Legal
Privacy Policy
Last updated:
What personal data LaunchOS handles, why, who helps us process it, how long we keep it and how you can control it. In short: we use account data to run the service, we process our customers' data only on their instructions, and we never sell personal data.
Template notice. This document is a template written for the LaunchOS product. It must be reviewed and adapted by qualified legal counsel before LaunchOS is used in production.
1.Who we are and what this covers
LaunchOS (“LaunchOS”, “we”, “us”) provides an online workspace that creators, brands, producers, media buyers and affiliates use to run digital product launches. This policy explains how we handle personal data in two different roles.
When we are the controller
We decide how and why we use account data: information about people who visit our website, sign up, are invited to a workspace, contact us or pay for a subscription. This policy fully applies to that data.
When we are a processor
Our customers put data about their own customers, leads, students, affiliates and contacts into LaunchOS, or bring it in from accounts they connect. For this customer data the customer is the controller and we are their processor (“operator” under Brazil's LGPD, “service provider” under the CCPA). We process it only on the customer's instructions and under our Terms of Service and any data processing agreement. If you bought from, studied with or promoted one of our customers, their privacy notice applies, and you should contact them first. We'll help them respond.
2.Personal data we collect
Account data (we are the controller)
- Account and profile: name, email address, password (stored only as a secure hash by our authentication provider), profile picture, language, time zone and the workspaces and roles you belong to.
- Organization and billing: workspace name and address, plan, billing contact, billing address, tax ID and invoices. Card details are collected directly by Stripe. We never receive or store full card numbers.
- Usage and device: IP address, browser and device type, pages and features used, timestamps, active sessions, security events and the audit log of actions in your workspace.
- Consent records: your acceptance of our terms and privacy policy and your cookie choices, with the version, date and browser user agent.
- Communications: messages you send to us, support requests and feedback.
Customer data (we are a processor)
- Commerce: orders, refunds, abandoned checkouts and customer records (such as name, email, phone number and purchase history) received from the checkout providers a customer connects.
- Affiliates and students: affiliate profiles, commissions and payout notes; course enrollments, lesson progress, comments, questions and live event registrations.
- Support conversations: WhatsApp and Instagram messages, profile names and handles of people who message a customer, and internal notes.
- Marketing and tracking: ad account metrics, content, files, tracked-link clicks (a click identifier, referring site, landing page, device type and country; we don't store the raw IP address of a link click) and, only where the visitor has consented, a visitor identifier.
- Integration credentials: API keys and access tokens for connected accounts, stored encrypted.
3.How we use data and our legal bases
We use account data only for the purposes below. Where the GDPR or LGPD applies, each purpose relies on the legal basis shown.
Create and run your account and workspace, sign you in
- Data used
- Account, organization, usage
- Legal basis
- Performance of a contract
Bill subscriptions, issue invoices, meet tax rules
- Data used
- Billing, organization
- Legal basis
- Contract; legal obligation
Keep LaunchOS secure: authentication, rate limiting, fraud prevention, audit logs
- Data used
- Usage and device, audit log
- Legal basis
- Legitimate interests (security); legal obligation
Send service emails: verification, password resets, invitations, billing and security notices
- Data used
- Account
- Legal basis
- Performance of a contract
Answer support requests
- Data used
- Communications, account
- Legal basis
- Contract; legitimate interests
Understand and improve the product in aggregate
- Data used
- Usage (aggregated)
- Legal basis
- Legitimate interests; consent for analytics cookies
Send news about LaunchOS
- Data used
- Name, email
- Legal basis
- Consent where required, otherwise legitimate interests; opt out any time
Comply with the law and enforce our terms
- Data used
- As needed
- Legal basis
- Legal obligation; legitimate interests
We process customer data only to provide LaunchOS to the customer who controls it, on their instructions. We don't sell personal data, we don't share it for cross-context behavioral advertising, and we don't use customer data for our own marketing. We don't make decisions that produce legal or similarly significant effects about you based solely on automated processing.
5.International transfers
Our sub-processors and the providers customers connect may process data outside your country, including in the United States. When we transfer personal data from the European Economic Area, the United Kingdom, Switzerland or Brazil, we rely on an adequacy decision where one exists, or on the European Commission's Standard Contractual Clauses (with the UK addendum where relevant) or the standard contractual clauses approved by Brazil's data protection authority (ANPD), together with safeguards such as encryption in transit and at rest. You can ask us for a copy of the relevant safeguards at privacy@launchos.app.
6.How long we keep data
Account and profile
- Retention
- While your account exists. Deleted after you delete your account and the grace period ends.
Workspace and customer data
- Retention
- While the organization exists, or until the customer deletes it. Deleted after the organization is deleted and the grace period ends.
Invoices and billing records
- Retention
- As long as tax and accounting law requires, typically 5 to 10 years depending on the country.
Audit log
- Retention
- For the life of the organization.
Server and security logs
- Retention
- Up to 90 days, longer only while needed to investigate an incident.
Consent records
- Retention
- As long as needed to show what was agreed, and up to 5 years after consent is withdrawn or replaced.
Data export files
- Retention
- Available for a limited time shown in the app, then deleted automatically.
Backups
- Retention
- Overwritten on a rolling cycle of up to 30 days.
Customers control how long their customer data is kept and can delete records at any time. When retention ends, we delete data or anonymize it so it can no longer identify anyone.
7.How we protect data
- Organization isolation: every table that holds workspace data is protected by Postgres row-level security, so one organization can't read another's data even through the API.
- Encryption: data is encrypted in transit with TLS and at rest by our infrastructure providers. Integration secrets are additionally encrypted with AES-256-GCM using a key kept outside the database and are never sent to the browser.
- Access control: role-based permissions inside each workspace; support access by LaunchOS staff is time-limited, read-only, requires a recorded reason and is written to the audit log.
- Accountability: sensitive actions are recorded in an append-only audit log that workspace owners can review.
- Safe defaults: private file storage served through expiring signed links, verified webhook signatures, rate-limited sign-in and public endpoints, email verification and session management.
No system is perfectly secure. If a personal data breach affects you, we'll notify affected customers without undue delay and notify authorities and individuals where the law requires.
8.Your privacy rights
Depending on where you live, you have some or all of the following rights.
European Economic Area, United Kingdom and Switzerland (GDPR)
You can access your data, correct it, delete it, restrict or object to its processing (including objecting to direct marketing at any time), receive it in a portable format, and withdraw consent without affecting earlier processing. You can also complain to your local data protection authority.
Brazil (LGPD)
You can confirm whether we process your data, access and correct it, ask for anonymization, blocking or deletion of unnecessary or unlawfully processed data, request portability, learn which entities we share data with, be told about the option to refuse consent and its consequences, revoke consent, and petition the ANPD.
California and other US states (CCPA/CPRA and similar laws)
You can know what personal information we collect, use and disclose, access it, correct it and delete it. You have the right to opt out of the sale or sharing of personal information; we don't sell or share it, and we don't use sensitive personal information to infer characteristics about you. We treat a Global Privacy Control signal from your browser as a request to opt out of analytics and attribution cookies for that browser. We won't discriminate against you for exercising your rights, and you can use an authorized agent.
In the last 12 months we collected the categories described in Personal data we collect: identifiers, commercial information, internet activity, approximate (country-level) location and professional information, from you, your organization, your devices and the providers you connect, for the purposes in How we use data.
9.How to exercise your rights
- In the app: under Account settings, download your personal data as a JSON file, review your consents, sign out other sessions or delete your account. Organization owners can export the workspace as CSV files or delete the organization from the organization's settings.
- By email: write to privacy@launchos.app from the address on your account, or tell us how to verify your identity.
We respond within the time the law sets, usually within one month (15 days for LGPD confirmation and access requests, 45 days under the CCPA), and tell you if we need more time. If you're a customer, student, affiliate or contact of one of our customers, send your request to that customer. If you send it to us, we'll pass it on to them.
10.Children
LaunchOS is a business tool and isn't directed at children. Account holders must be at least 18. We don't knowingly collect personal data from children under 13, or under 16 in the EEA and UK. Customers who offer courses or events to minors through LaunchOS are responsible for obtaining any parental consent the law requires. If you believe a child has given us personal data, contact privacy@launchos.app and we'll delete it.
11.Changes to this policy
We'll update this policy when our practices change. The date at the top shows the current version. If a change is material, we'll tell you by email or in the app before it takes effect and, where the law requires, ask for your consent again.
12.Contact
For any privacy question or request, including for our data protection contact (the “encarregado” under the LGPD), email privacy@launchos.app. Cookie details are in the Cookie Policy.