Privacy Policy

2. What Data We Collect

We strictly collect and process only the personal data required to deliver our services and manage waitlist onboarding, categorized as follows:

• Waitlist Subscriber Data: Email address provided during registration to secure early access to our private beta cohort.
• Optional Qualification Data: Structured responses regarding your product model, checkout provider, and operational priorities, used to size and prioritize beta onboarding.
• SaaS Account & Platform Data: For registered creators: authentication credentials, workspace data, payment provider API tokens (encrypted at application level), and project configurations.
• Purchase Event & Review Data: Transaction event data ingested via webhook adapters (buyer email, transaction ID, order details) and guided responses provided by customer reviewers (star ratings, guided answers, optional reviewer identity).
• Technical & Telemetry Logs: IP addresses (processed in anonymized form or retained solely for HTTP routing and DDoS mitigation), browser user agents, request timestamps, and rate limiting logs.

3. Purposes and Legal Bases for Processing

All personal data is processed under the legal bases established by Article 6 of the GDPR:

• Waitlist Management & Early Access Notifications: Art. 6(1)(a) GDPR (explicit consent) and Art. 6(1)(b) GDPR (steps prior to entering into a contract upon request).
• SaaS Service Delivery & Embeddable Widget: Art. 6(1)(b) GDPR (performance of the SaaS service contract with the creator).
• Infrastructure Security & Abuse Prevention: Art. 6(1)(f) GDPR (legitimate interest in preserving system integrity, preventing SSRF exploits, abuse, and brute-force attacks via rate limiting).
• Statutory & Regulatory Compliance: Art. 6(1)(c) GDPR (compliance with statutory accounting, tax, and reporting obligations).

4. Sub-processors and Third-Party Sharing

We never sell, rent, or monetize personal data with data brokers or marketing third parties. Data is processed exclusively by verified technical providers bound by Data Processing Agreements (Art. 28 GDPR):

• Supabase Inc. — Managed PostgreSQL database with Row-Level Security and auth (hosted in EU region).
• Vercel Inc. — Edge compute, serverless hosting, and CDN infrastructure (backed by Standard Contractual Clauses / DPA).
• Resend Inc. — Transactional email delivery and system notifications.
• Stripe / Gumroad / Lemon Squeezy — Secure payment processing for platform subscriptions and verified purchase event ingestion.

5. Security Measures & Architecture

Pursuant to Article 32 of the GDPR, we maintain technical and organizational safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure:

• Mandatory in-transit encryption across all web and API channels (TLS 1.3 / HTTPS).
• Application-level encryption at rest for sensitive integration credentials and webhook secrets.
• Multi-tenant database isolation enforced at database engine level via PostgreSQL Row-Level Security (RLS).
• SSRF (Server-Side Request Forgery) defense with strict outbound domain allowlisting.
• Rate limiting enforced on all public forms, widget API endpoints, and webhook receivers.

6. Data Retention Schedule

Personal data is retained only for as long as necessary to fulfill the specific purposes for which it was collected:

• Waitlist Data: Retained until private beta access onboarding concludes or until the subscriber requests deletion.
• Account & Subscription Data: Retained throughout the active subscription and thereafter for statutory accounting and civil prescription periods (up to 10 years).
• Security Logs: Retained for a maximum of 90 days for diagnostic and security auditing before automated rotation and purge.

7. Your Rights Under the GDPR

Under Articles 15 through 22 of the GDPR, you have the following enforceable rights:

• Right of Access (Art. 15): Obtain confirmation of data processing and access to your personal records.
• Right to Rectification (Art. 16): Request correction of inaccurate data or completion of incomplete information.
• Right to Erasure / To Be Forgotten (Art. 17): Request permanent erasure of your personal data from our databases.
• Right to Restriction of Processing (Art. 18): Request temporary restriction of processing in statutory circumstances.
• Right to Data Portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format.
• Right to Object & Revoke Consent (Arts. 7 & 21): Object to legitimate interest processing and withdraw consent anytime without retroactive effect.

To exercise your rights, email us at privacy@laudoloop.com. We will respond without undue delay within 30 days. You also maintain the right to lodge a complaint with your local EU Data Protection Authority or the Italian Garante Privacy (www.garanteprivacy.it).

8. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect product evolutions or legal developments. Substantive updates will be published on this page with an updated revision date.