LaunchSign
Pricing
Start free

Last updated: 8 August 2026

Privacy Policy

This Privacy Policy describes how Albert M. Morales Palleja, a sole trader (empresario individual / autónomo) established in Spain, NIF 53073266F, operating under the trade name LaunchSign(“LaunchSign”, “we”, “us”, or “our”), Calle Girona 161, 08402 Granollers, Barcelona, Spain, collects and processes personal data in connection with the LaunchSign service (launchsign.io).

We are subject to the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (“LOPDGDD”).

1. Data controller

The data controller for the processing described in this policy is:
Albert M. Morales Palleja (sole trader / empresario individual)
Trade name: LaunchSign
NIF: 53073266F · EU VAT: ES53073266F
Calle Girona 161, 08402 Granollers, Barcelona, Spain
Phone: +34 902 002 373
Email: privacy@launchsign.io

2. Personal data we collect

We collect personal data in the following circumstances:

  • Account registration: name, email address, password (hashed), and optionally your organisation name and role.
  • Service use: campaign content you create, files you upload, comments and annotations, and approval decisions.
  • Guest access: when an external reviewer accesses a shared review link, we record their approval decision and any feedback they submit. No account is required; we do not knowingly collect additional personal data from guests beyond what they voluntarily provide.
  • Billing: name, billing address, and payment method details. Payment card data is handled directly by Stripe and never stored on our servers.
  • Technical data: IP address, browser type, operating system, referring URLs, and usage telemetry (page views, feature interactions) collected via server logs and, if you consent, analytics cookies.
  • Communications: emails or messages you send to our support address.

3. Legal basis for processing

We rely on the following legal bases under Article 6 GDPR:

  • Contract performance (Art. 6(1)(b)): processing necessary to provide the LaunchSign service you have subscribed to, including account management, campaign production features, and billing.
  • Legitimate interests (Art. 6(1)(f)): fraud prevention, service security, product analytics to improve the service, and communicating with you about material changes to the service. Our legitimate interests do not override your rights where you have a reasonable expectation of privacy.
  • Legal obligation (Art. 6(1)(c)): retaining billing records as required by Spanish tax law (generally seven years).
  • Consent (Art. 6(1)(a)): for non-essential cookies and marketing communications. You may withdraw consent at any time without affecting prior processing.

4. How we use your data

  • Providing and maintaining the LaunchSign service
  • Processing payments and managing subscriptions
  • Sending transactional emails (welcome, approval notifications, billing receipts)
  • Responding to support requests
  • Detecting and preventing fraud and abuse
  • Improving the product based on aggregate, anonymised usage data
  • Complying with legal obligations

We do not sell personal data to third parties. We do not use your data for automated decision-making that produces legal or similarly significant effects.

5. Data sharing and sub-processors

We share personal data only with sub-processors necessary to deliver the service. Our primary sub-processors are:

  • Supabase, Inc. (database, authentication, file storage), EU region (AWS eu-west-1, Ireland)
  • Vercel, Inc. (application hosting), EU region where selected
  • Stripe, Inc. (payment processing), EU data region
  • Resend, Inc. (transactional email)

All sub-processors are bound by data processing agreements that require them to apply appropriate technical and organisational security measures. Where sub-processors are located outside the EU/EEA, transfers are governed by the EU Standard Contractual Clauses (SCCs) or an adequacy decision.

We may also disclose data where required by law, court order, or to protect the rights, property, or safety of LaunchSign, our users, or others.

6. Data retention

We retain personal data for as long as your account is active or as needed to provide the service. Upon account deletion, we delete or anonymise personal data within 30 days, except where retention is required by legal obligation (e.g., billing records retained for seven years under Spanish tax law).

Campaign content and approval records may be retained for a longer period if required under a Data Processing Agreement with a customer acting as data controller (see Section 9).

7. Your rights under GDPR

You have the following rights regarding your personal data:

  • Access (Art. 15): obtain confirmation of whether we process your data and receive a copy.
  • Rectification (Art. 16): correct inaccurate or incomplete data.
  • Erasure (Art. 17): request deletion of your data, subject to legal retention requirements.
  • Restriction (Art. 18): request that we restrict processing in certain circumstances.
  • Portability (Art. 20): receive your data in a structured, machine-readable format.
  • Objection (Art. 21): object to processing based on legitimate interests, including direct marketing.
  • Withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, email privacy@launchsign.io. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish data protection authority (AEPD) at www.aepd.es.

8. Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, disclosure, or access. These include encryption in transit (TLS) and at rest, role-based access controls, and regular security reviews.

No transmission over the internet is completely secure. We cannot guarantee absolute security, but we take reasonable steps to protect your data and will notify you and the relevant supervisory authority of any breach as required by GDPR.

9. Data processing on behalf of customers

When you use LaunchSign on behalf of your organisation to process personal data of third parties (for example, campaign audiences or guest reviewers), you act as the data controller and LaunchSign acts as a data processor. In this capacity, we process such data only on your documented instructions. A Data Processing Agreement (DPA) governs this relationship; please see our DPA page for details and to request execution.

10. Cookies

We use cookies and similar technologies. For full details, including how to manage your preferences, see our Cookie Policy.

11. Children

LaunchSign is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users by email and update the “Last updated” date at the top of this page. Your continued use of LaunchSign after changes take effect constitutes acceptance of the revised policy.

13. Contact

Questions about this policy or your personal data: privacy@launchsign.io