Privacy Policy | GenerateSaaS

DRAFT: not legal advice. Must be reviewed by a qualified attorney before publication. Jurisdiction/governing-law marked TODO.

Your privacy is important to us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

This Privacy Policy ("Policy") describes the privacy practices of GenerateSaaS ("we," "us," "our," "Company"), a company registered at (Registration No: ), in connection with GenerateSaaS (https://generatesaas.com), including all associated websites, applications, and services (collectively, the "Service"). As the data controller, we are responsible for determining the purposes and means of processing your personal data.

By accessing or using the Service, you acknowledge that you have read, understood, and consent to the data practices described in this Policy. If you do not agree with this Policy, please do not access or use the Service.

1. Information We Collect

We collect information in several ways: directly from you, automatically through your use of the Service, and from third-party sources.

1.1 Information You Provide Directly

Account Information:

Name, email address, and username
Password and security credentials
Profile picture and biographical information
Phone number (if provided)
Organization name and role (for team accounts)

Billing and Payment Information:

Billing name and address
Payment method details (credit card number, expiration date, CVV)
Tax identification numbers (VAT, GST, etc.)
Transaction history and invoices

Note: Payment information is processed by our third-party payment processor(s) and is not stored on our servers except as necessary for record-keeping.

Communications:

Messages you send through the Service
Support inquiries and correspondence
Survey responses and feedback
Testimonials and reviews (with your consent)

User Content:

Files, documents, and data you upload
Content you create, share, or store on the Service
Comments, notes, and annotations

1.2 Information Collected Automatically

Device and Browser Information:

Device type, model, and manufacturer
Operating system and version
Browser type and version
Screen resolution and display settings
Device identifiers (including advertising identifiers)

Usage Information:

Pages and features accessed
Time spent on pages and features
Clicks, scrolls, and interactions
Search queries within the Service
Date and time of access
Referring and exit pages

Network and Location Information:

IP address
Internet service provider
General geographic location (city, region, country)
Time zone settings

Cookies and Similar Technologies:

Session cookies and persistent cookies
Pixel tags (web beacons)
Local storage and session storage
Mobile advertising identifiers

For more information about our use of cookies, please see our Cookie Policy.

1.3 Information from Third Parties

OAuth and Social Login Providers: When you choose to log in using a third-party service (such as Google, GitHub, or Microsoft), we receive basic profile information as authorized by you through that service.

Payment Processors:

Transaction status and confirmation
Fraud prevention and verification data
Chargeback and dispute information

Analytics and Advertising Partners:

Aggregated usage statistics
Attribution and conversion data
Ad performance metrics

1A. Boilerplate, CLI, and License Telemetry

This section is specific to the GenerateSaaS boilerplate/CLI product (the "Software") licensed under our End User License Agreement. It discloses the data collected by the license authority and the telemetry sent by the CLI and by Derivative Products you build and deploy. This data collection is described and consented to in Section 8 of the EULA.

When you purchase, install, run, or operate the Software, we collect the following data in addition to the categories above.

1A.1 Purchase and License Data

Account email: the email address associated with your buyer account, used to issue and deliver your license key and to contact you about your license.
Stripe payment metadata: transaction and order metadata received from our payment processor (Stripe), such as the plan/tier purchased, amount, currency, purchase date, payment/charge status, and refund or dispute status. (Full card details are handled by Stripe and are not stored on our servers; see Section 1.1.)

1A.2 CLI and License-Validation Telemetry

The CLI contacts our license authority on each init and refresh to validate your license key and determine your entitlements. Each such request is logged and may include:

IP address of the request;
Install identifier (a per-install UUID, "install id");
Project name you supplied for the scaffolded project;
Frontend/framework selected, and the CLI/Software version;
The configuration options selected for that request (e.g., architecture, deploy target, database, cache, payments, email, feature flags, and similar selections); and
The associated license key reference (stored hashed; we do not store your raw key after issuance).

1A.3 Heartbeat (Phone-Home) Telemetry

Derivative Products you build and deploy include a periodic heartbeat that contacts us. Each heartbeat may include:

IP address of the request;
Install id (the per-install identifier);
Install domain: the hostname where the Derivative Product is deployed;
Frontend/framework and version; and
The revenue-sharing opt-in flag: a buyer-controlled setting that is disabled by default (off) and is only sent as enabled if you choose to opt in.

1A.4 Why We Collect This Data (Purpose)

We process the data in this Section 1A to:

Detect license abuse and source leakage (anti-abuse / anti-leak enforcement of the EULA);
Validate license keys and determine entitlements (which Tier, update window, allowed frameworks, and rights apply);
Provide geo/currency selection (deriving general location from IP to choose the appropriate currency); and
Produce active-install and usage analytics to understand how the Software is used and to improve it.

The lawful bases for this processing (for EEA/UK/Swiss users) are performance of the license contract (key validation and entitlements), our legitimate interests (anti-abuse, anti-leak, security, and analytics), and, where applicable, your consent (e.g., the revenue-sharing opt-in).

1A.5 Retention

License-validation and heartbeat telemetry (including IP address, install id, domain, project name, framework, version, options, and the heartbeat flags) are retained for as long as reasonably necessary for the purposes above, including active-install analytics and abuse/leak investigation, and are then deleted or aggregated/anonymized. Purchase and license records are retained in line with the billing and transaction retention period in Section 6. Specific retention periods will be finalized on legal review (TODO).

2. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, we process your personal data under the following legal bases:

Contractual Necessity:

To create and manage your account
To provide the Service you have requested
To process payments and fulfill subscriptions
To provide customer support

Legitimate Interests:

To improve and develop our Service
To analyze usage patterns and optimize performance
To prevent fraud and ensure security
To send service-related communications
To protect our legal rights

Consent:

To send marketing communications
To use cookies for analytics and advertising
To process special categories of data (if applicable)
To transfer data internationally (where consent is required)

Legal Obligation:

To comply with applicable laws and regulations
To respond to lawful requests from authorities
To maintain records as required by law

You may withdraw your consent at any time where we rely on consent as the legal basis for processing. Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal.

3. How We Use Your Information

3.1 Providing and Maintaining the Service

Creating, managing, and authenticating your account
Processing transactions and managing subscriptions
Delivering the features and functionality you request
Storing and managing your User Content
Providing technical support and responding to inquiries

3.2 Improving and Developing the Service

Analyzing usage patterns to improve features
Conducting research and analysis
Developing new products, features, and services
Testing and debugging
Training machine learning models (using aggregated or anonymized data)

3.3 Communications

Sending transactional emails (account confirmations, password resets, receipts)
Providing service updates and administrative notifications
Sending marketing communications (with your consent or as permitted by law)
Responding to your inquiries and support requests
Sending surveys and requesting feedback

3.4 Security and Fraud Prevention

Detecting, investigating, and preventing fraudulent transactions and abuse
Monitoring for security threats and vulnerabilities
Enforcing our Terms of Service
Verifying user identity
Protecting against unauthorized access

3.5 Legal and Compliance

Complying with applicable laws, regulations, and legal processes
Responding to lawful requests from government authorities
Establishing, exercising, or defending legal claims
Enforcing our agreements and policies

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

4.1 Service Providers

We share information with third-party vendors, consultants, and service providers who perform services on our behalf, including:

Cloud hosting and infrastructure providers
Payment processors and billing services
Email delivery services
Customer support platforms
Analytics providers
Security and fraud prevention services

These service providers are bound by contractual obligations to protect your information and may only use it for the purposes for which it was disclosed.

Sub-Processor Changes: We maintain a list of sub-processors who process personal data on our behalf. We will provide you with reasonable advance notice of any intended changes to our sub-processors, either through email notification or by updating the list on our website. If you have objections to a new sub-processor, you may contact us to discuss your concerns. A current list of our sub-processors is available upon request.

4.2 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of company assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

4.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal process, including:

Court orders and subpoenas
Requests from law enforcement or government agencies
Legal proceedings and litigation
National security requests

4.4 Protection of Rights

We may disclose information when we believe disclosure is necessary to:

Protect our rights, property, or safety
Protect the rights, property, or safety of our users or the public
Investigate potential violations of our Terms of Service
Detect, prevent, or address fraud, security, or technical issues

4.5 With Your Consent

We may share your information with third parties when you have given us your explicit consent to do so.

4.6 Aggregated or Anonymized Data

We may share aggregated or anonymized information that cannot reasonably be used to identify you.

5. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your jurisdiction.

5.1 Transfer Safeguards

When we transfer personal data internationally, we implement appropriate safeguards:

Standard Contractual Clauses (SCCs): We use European Commission-approved Standard Contractual Clauses with our service providers to ensure adequate protection for data transferred outside the EEA.

Adequacy Decisions: We may transfer data to countries that have been recognized by relevant authorities as providing an adequate level of data protection.

Data Processing Agreements: We maintain data processing agreements with all third parties who process personal data on our behalf.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected:

Account Information: Retained for the duration of your account plus a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce agreements.

Billing and Transaction Data: Retained for a minimum of seven (7) years to comply with tax and accounting requirements.

Usage Data and Analytics: Typically retained for up to two (2) years for analysis and service improvement.

Communication Records: Support correspondence retained for up to three (3) years after resolution.

User Content: Retained until you delete it or for a reasonable period after account termination.

You may request deletion of your personal information at any time, subject to our legal obligations and legitimate business interests.

7. Data Security

We implement appropriate technical and organizational security measures:

7.1 Technical Measures

Encryption of data in transit using TLS/SSL
Encryption of data at rest using industry-standard algorithms
Secure password hashing
Multi-factor authentication options
Regular security testing and vulnerability assessments
Firewalls and intrusion detection systems
Access controls and role-based permissions

7.2 Organizational Measures

Employee training on data protection and security
Background checks for employees with access to personal data
Confidentiality agreements with employees and contractors
Incident response procedures
Regular security audits and reviews

While we strive to use commercially acceptable means to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure.

7.3 Security Incidents

In the event of a data breach that affects your personal information, we will notify you and the relevant authorities as required by applicable law.

8. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information:

Right to Access: Request a copy of the personal information we hold about you.

Right to Rectification: Request correction of inaccurate or incomplete personal information.

Right to Erasure: Request deletion of your personal information, subject to certain exceptions.

Right to Restriction: Request that we restrict the processing of your personal information.

Right to Data Portability: Receive your personal information in a structured, commonly used format.

Right to Object: Object to processing of your personal information for direct marketing or based on legitimate interests.

Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us at support@generatesaas.com. We will respond within the timeframe required by applicable law (typically 30 days).

Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. If we use automated decision-making, we will inform you and provide meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing. You may request human intervention, express your point of view, or contest any automated decision.

9. Rights for Specific Jurisdictions

9.1 European Economic Area, United Kingdom, and Switzerland (GDPR)

If you are located in the EEA, UK, or Switzerland, you have the rights described above, plus:

Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

9.2 United States Residents

California (CCPA/CPRA): If you are a California resident, you have the following rights:

Right to Know: Request information about personal information collected, sources, purposes, and third parties with whom it is shared
Right to Delete: Request deletion of personal information
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out: Opt out of the "sale" or "sharing" of personal information (Note: We do not sell personal information)
Right to Non-Discrimination: We will not discriminate against you for exercising your rights
Right to Limit Use of Sensitive Personal Information: You may limit our use of sensitive personal information to purposes necessary to provide the Service

Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and Other US State Laws: If you are a resident of a US state with comprehensive privacy legislation, you may have similar rights including:

Right to access, correct, and delete your personal data
Right to data portability
Right to opt out of targeted advertising, sale of personal data, and profiling
Right to appeal our decisions regarding your privacy requests

To exercise any of these rights, contact us at support@generatesaas.com. We will verify your identity before processing your request.

9.3 Brazilian Residents (LGPD)

If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados (LGPD), including access, correction, deletion, portability, and the right to revoke consent.

9.4 Canadian Residents (PIPEDA)

If you are located in Canada, you have rights under PIPEDA, including access, correction, and withdrawal of consent.

10. Children's Privacy

The Service is not intended for children under the age of 18 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal information from children.

If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us immediately.

11. Third-Party Links and Services

The Service may contain links to third-party websites, applications, or services that are not operated by us. This Privacy Policy does not apply to third-party services.

We encourage you to review the privacy policies of any third-party services you access. We are not responsible for the content, privacy practices, or data handling of third-party services.

12. Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) feature. There is no uniform standard for responding to DNT signals.

Currently, our Service does not respond to DNT signals. However, you can manage your privacy preferences through our cookie settings and the options described in this Policy.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

Notification of Changes:

We will post the updated Policy on the Service with a new "Last Updated" date
For material changes, we will provide additional notice via email or a prominent notice on the Service
We will obtain your consent where required by law

Your continued use of the Service after changes are posted constitutes your acceptance of the updated Policy.

14. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

GenerateSaaS (Data Controller)

Registration No:

Data Protection Inquiries: support@generatesaas.com

Website: https://generatesaas.com

Supervisory Authority: If you are located in the EEA, UK, or Switzerland and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

By using the Service, you acknowledge that you have read, understood, and consent to the practices described in this Privacy Policy.