• Account data: your email address and profile name, collected when you sign in via magic link.
• Product submissions: product name, description, categories, logos, screenshots, pricing, maker name, and website URL.
• Contributions: votes, reviews, and ratings you post.
• Usage & technical data: IP address, browser type, referrer, and page interactions, used for security and to keep votes fair.
• Payment data: if you buy a placement, our payment provider processes your payment. We receive confirmation and basic order details, not your full card number.

We only process your data where we have a lawful basis under the GDPR:

• Contract: to create your account, publish your listings, run tournaments, and deliver paid placements.
• Legitimate interests: to secure the platform, prevent vote manipulation and fraud, and improve the Services — balanced against your rights.
• Consent: for any optional marketing emails, which you can withdraw at any time.
• Legal obligation: to keep tax and transaction records where the law requires it.

We never sell your personal data. We share it only with trusted service providers who process it on our behalf, under contract:

• Supabase — database, authentication, and file storage.
• Cloudflare — hosting, content delivery, and security.
• Dodo Payments — payment processing (merchant of record) for placements.
• Resend — transactional email delivery (magic links, notifications).

Some providers are located outside the EEA/UK. Where personal data is transferred internationally, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

• Account and listing data: for as long as your account is active.
• After you delete your account: removed or anonymised within 30 days, except where we must keep records longer.
• Payment and tax records: retained for the period required by law (typically several years).
• Security logs: kept for a limited period, then deleted.

We use only strictly necessary cookies — to keep you signed in and to record that a vote was cast. These are essential to run the Services and do not require consent. We do not use advertising or cross-site tracking cookies. If we introduce analytics or marketing cookies in future, we will ask for your consent first.

We use technical and organisational measures to protect your data. All connections use TLS encryption, access to production data is restricted, and payments are handled by our provider — we never store your full card details. No system is completely secure, but we work to keep your data safe and will notify affected users and regulators of a breach where the law requires.

Depending on where you live, you have the right to:

• Access, correct, or delete your personal data.
• Portability: receive a copy of your data in a portable format.
• Object or restrict: object to processing based on legitimate interests, and opt out of marketing.
• Withdraw consent at any time, without affecting prior processing.

To exercise any right — including deleting your account and data — email support@launchnest.io and we will respond within the time the law allows (usually one month). You also have the right to lodge a complaint with your local data protection authority (in the EU, your national supervisory authority).