Privacy Policy

What we collect

• Account details. Your name, email address, a password hash (we never store the plain password), and session records created when you sign in. If you use Google sign-in, we receive the basic profile information Google returns for authentication.
• Submitted URLs and attestations. The website address you add, the project name you choose, and the timestamp of your ownership attestation.
• Crawled public content. Public HTML excerpts, metadata, headings, links, image URLs, and DOM-derived brand tokens from pages we audit. We also store screenshots of publicly reachable pages and a favicon or logo if one is available.
• Generated outputs. Audit results, issue records, video scripts, narration audio, rendered MP4 files, poster frames, and subtitle files.
• Operational logs. Job status, progress steps, and error messages used to show progress and diagnose failures. These are tied to a project.

We do not run advertising trackers, sell personal data, or build cross-site behavioural profiles.

Why we process it and our legal basis

We process account and project data to perform the service you asked for (contract), to keep the service secure and diagnose failures (legitimate interests), and to comply with legal obligations. Where local law requires consent for a specific processing activity, we will ask for it separately and you can withdraw it at any time.

Ownership attestation and crawl limits

Audits and captures run only on URLs you attest that you own or are authorised to audit. Every project records that attestation with a timestamp. Discovery crawls honour robots.txt, stay on the same site, and are capped at a small number of pages. We do not attempt to bypass authentication, paywalls, or other access controls, and we do not crawl third-party sites on your behalf.

Screenshots are taken of publicly reachable pages only. If a page requires a login or blocks automated access, it will not be captured.

AI processing and sub-processors

We use Google’s Gemini API to analyse page content, write video scripts, and generate voiceover audio. Page text and screenshots are sent to that API for processing. We do not use your content to train our own models, and we do not send it to the API for the purpose of training Launchkit models. Google processes the data under its API terms as a sub-processor.

Other categories of sub-processors we rely on:

• Hosting and object storage. To run the web app, worker, database, and store generated assets.
• Email delivery. If we configure transactional email, an email provider processes your address to deliver account messages.

We do not list advertising networks because we do not use them. A current list of sub-processors is available on request at [email protected].

Retention

• Generated assets (screenshots, audio, video, posters) are kept for 12 months by default, then removed unless the project is deleted sooner.
• Deleting a project removes its audits, videos, jobs, asset rows, and the stored files under that project’s folder immediately.
• Deleting your account removes the user row and cascades to all projects and their related records, and removes the stored asset files.
• Session records expire after 30 days of inactivity or when you sign out.
• We may retain limited records where required by law, or in backups for a short period before they are overwritten.

Cookies

We use a session cookie to keep you signed in. It is set by our authentication layer and is not used for advertising. We do not set third-party analytics or tracking cookies. Clearing cookies signs you out.

Your rights

Depending on where you live, you may have the right to access, correct, export, delete, restrict, or object to our processing of your personal data, and to lodge a complaint with a supervisory authority.

• Export. In Settings, choose Export my data to download a JSON file containing your account, projects, audits, videos, jobs, and asset metadata.
• Delete. In Settings, delete individual projects or your entire account. Account deletion requires typing DELETE and signs you out.
• Object or ask a question. Email [email protected]. We may need to verify your identity before acting on a request.

Security

We use HTTPS in transit, hash passwords, keep sessions server-side, check project ownership on every mutation, and serve generated assets only to the owning account or through a published share link. No system is perfectly secure, and we do not claim certifications such as SOC 2 or ISO 27001 that we have not obtained.

International transfers

Our infrastructure and sub-processors may process data in countries other than yours. Where required, we rely on appropriate safeguards such as standard contractual clauses with our providers. Contact us if you need details for a specific transfer.

Children

Launchkit is a business tool and is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it.

Changes to this policy

We may update this policy as the product changes. When we do, we will revise the “Last updated” date above. If a change materially affects how we use your data, we will provide a clearer notice in the app or by email before it takes effect.

Contact

Privacy questions and data requests: [email protected].