Privacy Policy

1. Who We Are

Launch at Dawn ("we," "us," "our") operates the AI visibility tracking platform at www.launchatdawn.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

For GDPR purposes, our data controller is Launch at Dawn. This policy applies to visitors and customers around the world, and we have designed it to meet the requirements of applicable laws, including the GDPR (European Economic Area, UK, Switzerland), PIPEDA (Canada), and the CCPA/CPRA (California, United States). For questions about this policy, contact us at privacy@launchatdawn.com.

2. Data We Collect

2.1 Account Data (when you sign up)

• Email address
• Password (stored as a bcrypt hash — we cannot read it)
• Name (if provided via OAuth — Google/GitHub)
• Plan selection (free, starter, pro, growth, agency)

2.2 Business Data (when you add a business)

• Business name, URL, category, city
• Client email (if provided by agency users)
• Country code
• Tracking prompts you create
• Competitor names and URLs

2.3 Analytics Data (generated by our Service)

• AI model responses to your prompts
• Visibility scores, position rankings, sentiment analysis
• Citation data and competitor brand mentions
• Crawler hit logs (bot visits to your website via our integration snippet)
• Cost and token usage per AI model call

2.4 Payment Data (processed by Stripe)

We do not store credit card numbers. Payment is processed by Stripe. We store only your Stripe customer ID and subscription status. See Stripe's Privacy Policy.

2.5 Lead Data (when you use our free tools)

• Email address (from free scan, report request, or contact forms)
• Name and business information (if voluntarily provided)
• Chat transcripts (from our AI agent)

2.6 Integration Credentials

• WordPress Application Passwords (encrypted with AES-256-GCM before storage)
• GitHub/GitLab/Bitbucket access tokens (encrypted with AES-256-GCM)
• Slack webhook URLs

3. How We Use Your Data

• Provide the Service: Run AI visibility scans, track prompts, generate analytics
• Process payments: Manage subscriptions via Stripe
• Send transactional emails: Score alerts, weekly digests, account notifications
• Improve the Service: Aggregate usage patterns (anonymized)
• Customer support: Respond to your inquiries
• Legal compliance: Maintain audit logs, fraud prevention

4. Third-Party Services (Data Processors)

We share data with the following third-party processors solely to provide the Service:

• Supabase — Database, authentication, file storage
• Stripe — Payment processing
• Resend — Transactional email delivery
• Vercel — Hosting and serverless infrastructure
• AI Model Providers — OpenAI, Anthropic, Google (Gemini), Perplexity, Groq, Mistral, DeepSeek, xAI (Grok), OpenRouter. Your prompts and business URLs are sent to these providers to generate AI visibility responses.

5. Your Rights

5.1 GDPR (European Economic Area, UK, Switzerland)

If you are in the EEA, the United Kingdom, or Switzerland, you have the following rights:

• Right of Access: Request a copy of all personal data we hold about you
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Portability: Receive your data in a machine-readable format (JSON)
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time (where processing is based on consent)

5.2 PIPEDA (Canada)

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) governs how we handle your personal information. You have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Correct or update inaccurate personal information
• Withdraw Consent: Withdraw consent for non-essential processing at any time
• Challenge Compliance: Question our compliance with PIPEDA at any time
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada

5.3 CCPA/CPRA (California and selected US states)

If you are a California resident or a resident of another US state with a comparable privacy law (e.g. Colorado, Connecticut, Utah, Virginia), you have the right to:

• Know: Learn what personal information we collect, use, and disclose about you
• Access: Request a copy of the personal information we hold about you
• Deletion: Request deletion of your personal information
• Opt Out: Opt out of the "sale" or "sharing" of personal information, where applicable
• Non-Discrimination: Exercise your rights without being discriminated against

We do not sell personal information and do not "share" it for cross-context behavioral advertising. We honor "Do Not Sell or Share My Personal Information" requests, Global Privacy Control (GPC) signals, and Do Not Track (DNT) browser signals, and we process consent recorded via our cookie banner (see the Cookie Policy).

5.4 Other Jurisdictions

Users in countries not listed above may still request access, correction, or deletion of their personal data. We will honor such requests wherever permitted or required by applicable law.

To exercise any of these rights, use the data export and account deletion tools in your dashboard settings, or email us at privacy@launchatdawn.com. We respond to all verified requests within 30 days.

6. Data Retention

• Account data: Retained while your account is active. Deleted within 30 days of account deletion.
• Analytics data: Retained for the duration of your plan (0–365 days depending on tier).
• Lead data: Retained for 12 months for sales follow-up, then deleted.
• Audit logs: Retained for 24 months for security and compliance.
• Payment records: Retained as required by tax law (7 years in most jurisdictions).

7. Cookies

We use only strictly necessary cookies for authentication (Supabase session cookies). These are HTTP-only, secure, and essential for the Service to function. We do not use advertising or tracking cookies. Where you enable the "Analytics" category in our cookie banner, we load Vercel Analytics, a cookieless measurement script that does not set cookies on your device; it runs only with your consent, and you can withdraw consent at any time via the banner. See our Cookie Policy for full details.

8. Data Security

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Integration credentials are encrypted with AES-256-GCM before database storage
• Row Level Security (RLS) ensures users can only access their own data
• Admin access is restricted by email allowlist
• Regular security audits and penetration testing

9. International Transfers

Because our customers are located worldwide, your data may be processed in countries other than your own (including Canada, the United States, and the European Union) by us and our third-party processors. Where required, we rely on safeguards such as Standard Contractual Clauses (SCCs), adequacy decisions, and user consent to ensure an adequate level of protection for international transfers. By using the Service and continuing to provide your personal data, you understand and agree to this transfer.

10. Children's Privacy

Our Service is not intended for children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on our Service. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

For privacy-related inquiries: privacy@launchatdawn.com

For general inquiries: hello@launchatdawn.com