§1Who is responsible
SafeLaunch is operated by Adnah India Consulting LLP (LLPIN ACF-7528), a limited liability partnership registered in India, with its registered office at New Delhi, India. Adnah India Consulting LLP is the controller (data fiduciary) of the personal data described here.
Privacy contact and grievance officer: hello@raghavrhanda.com. We reply within one month, and sooner where local law requires.
§2What we collect, why, and on what legal basis
Account data — email address, and if you sign in with Google or Apple, your name and account identifier. Used to create and secure your account and send you your reports. Basis: performance of our contract with you.
Audit content — the URLs, repositories, files and app packages you submit, your jurisdiction and questionnaire answers, and the resulting reports. Used only to produce and show you your reports. Basis: contract. Zip files and app packages are unpacked in your browser; only text source files, or for apps a summary of permissions and SDKs, are sent to us. Secrets we detect are redacted before anything is stored.
Version fingerprints and verification records — the commit SHA or SHA-256 fingerprints of what was scanned, file names and hashes, the date, rulebook version, results and any exceptions you recorded. Used so a verification can be checked later. Basis: contract, and our legitimate interest in keeping accurate records. A verification record (project name, version, date, result and exceptions) is visible to anyone who has its link.
Purchase data — what you bought, when and for how much, and your billing country. Card details are collected by Paddle, our Merchant of Record, and never reach us. Basis: contract and legal obligations (tax and accounting).
Technical data — a hashed form of your IP address for rate limiting, and standard server logs. Used to keep the service secure and prevent abuse. Basis: legitimate interests.
Messages you send us. Used to respond. Basis: legitimate interests, or contract where it relates to an order.
We do not use your data for advertising, we do not sell or share it for cross-context behavioural advertising, and we do not use your code or reports to train AI models.
§3Who receives it
Service providers that process data for us under contract: Lovable (hosting, database and authentication); our AI model providers — currently Google Gemini via Lovable AI, and Anthropic or OpenAI if enabled — which process audit content to write parts of your report and are not permitted to train on it; Resend (email delivery); Cloudflare (network and DNS resolution of sites you ask us to scan); and, only if you use those features, GitHub (repository access) and a browser-rendering provider.
Paddle.com, which acts as Merchant of Record for all orders and receives the data needed to process payments, taxes and refunds as an independent controller under its own privacy notice.
AI assistants you choose to connect (for example Claude Code, Cursor or another MCP client, through an API token or the sign-in consent screen) can read your audits and reports on your behalf until you revoke access in Account settings.
Professional advisers (lawyers, accountants, auditors) where needed, and courts, regulators or law-enforcement authorities where the law requires it.
§4International transfers
Our providers process data in several countries, including the United States, the European Union and India, so your data may be processed outside the country where you live. Where the law requires it, transfers are protected by an adequacy decision, Standard Contractual Clauses (or the UK International Data Transfer Addendum), or an equivalent safeguard.
§5How long we keep it
Account data, audits and reports: until you delete them or your account. You can delete any audit from your dashboard and your whole account from Account settings at any time.
Code excerpts used for AI analysis: deleted as soon as your report is written. Hashed rate-limit counters: up to two days.
Purchase records: Paddle, our Merchant of Record, keeps transaction records for as long as tax law requires. Our own order records are deleted with your account.
Verification records: kept after account deletion, detached from your account, because they are the evidence of what was verified and when and may be needed to establish or defend legal claims.
§6Your rights
Depending on where you live, you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent where we rely on consent. You can download all your data and delete your account yourself from Account settings, or write to us.
We respond within one month. You may complain to your data protection authority — for example your EU or UK supervisory authority, or the Data Protection Board of India — and Indian users may first raise a grievance with our grievance officer at the address above.
Residents of US states with privacy laws can use the same rights; we do not sell or share personal data, and we honour Global Privacy Control signals.
§7Security
We protect your data with encryption in transit, access controls and row-level security in our database, server-only storage of full reports, hashed API tokens and IP addresses, and redaction of detected secrets. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as the law requires.
§8Cookies and local storage
We use only strictly necessary browser storage: to keep you signed in and to remember your light or dark theme. We do not use analytics, advertising or cross-site tracking cookies, so we do not show a cookie banner. Paddle's checkout may set its own cookies when you pay; see Paddle's notice.
§9Children
SafeLaunch is for people aged 18 and over and is not directed at children.
§10Changes
We will post any change here and update the date above, and tell you by email before a material change takes effect.