Privacy Policy

1. Who we are

SaasStarter (“we”, “our”, “us”) is a software company providing a production-ready SaaS starter kit. Our registered address and Data Protection Officer (DPO) can be contacted at dpo@saastarter.dev.

2. Data we collect

• Account data: name, email address, profile image (from OAuth provider).
• Usage data: pages visited, features used, session duration (analytics — only with consent).
• Payment data: billing address, invoice history. Card numbers are processed exclusively by Stripe — we never store them.
• Technical data: IP address, browser type, device type, referring URL.
• Communication data: emails you send us and support tickets.

3. Legal basis for processing (GDPR Art. 6)

• Contract (Art. 6(1)(b)): account data and payment data — necessary to provide the service.
• Legitimate interests (Art. 6(1)(f)): technical data for security and fraud prevention.
• Consent (Art. 6(1)(a)): analytics and marketing cookies — only after you opt in via our cookie banner.
• Legal obligation (Art. 6(1)(c)): invoices and tax records retained for statutory periods.

4. How we use your data

• Delivering and improving the service
• Processing payments and managing subscriptions (Stripe)
• Sending transactional emails: welcome, invoices, password reset (Resend)
• Security monitoring and fraud detection
• Analytics — only when you have consented

5. Data sharing

We share your data only with the following sub-processors:

• Stripe — payment processing. DPA
• Resend — transactional email. Privacy policy
• Vercel — hosting and edge functions. DPA
• Neon — PostgreSQL database. Privacy policy

We do not sell your personal data to any third party.

6. Data retention

Account data is retained for the duration of your contract and deleted within 90 days of your account deletion request. Audit logs are retained for 2 years for security purposes. Tax records are retained for the period required by applicable law (typically 7 years).

7. Your rights (GDPR)

Under GDPR you have the right to:

• Access — request a copy of your data
• Rectification — correct inaccurate data
• Erasure — “right to be forgotten”
• Portability — receive your data in machine-readable format
• Restriction — limit how we process your data
• Objection — object to processing based on legitimate interests
• Automated decision-making — right not to be subject to solely automated decisions

Exercise these rights at Settings → Privacy in the app, or by emailing privacy@saastarter.dev. We respond within 30 days.

8. CCPA rights (California)

• Right to know what personal information we collect
• Right to delete your personal information
• Right to opt-out of sale of personal information (we do not sell personal data)
• Right to non-discrimination for exercising your rights

9. DPDPA 2023 (India)

Under the Digital Personal Data Protection Act 2023, you may withdraw consent at any time via Settings → Privacy. Grievance Officer: grievance@saastarter.dev. Complaints must be acknowledged within 48 hours and resolved within 30 days.

10. Cookies

We use essential cookies required for the service to function, and optional analytics and functional cookies with your consent. See our Cookie Policy for the full inventory.

11. International data transfers

Your data may be transferred to and processed in the United States. We rely on the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) as the legal basis for such transfers. A copy of the SCCs is available on request.

12. Changes to this policy

We will notify you of material changes by email and by posting a notice in the app at least 30 days before the change takes effect. Continued use of the service after the effective date constitutes acceptance.

13. Contact

Data Protection Officer: dpo@saastarter.dev.
You also have the right to lodge a complaint with your local data protection authority.