Privacy Policy

TL;DR

1. Who we are

This Privacy Policy describes how AfterLaunch ("we," "us," or "our") collects, uses, and shares information when you use our service at afterlaunch.io (the "Service").

AfterLaunch is operated by AfterLaunch Technologies, with its principal place of business at D-704, Neelkanth Business Park, Mumbai 400086, India.

For privacy questions or requests, contact us at hello@afterlaunch.io.

2. Information we collect

2.1 Information you provide

When you use the Service, we collect:

• Email address: Required to deliver insights, briefs, and account access.
• Business URL: The domain you submit so we can analyse it.
• Account credentials: If you create an account, we store your email and a hashed password (we never see your actual password).
• Voice samples: Writing samples you optionally provide so generated content matches your style.
• Custom prompts: Any custom AI search queries you add (paid tier feature).
• Communications: Any messages you send us by email or other means.

2.2 Information collected automatically

• Usage data: Pages you visit, features you use, time spent, errors encountered.
• Device information: Browser type, operating system, IP address (for security and rate limiting).
• Cookies and similar identifiers: Essential cookies for authentication and session management, plus first-party and third-party analytics cookies and identifiers set by PostHog and Google Analytics 4 so we can understand how the site and product are used. We do not use advertising cookies and we do not sell your data.

2.3 Information generated by the Service

• AI-generated content: Briefs, action drafts, snapshots, and SEO articles we generate for you.
• Monitoring data: Information we observe about your business across the channels we monitor (AI search engines, Reddit, Hacker News, your competitors' public pages, etc.).
• Engagement data: Whether you opened emails, clicked actions, marked actions complete.
• Usage-metering records: A ledger of your included monthly allowance, top-up purchases, the metered actions you run, and any automatic credit refunds, kept so your balance and billing are accurate.

2.4 Information from Google accounts you connect

Connecting an analytics account is optional. If you choose to connect your Google Analytics or Google Search Console account, you authorise AfterLaunch to access that account on a read-only basis through Google's official OAuth consent flow. We request only the minimum scopes needed:

• Google Analytics (scope: analytics.readonly): we read the traffic and engagement metrics for the property you select, such as sessions, users, and conversions.
• Google Search Console (scope: webmasters.readonly): we read the search performance data for the site you select, such as clicks, impressions, queries, and average position.

We use this Google data for one purpose: to show you, inside your own AfterLaunch dashboard, whether the growth recommendations we make are working (we call this your outcome and movement data). We never write to, modify, or delete anything in your Google account. We do not use this data for advertising, we do not use it to train any AI or machine-learning model, and we do not sell, rent, or transfer it.

You can disconnect at any time from Settings then Sources, or by revoking access directly at https://myaccount.google.com/permissions. When you disconnect, we stop fetching new data and delete the stored access tokens.

2.5 Information we gather from your public website

To analyse the business URL you submit, AfterLaunch fetches pages from that website directly, in the same way a search engine crawler does. We read only what is publicly available: we do not log in, we do not submit forms, and we do not attempt to reach anything behind authentication.

Our crawler identifies itself in every request with the user agent "Mozilla/5.0 (compatible; AfterLaunchBot/1.0; +https://afterlaunch.io)", so you can recognise it in your server logs, and allow or block it at your edge, exactly as you would any other crawler.

We also read publicly available information about your business from third-party sources, such as search results, AI search engine answers, public community threads, directories and listings, and your competitors' public pages.

3. How we use information

We use information to:

• Provide the Service (generate snapshots, deliver briefs, monitor channels you've opted into)
• Show you results from accounts you connect (read your Google Analytics and Search Console stats to display your outcome and movement data)
• Improve the Service (understand which features work, fix bugs, calibrate AI quality)
• Communicate with you (send transactional emails, respond to support inquiries)
• Process payments (when you upgrade to a paid plan)
• Administer your usage allowance (meter on-demand actions against your included allowance and top-up credits, and restore credits when an action fails)
• Maintain security (detect abuse, prevent fraud)
• Comply with legal obligations

4. AI processing: important

To generate your content and analyse your data, the Service sends your inputs (such as your business URL, voice samples, custom prompts, and your edits) together with public data we gather about your site to third-party AI providers. We use these providers as sub-processors:

• Anthropic (Claude): primary content generation.
• OpenAI: AI search analysis.
• Google (Gemini): AI search analysis.
• Perplexity: AI search analysis.
• DataForSEO: Google search results and AI Overview data used to analyse how you appear in search.

When you use the Service:

• Your inputs and the public site data described above may be sent to these AI providers for processing
• We do NOT train any AI or machine-learning model on your data
• These providers do NOT train their models on your data either. We use their API and enterprise tiers, which exclude your content from model training under their published terms
• Outputs are returned to us, persisted in our database, and made available to you

We rely on these providers' privacy practices for the AI processing portion. Their policies are available at:

• Anthropic
• OpenAI
• Google
• Perplexity
• DataForSEO

5. How we share information

We share information only as described:

• Service providers: We use third-party services to operate (hosting via Vercel, content delivery and bot filtering via Cloudflare, database via Supabase, email via Resend, AI via Anthropic/OpenAI/Google/Perplexity, payments via Dodo Payments). They process data on our behalf under their own privacy obligations. Dodo Payments acts as merchant of record for AfterLaunch subscriptions, which means they handle VAT, GST, and other applicable taxes on our behalf.
• Analytics providers: We use PostHog and Google Analytics 4 to process our own site and product usage data (such as pages visited and features used) so we can understand how AfterLaunch is used and improve it. They process this data on our behalf under their own privacy obligations.
• Legal compliance: If required by law, regulation, court order, or to protect rights and safety.
• Business transfers: If we're acquired or merge with another company, your information may transfer (we'd notify you).

We do NOT:

• Sell your personal information to anyone
• Share your information with advertisers
• Use your data to train external AI models
• Transfer, sell, or share the data we read from your connected Google accounts, except as needed to provide the feature to you or where required by law

Your Growth Snapshot report lives at its own unguessable link. Anyone who has that link can open the report, and search engines may index a finished report. A snapshot analyses a website that is already public, so treat the report as public too.

6. Data retention

• Account data: Retained while your account is active and for 90 days after deletion.
• Connected-account data (Google Analytics, Search Console): Retained while the connection is active. Access tokens are encrypted at rest and deleted when you disconnect or close your account.
• Generated content (briefs, snapshots, articles): Retained while your account is active. Deleted with your account.
• AI generation logs (the inputs we send to AI providers and the content we generate for you): Retained while your account is active. Used only to run and improve your account, and never used to train third-party AI models.
• Email logs and engagement data: Retained while your account is active.
• Server logs and security data: Retained while your account is active.
• Payment records: Retained as required by law (typically 7 years for tax compliance).

7. Your rights

Depending on where you live, you may have rights to:

• Access: Request a copy of your data
• Correction: Update inaccurate data
• Deletion: Request deletion of your data
• Portability: Receive your data in a machine-readable format
• Object: Object to specific processing
• Withdraw consent: Where processing is based on consent

For EU/UK users, these rights are guaranteed under GDPR. For California users, under CCPA. For other regions, similar rights may apply under local law.

You can request deletion at any time. When you delete your account (from Settings then Account, or by emailing us) we run a deletion that removes your account and the associated data we hold about you, subject only to the limited categories we are required to keep for legal or accounting reasons (see Section 6).

To exercise any right, email hello@afterlaunch.io. We'll respond within 30 days.

8. Data security

We use industry-standard practices:

• TLS encryption in transit
• Encryption at rest for databases
• Access controls limiting who can read sensitive data
• Regular security review of our infrastructure

No system is perfectly secure. If we discover a security incident affecting your data, we'll notify you and authorities as required by law.

9. International data transfers

We're based in India. Our infrastructure providers may store and process data in countries including the United States, India, and the European Union.

For EU/UK users: We rely on Standard Contractual Clauses or equivalent legal mechanisms for data transfers outside the EU/UK.

10. Children's privacy

The Service is for business use by adults. We do not knowingly collect information from anyone under 18. If you believe we have, contact us and we'll delete it.

11. Cookies

We use two kinds of cookies and similar identifiers.

Essential cookies, which the Service needs to work:

• Session cookies for authentication
• Security cookies (CSRF tokens, etc.)
• Functional cookies (preferences)

Analytics cookies and identifiers, set by PostHog and Google Analytics 4, which help us understand how the site and product are used:

• PostHog: product analytics that measure which pages you visit, which features you use, and how flows perform. PostHog stores its identifiers in your browser using cookies and local storage.
• Google Analytics 4: website analytics that measure traffic and engagement, such as visits, sessions, and referral sources.
• How your IP address is handled and how long this analytics data is retained are governed by PostHog and Google under their own terms.

Analytics are off until you allow them. The first time you visit we ask, and nothing analytics-related loads unless you accept. You can change your mind at any time using the "Cookie choices" link in the site footer, and you can also block these cookies through your browser settings or a privacy extension. The core Service works normally either way. We do NOT use advertising cookies, and we do not sell or share your data with advertisers.

You can disable cookies in your browser, but the Service won't work properly without the essential cookies.

12. Changes to this policy

We may update this Privacy Policy. Material changes will be communicated via email and a notice on the Service at least 14 days before taking effect. Continued use after changes constitutes acceptance.

13. Contact

For privacy questions, requests, or concerns:

Email: hello@afterlaunch.io

Address: D-704, Neelkanth Business Park, Mumbai 400086, India

For EU/UK users: You can lodge a complaint with your local data protection authority. AfterLaunch Technologies is established outside the EU and the UK and has not appointed a representative under GDPR Article 27 or UK GDPR. If we become required to appoint one, we will name them in this policy and tell you here. In the meantime, contact us directly using the details above and we will handle your request ourselves.

Annex: List of subprocessors

Last updated: 25 August 2026

This list may change as our infrastructure evolves. Material changes communicated per Section 12.