do not send messages from your accounts. Drafting is assistive; a human reviews and posts every reply. This is both the product’s design and the rule that keeps it within the platforms’ terms.
• We do not contact the people whose posts are surfaced. Their public post is read; they are not enrolled in anything and receive no email from us.

The radar stores public posts — including the author’s username and the post text — so they can be scored and shown to the customer who searched for them. These authors are not our customers. We process their data on the basis of our legitimate interest in providing a public-conversation search tool, on the understanding that the information was published publicly, that we do not contact them, and that we do not build profiles about them beyond the single post.

If you are the author of a post that appears in the product and you want it removed, you do not need an account. Email [email protected] with the URL of the post, and we will suppress it from results and stop re-scanning it. You can also ask us what we hold about you, and object to our processing of it.

These are the processors that hold data on our behalf, and the reason each is necessary. Each is bound by its own terms and data-processing agreement.

• Neon — the Postgres database and authentication.
• Dodo Payments — payment processing; the merchant of record.
• Resend — transactional email such as the daily digest and alerts.
• Inngest — scheduling the recurring scans, digest, and webhook retries.
• Tavily, Brave, or Serper — the web-search provider used to find public conversations. Only one is queried per scan.
• Your chosen LLM provider — drafting. If you supply your own key on the BYOK plan, the request goes to your account with that provider.
• OVHcloud — the server the application runs on.
• Cloudflare — DNS, TLS termination, the edge in front of the server, and privacy-friendly web analytics (see Cookies). Like any reverse proxy it necessarily sees the request as it passes through.
• Sentry — error reports when a page or request fails: the error and its stack trace, the page it happened on, and browser and device type. The SDK is configured not to collect user identity, IP addresses, cookies, request or response bodies, or URL query parameters.

This list names only processors that are actually in use, so it can be checked against the deployment. We will give reasonable advance notice here before a new subprocessor starts processing personal data.

Data is stored in the Neon database and on the application server, both in Canada / United States regions. The operator is in India, so your data is transferred to and processed outside your own country. Where the GDPR or UK GDPR applies, those transfers rely on the providers’ standard contractual clauses and, where available, the EU–US Data Privacy Framework. We choose providers that offer those safeguards.

Retention is applied automatically:

• Agent activity records (agent_events) are pruned after 90 days.
• Website-import attempts (url_extractions) are pruned after 30 days.
• Webhook delivery records are pruned after 14 days.
• Scanned signals, drafts, and project profiles are kept while your workspace exists, so the history stays useful.

A nightly database dump is written to object storage for disaster recovery. It is compressed and encrypted at rest by the storage provider (Cloudflare R2), and old dumps are deleted automatically after 30 days.

Provider keys you bring yourself are encrypted at rest with a key held in the server environment, and are scoped to your workspace. Activity logs are tenant-isolated, so one workspace cannot read another’s data — the same isolation that the mute and signal-feed features rely on. Access to production systems is limited to the operator.

No system is perfectly secure. If a breach affects your personal data, we will notify you and, where the law requires it, the relevant authority, without undue delay after we become aware of it.

Depending on where you live, you have some or all of these rights: to access the personal data we hold about you, to have it corrected, to have it erased, to receive a portable copy, to withdraw consent, and to object to processing based on legitimate interests. Under India’s DPDP Act you also have the right to nominate someone to exercise these rights on your behalf if you die or become incapacitated. If you are in the EU or UK, you have the right to lodge a complaint with your local supervisory authority; we would ask you to contact us first so we can try to resolve it.

To exercise any of these, email [email protected]. Deleting your account removes your workspace’s profiles, signals, and drafts from the live database; the next scheduled retention pass drops the associated activity records and backups age out. We aim to respond within 30 days.

We set only what authentication needs: a signed session cookie so you stay signed in. Clearing it signs you out.

In production we also load Cloudflare Web Analytics, which counts page views and measures performance. It is cookieless, does not fingerprint you, and does not track you across other sites, so it needs no consent banner — but we are telling you it runs rather than claiming there is no analytics at all. There is no advertising cookie.

If this policy changes in a way that affects what is collected, the “last updated” date at the top changes and, for a material change, signed-in users are notified. The current version is always this page.