Privacy Policy

1. Information we collect

Account data — when you sign up we collect your email address and, if you use Google OAuth, your name and profile picture. Passwords are never stored by us; authentication is handled by Supabase Auth.

Usage data — pages viewed, features used, roadmaps generated, and idea cards saved. This data is pseudonymous and tied to your account ID, not your name.

Roadmap and profile inputs — when you generate a roadmap, your builder profile answers and the idea content are sent to our AI provider as prompt input to produce your personalised roadmap. This content is processed solely to generate your result.

Payment data — if you subscribe to Pro, payment is processed by Paddle. We receive a customer reference ID and subscription status only; we never see or store your card number or billing address.

Builder profile — budget, time availability, experience level, and goal. You provide this voluntarily to personalise your roadmap. You can edit it at any time from the roadmap builder; to have it deleted, contact us.

Technical data — IP address, browser type, and device type collected automatically by our hosting infrastructure (Vercel) for security and abuse prevention.

2. How we use your information

• To create and manage your account
• To generate and save personalised roadmaps based on your builder profile
• To process subscription payments via Paddle
• To send transactional emails (welcome email, subscription receipts) via Resend
• To translate interface and roadmap text into your language via DeepL
• To detect and prevent fraud, abuse, and security incidents
• To monitor errors and diagnose failures (via Sentry)
• To understand which features are used so we can improve the product (via PostHog analytics)

We do not sell your data. We do not use it for advertising.

3. Third-party services

We share data with the following processors, each under their own privacy policy:

• Supabase (database and authentication) — EU/US data hosting, SOC 2 Type II
• Vercel (web hosting and edge network) — US-based, processes IP/request metadata
• Anthropic (AI roadmap generation) — US-based. When you generate or preview a roadmap, your builder profile answers and the idea content are sent to Anthropic's API as prompt input. Groq (US) serves as fallback provider when Anthropic is not configured.
• DeepL (translation) — Germany-based, receives interface and roadmap text to translate into your selected language
• Paddle (payment processing) — UK-based, PCI-DSS compliant, processes payment data independently
• PostHog (product analytics) — EU region, collects pseudonymous usage events
• Sentry (error monitoring) — captures error reports and, on a small sample of sessions, anonymised session replays (text masked, media blocked) to help us diagnose issues
• Resend (transactional email) — processes your email address to deliver messages

Our AI and translation providers act as processors: your inputs are used solely to generate your roadmap or translation and, under their API terms, are not used to train their models. No processor receives your data for its own purposes.

International transfers. Some providers are located outside the EEA (notably the US and UK). Where required, transfers rely on the provider's Data Processing Agreement and Standard Contractual Clauses, or equivalent safeguards under the EU–US Data Privacy Framework where the provider is certified.

4. Cookies and analytics

We use cookies and similar technologies for:

• Session management — a secure, HttpOnly cookie to keep you signed in
• Analytics — PostHog sets a first-party cookie to count unique visitors and track feature usage. No personal data is sent to third-party ad networks.
• Preferences — your locale selection and cookie consent choice

You can opt out of analytics cookies via the cookie banner, and change your choice at any time from our Cookie Policy page. Opting out does not affect core functionality.

5. Data retention

Account data is retained while your account is active. If you ask us to delete your account (see section 6), we delete your email address, builder profile, roadmaps, saved ideas, and votes within 30 days. Security and rate-limiting logs (API usage records) are kept in pseudonymous form for up to 12 months for abuse prevention. Anonymised, aggregated analytics data may be retained indefinitely. Payment records are retained for 7 years as required by financial regulations.

6. Your rights (GDPR / UK GDPR)

If you are in the EEA, UK, or Switzerland you have the right to:

• Access — request a copy of the data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your account and personal data
• Portability — receive your data in a machine-readable format
• Object — opt out of analytics processing
• Restriction — ask us to pause processing while a complaint is resolved

To exercise any of these rights, email hello@saasascent.com. We will respond within 30 days.

7. Security

We use HTTPS everywhere, HttpOnly and Secure cookies, row-level security on the database, and access controls on all infrastructure. No system is perfectly secure; if you discover a vulnerability please disclose it responsibly to hello@saasascent.com.

8. Children

SaaSAscent is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it promptly.

9. Changes to this policy

We may update this policy. Material changes will be communicated by email to registered users at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.

10. Contact

Questions or requests: hello@saasascent.com

Operator draft for launch — product-accurate interim terms pending professional legal review. Not final legal advice.