Legal

Privacy Policy

Last updated: July 6, 2026

GDPR · CCPA Compliant

Data We Collect How We Use It Sub-Processors Cookies Data Retention Your Rights International Transfers

Short version: We collect only what we need to run the marketplace (your email, payment info, and IP), we never sell your data, and you can request deletion at any time by emailing support@launchstruc.com.

1. Data We Collect

We collect the minimum data needed to operate LaunchStruc — no more. Here is exactly what we collect and why:

Account Data

–Email address (required for account creation)
–Display name (optional)
–Profile photo (if using Google/GitHub OAuth)
–Authentication method (email, Google, GitHub)

Transaction Data

–Billing name and email address
–Billing country and postal code
–Payment method type (card brand, last 4 digits)
–Purchase history and download timestamps

Technical / Network Data

–IP address (at registration and checkout)
–Browser user-agent string
–HTTP referrer and page visit timestamps
–Download event logs (IP + timestamp)

What We Do NOT Collect

–Full credit card numbers or CVV codes
–Government IDs or social security numbers
–Phone numbers (never required)
–Location tracking or device identifiers

Why do we store IP addresses? IP addresses captured at registration and checkout are stored exclusively as fraud prevention evidence and to comply with digital goods payment processor (Stripe) requirements for dispute resolution. They are never used for advertising or sold to third parties.

2. How We Use Your Data

Product Delivery

To authenticate your account and grant you access to purchased source code via secure, time-limited download links.

Payment Processing

To create and manage your Stripe customer record, process payments, and send order confirmation emails.

Fraud & Dispute Prevention

To maintain immutable download logs and IP records that serve as proof-of-delivery evidence in the event of a payment dispute.

Transactional Emails

To send OTPs, magic links, and order receipts via Resend. We do not send unsolicited marketing emails.

Platform Security

To detect and prevent abuse, rate-limit bot traffic via Cloudflare Turnstile, and block disposable email signups.

Analytics (opt-in only)

Vercel Analytics and Speed Insights are loaded only if you have given explicit cookie consent. No data is collected without consent.

3. Third-Party Sub-Processors

We share your data with the following sub-processors only to the minimum extent required to operate our services. All sub-processors are bound by contractual data protection obligations.

ProviderPurposeLocation

NeonDatabase & AuthUSA (AWS us-east-1)

StripePayment processingUSA / Global

CloudflareCDN, Turnstile CAPTCHA, R2 storageUSA / Global

ResendTransactional email deliveryUSA

VercelHosting & optional analytics (consent-gated)USA

We do not sell, rent, or trade your personal data to any third party for advertising, marketing, or any other commercial purpose.

4. Cookies & Tracking

We use a strictly categorized cookie approach in compliance with GDPR and CCPA:

Strictly Necessary

Session authentication cookies set by Neon Auth. These are essential for login and cannot be disabled.

Functional

Cookie consent preference storage (remembers your choice for 12 months). Set on first visit.

Analytics (opt-in)

Vercel Analytics — only loaded if you click "Accept All" in our Cookie Consent banner. Tracks page views and performance metrics.

You can change your cookie preferences at any time using the Cookie Settings button in the page footer.

5. Data Retention

Account dataUntil account deletion is requestedEmail, name, auth method

Transaction records7 yearsRequired for tax/accounting compliance

Download logs7 yearsRequired for Stripe dispute evidence

IP addresses2 yearsFraud prevention and dispute resolution

Analytics data90 daysVercel rolling window (if consented)

Transaction records and download logs are retained for 7 years to satisfy US tax law requirements and Stripe dispute evidence obligations — even after account deletion. All other data is deleted upon verified request.

6. Your Rights (GDPR & CCPA)

Depending on your location, you have the following rights regarding your personal data. To exercise any of these rights, email support@launchstruc.com. We will respond within 30 days.

Right of Access

Request a copy of all personal data we hold about you.

Right to Rectification

Request correction of inaccurate or incomplete data.

Right to Erasure

"Right to be Forgotten" — request deletion of your account and data (subject to legal retention obligations).

Right to Restriction

Request that we limit processing of your data.

Right to Portability

Receive your data in a structured, machine-readable format.

Right to Object

Object to processing based on legitimate interests.

Opt-out of Sale (CCPA)

We never sell your data — this right is automatically honored.

Withdraw Consent

Withdraw consent for analytics cookies at any time via Cookie Settings.

7. International Data Transfers

LaunchStruc LLC is headquartered in the United States. If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, your personal data may be transferred to and processed in the United States and other countries.

Such transfers are conducted in accordance with EU Standard Contractual Clauses (SCCs) and applicable GDPR transfer mechanisms. All sub-processors listed in Section 3 participate in recognized compliance frameworks (e.g., EU-US Data Privacy Framework, SCCs).

EEA/UK residents who believe their data has been processed in violation of applicable law may lodge a complaint with their local Supervisory Authority (e.g., the ICO in the UK, or a national DPA in the EU).

Privacy questions? Email support@launchstruc.com