Privacy Policy

1. Introduction & Scope

This Privacy Policy explains how Launchfolio Ltd ("we", "us", "our", or "Launchfolio") collects, processes, and protects personal data when you visit our websites, use the Launchfolio content management software, or access creator portals hosted on our infrastructure.

We are committed to creator sovereignty and audience privacy. We do not sell your personal data, and we do not deploy invasive cross-site advertising trackers or third-party behavioral surveillance scripts.

2. Roles and Data Ownership

Under data protection legislation (UK GDPR / EU GDPR):

• Launchfolio as Data Controller: We act as the Data Controller for account information belonging to creators and workspace owners who register to use our publishing platform.
• Launchfolio as Data Processor: For visitors and members who sign in to individual creator portals (e.g., commenting on protocols), the respective creator/tenant is the Data Controller, and Launchfolio acts as the Data Processor on their behalf in accordance with our Data Processing Addendum.

3. Information We Collect

3.1 Creator & Tenant Accounts

When you create an Launchfolio workspace, we collect your name, email address, workspace slug, and credential tokens necessary to connect your third-party social media channels (Instagram Graph API, Facebook Graph API, and YouTube Data API v3).

You can sign in with Google or with a one-time link we email you. If you ask for a sign-in link, we send it through our email provider, Brevo, and keep a record of the request (your email address, the time, and a one-way hash of your IP address) for one day so we can stop abuse. The link itself stops working after 15 minutes or once it is used.

3.2 Portal Members & Readers

When an audience member signs in to a creator portal, with Google or with a one-time link we email them, we receive:

• Display name and avatar URL (to display alongside discussion comments)
• Email address (hashed using a salted cryptographic function for secure member identification)
• Membership tier status
• Whether they asked to be emailed about new posts, and when

Members who sign in by email give us their email address and, if they choose, a display name. We send the sign-in link through our email provider, Brevo. The link works once and expires after 15 minutes, and we delete the request record after one day.

3.3 Telemetry & Analytics

Our static site generator includes a privacy-preserving analytics beacon. This beacon records high-level page views and content engagement without storing raw IP addresses or cross-site tracking cookies. Aggregated analytics are rolled up nightly and purged according to data retention limits.

3.4 Beta Applications

When you apply to join the Launchfolio beta, we collect your name, email address, the kind of content you make, and anything you choose to add (a social media link, your rough audience size, and what you would use Launchfolio for). We use these details only to review your application and to email you about the beta. We send these emails through our email provider, Brevo. If you are not offered a place, or are put on the waitlist, we delete your application after 12 months. You can ask us to delete it sooner by emailing privacy@launchfolio.app.

4. Social Media Integrations & API Usage

Launchfolio integrates with third-party platform APIs to allow creators to schedule and publish content directly:

• Meta (Instagram & Facebook): We store encrypted access tokens to publish media and carousel posts on your behalf. We do not access your private personal messages or non-authorized pages.
• Google & YouTube: When connecting YouTube, we request authorization via OAuth to upload video assets to your designated YouTube channel. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

5. Right to Erasure & User Data Deletion (GDPR Article 17)

We respect your absolute right to be forgotten. Any creator or portal member can request complete deletion of their personal data:

• Self-Service Erasure: Authenticated portal members can trigger automated account deletion and comment anonymization directly via their profile settings or by sending an authenticated DELETE request to /portal/members/me.
• Data Deletion Instructions: To request manual deletion of any personal data or credentials stored on Launchfolio, email our Data Protection team at privacy@launchfolio.app with the subject line "Data Erasure Request". Requests are fulfilled within 30 days.
• Tombstone Anonymization: When an account is deleted, all past public comments are replaced with an anonymous placeholder ("Deleted user"), and email hashes are permanently wiped from PostgreSQL storage.

6. Data Security & Storage

All credential tokens (including Meta page tokens and YouTube OAuth refresh tokens) are encrypted at rest using industry-standard AES-256-GCM authenticated encryption. Media assets are hosted in secure Cloudflare R2 object storage with scoped access permissions.

7. Contact Information

If you have questions about this Privacy Policy or wish to exercise your rights under GDPR or the UK Data Protection Act 2018, please contact:

Launchfolio Ltd — Data Protection Office
Email: privacy@launchfolio.app
General Inquiries: support@launchfolio.app