Privacy Policy

Contact and lead submissions. Five surfaces with distinct storage: (1) the main contact form (POST /api/contact-inquiry) is delivered to our contact inbox via Resend email and is not persisted in any database of ours; (2) the public lead-capture form and the Solo Pro public waitlist form (mounted on /compliance/checklist, /scanner, /evidence-layer, /platform, and /pricing; POST /api/leads/capture) write to our Supabase database (leads table); (3) the demo lead gate on /try (POST /api/demo/register) stores the email as an entry in .demo-leads.json on the server filesystem (Hetzner VPS); (4) the use-case analyzer lead gate (POST /api/use-case/register) appends a structured record to .usecase-leads.json on the Hetzner VPS filesystem. The record contains your email, the analyzer mode selected, industry, data sensitivity classification, a free-text description you provide (up to 500 characters), the analysis mode, and a timestamp; (5) the in-account Solo Pro feature-interest expression from the account billing and license pages (POST /api/account/waitlist) is held in volatile server memory only and triggers a confirmation email via Resend. Each surface collects only the information you provide — typically your email. For the main contact form, we collect your email address (required), optional company name, an optional free-text use-case description (up to 2000 characters), and an optional indicator of whether you operate in a regulated industry. Note: /api/demo/process and /api/use-case/analyze are separate inference endpoints (covered in §3 Anthropic), not lead-storage routes.

Account data. Account creation is email-only; no password is collected at any stage. When you submit your email, we generate a single-use verification token (valid 24 hours, stored in volatile server memory) and email it to you via Resend. When you click the verification link, we create a Supabase Auth user record, provision your customer record in our Supabase database, and our gateway generates your DSA API key. The raw API key is emailed to you once via Resend; our database stores only a SHA-256 hash of the key and a 12-character prefix for identification. The raw key is not retained after the email is sent and is never displayed in the web interface. Subsequent logins use Supabase Auth to issue session cookies (duration per Supabase defaults).

Web analytics. Plausible (cookieless, EU-hosted) records page-level aggregate usage. No cookies are set, no cross-site tracking is performed, and no personally identifying information is captured by Plausible.

Server-level access logs. Server-level request logs (IP address, user-agent, request URL, timestamp) are captured at the infrastructure level by our hosting provider (Hetzner) via systemd journald. Retention follows systemd journald defaults; specific retention will be documented upon UG registration.

Waitlist submissions use two distinct storage paths. The public Solo Pro waitlist (accessible via the pricing page and selected product surfaces) posts to /api/leads/capture and is persisted in the Supabase leads table alongside other lead-capture submissions. The in-account waitlist (accessible from /account/license and /account/billing when logged in) posts to /api/account/waitlist and is held in volatile server memory, with a confirmation email sent via Resend; the in-account submission itself is not persisted and is lost on server restart.

To operate the website, provision Solo Free accounts, and authenticate you when you sign in.

To respond to contact, pilot, demo-lead, use-case, and waitlist submissions.

To send transactional email: email verification at signup, delivery of your DSA API key at signup, support responses, and waitlist confirmations.

To understand aggregate website usage via privacy-preserving analytics.

To diagnose errors and investigate abuse using server-level access logs.

Retention per lead-submission surface (see §1 for the surface-by-surface taxonomy): (1) Main contact form — delivered as email via Resend to [email protected], not persisted in any database of ours; follows Resend retention and the operator's email-inbox policy. (2) Public lead-capture + Solo Pro public waitlist (Supabase leads table) — retained until deletion is requested via [email protected]. (3) Demo lead gate (.demo-leads.json on VPS filesystem) — retained until deletion is requested via [email protected]. (4) Use-case analyzer lead gate (.usecase-leads.json on VPS filesystem) — retained until deletion is requested via [email protected]. (5) In-account Solo Pro feature-interest expression — held in volatile server memory only, lost on server restart (no database retention applies). Automated retention schedules for persisted surfaces will be published upon UG registration.

Account data (email, DSA API key SHA-256 hash and 12-character prefix) is retained for as long as the account exists. Upon account deletion request, account data is removed from our database and the raw DSA API key is revoked at the gateway.

Waitlist submissions retention depends on the path. Public Solo Pro waitlist submissions (POST /api/leads/capture) are persisted in the Supabase leads table and retained until you request deletion via [email protected]. In-account waitlist submissions (POST /api/account/waitlist) are held in volatile server memory only and are lost on server restart; a confirmation email is sent via Resend at the time of submission.

Server-level request logs follow systemd journald defaults on the Hetzner VPS; specific retention will be documented upon UG registration.

Anthropic (US) and Cloudflare (global edge) process data outside the European Union / European Economic Area. Both transfers are covered by Standard Contractual Clauses (GDPR Article 46(2)(c)). All other sub-processors operate within the EU/EEA.

Data sent to Anthropic is limited to the content you submit via /api/demo/process or /api/use-case/analyze and is not combined with other identifying data on our side. Data routed through Cloudflare is limited to what is necessary for DNS resolution, CDN caching of public assets, and DDoS mitigation.