This Privacy Policy describes how AfterLaunch ("we," "us," or "our") collects, uses, and shares information when you use our service at afterlaunch.io (the "Service").
AfterLaunch is operated by AfterLaunch Technologies, with its principal place of business at D-704, Neelkanth Business Park, Mumbai 400086, India.
Email address: Required to deliver insights, briefs, and account access.
Business URL: The domain you submit so we can analyse it.
Account credentials: If you create an account, we store your email and a hashed password (we never see your actual password).
Voice samples: Writing samples you optionally provide so generated content matches your style.
Custom prompts: Any custom AI search queries you add (paid tier feature).
Communications: Any messages you send us by email or other means.
2.2 Information collected automatically
Usage data: Pages you visit, features you use, time spent, errors encountered.
Device information: Browser type, operating system, IP address (for security and rate limiting).
Cookies and similar identifiers: Essential cookies for authentication and session management, plus first-party and third-party analytics cookies and identifiers set by PostHog and Google Analytics 4 so we can understand how the site and product are used. We do not use advertising cookies and we do not sell your data.
2.3 Information generated by the Service
AI-generated content: Briefs, action drafts, snapshots, and SEO articles we generate for you.
Monitoring data: Information we observe about your business across the channels we monitor (AI search engines, Reddit, Hacker News, your competitors' public pages, etc.).
Engagement data: Whether you opened emails, clicked actions, marked actions complete.
Usage-metering records: A ledger of your included monthly allowance, top-up purchases, the metered actions you run, and any automatic credit refunds, kept so your balance and billing are accurate.
2.4 Information from Google accounts you connect
Connecting an analytics account is optional. If you choose to connect your Google Analytics or Google Search Console account, you authorise AfterLaunch to access that account on a read-only basis through Google's official OAuth consent flow. We request only the minimum scopes needed:
Google Analytics (scope: analytics.readonly): we read the traffic and engagement metrics for the property you select, such as sessions, users, and conversions.
Google Search Console (scope: webmasters.readonly): we read the search performance data for the site you select, such as clicks, impressions, queries, and average position.
We use this Google data for one purpose: to show you, inside your own AfterLaunch dashboard, whether the growth recommendations we make are working (we call this your outcome and movement data). We never write to, modify, or delete anything in your Google account. We do not use this data for advertising, we do not use it to train any AI or machine-learning model, and we do not sell, rent, or transfer it.
You can disconnect at any time from Settings then Sources, or by revoking access directly at https://myaccount.google.com/permissions. When you disconnect, we stop fetching new data and delete the stored access tokens.
3. How we use information
We use information to:
Provide the Service (generate snapshots, deliver briefs, monitor channels you've opted into)
Show you results from accounts you connect (read your Google Analytics and Search Console stats to display your outcome and movement data)
Improve the Service (understand which features work, fix bugs, calibrate AI quality)
Communicate with you (send transactional emails, respond to support inquiries)
Process payments (when you upgrade to a paid plan)
Administer your usage allowance (meter on-demand actions against your included allowance and top-up credits, and restore credits when an action fails)
Maintain security (detect abuse, prevent fraud)
Comply with legal obligations
4. AI processing: important
To generate your content and analyse your data, the Service sends your inputs (such as your business URL, voice samples, custom prompts, and your edits) together with public data we gather about your site to third-party AI providers. We use these providers as sub-processors:
Anthropic (Claude): primary content generation.
OpenAI: AI search analysis and image generation.
Google (Gemini): AI search analysis.
Perplexity: AI search analysis.
DataForSEO: Google search results and AI Overview data used to analyse how you appear in search.
When you use the Service:
Your inputs and the public site data described above may be sent to these AI providers for processing
We do NOT train any AI or machine-learning model on your data
These providers do NOT train their models on your data either. We use their API and enterprise tiers, which exclude your content from model training under their published terms
Outputs are returned to us, persisted in our database, and made available to you
We rely on these providers' privacy practices for the AI processing portion. Their policies are available at:
Service providers: We use third-party services to operate (hosting via Vercel, database via Supabase, email via Resend, AI via Anthropic/OpenAI/Google/Perplexity, payments via Dodo Payments). They process data on our behalf under their own privacy obligations. Dodo Payments acts as merchant of record for AfterLaunch subscriptions, which means they handle VAT, GST, and other applicable taxes on our behalf.
Analytics providers: We use PostHog and Google Analytics 4 to process our own site and product usage data (such as pages visited and features used) so we can understand how AfterLaunch is used and improve it. They process this data on our behalf under their own privacy obligations.
Legal compliance: If required by law, regulation, court order, or to protect rights and safety.
Business transfers: If we're acquired or merge with another company, your information may transfer (we'd notify you).
We do NOT:
Sell your personal information to anyone
Share your information with advertisers
Use your data to train external AI models
Transfer, sell, or share the data we read from your connected Google accounts, except as needed to provide the feature to you or where required by law
6. Data retention
Account data: Retained while your account is active and for 90 days after deletion.
Connected-account data (Google Analytics, Search Console): Retained while the connection is active. Access tokens are encrypted at rest and deleted when you disconnect or close your account.
Generated content (briefs, snapshots, articles): Retained while your account is active. Deleted with your account.
AI generation logs (the inputs we send to AI providers and the content we generate for you): Retained while your account is active. Used only to run and improve your account, and never used to train third-party AI models.
Email logs and engagement data: Retained while your account is active.
Server logs and security data: Retained while your account is active.
Payment records: Retained as required by law (typically 7 years for tax compliance).
7. Your rights
Depending on where you live, you may have rights to:
Access: Request a copy of your data
Correction: Update inaccurate data
Deletion: Request deletion of your data
Portability: Receive your data in a machine-readable format
Object: Object to specific processing
Withdraw consent: Where processing is based on consent
For EU/UK users, these rights are guaranteed under GDPR. For California users, under CCPA. For other regions, similar rights may apply under local law.
You can request deletion at any time. When you delete your account (from Settings then Account, or by emailing us) we run a deletion that removes your account and the associated data we hold about you, subject only to the limited categories we are required to keep for legal or accounting reasons (see Section 6).
To exercise any right, email [email protected]. We'll respond within 30 days.
8. Data security
We use industry-standard practices:
TLS encryption in transit
Encryption at rest for databases
Access controls limiting who can read sensitive data
Regular security review of our infrastructure
No system is perfectly secure. If we discover a security incident affecting your data, we'll notify you and authorities as required by law.
9. International data transfers
We're based in India. Our infrastructure providers may store and process data in countries including the United States, India, and the European Union.
For EU/UK users: We rely on Standard Contractual Clauses or equivalent legal mechanisms for data transfers outside the EU/UK.
10. Children's privacy
The Service is for business use by adults. We do not knowingly collect information from anyone under 18. If you believe we have, contact us and we'll delete it.
11. Cookies
We use two kinds of cookies and similar identifiers.
Essential cookies, which the Service needs to work:
Session cookies for authentication
Security cookies (CSRF tokens, etc.)
Functional cookies (preferences)
Analytics cookies and identifiers, set by PostHog and Google Analytics 4, which help us understand how the site and product are used:
PostHog: product analytics that measure which pages you visit, which features you use, and how flows perform. PostHog stores its identifiers in your browser using cookies and local storage.
Google Analytics 4: website analytics that measure traffic and engagement, such as visits, sessions, and referral sources.
How your IP address is handled and how long this analytics data is retained are governed by PostHog and Google under their own terms.
You can block the analytics cookies through your browser settings or a privacy extension, and the core Service will keep working normally. We do NOT use advertising cookies, and we do not sell or share your data with advertisers.
You can disable cookies in your browser, but the Service won't work properly without the essential cookies.
12. Changes to this policy
We may update this Privacy Policy. Material changes will be communicated via email and a notice on the Service at least 14 days before taking effect. Continued use after changes constitutes acceptance.
Address: D-704, Neelkanth Business Park, Mumbai 400086, India
For EU/UK users: You can lodge a complaint with your local data protection authority. EU representative (if required): TBD if needed for GDPR Article 27 compliance.