Privacy Policy

1. Controller

The controller responsible for processing personal data on launchboost.dev under the GDPR is:

We are not required to appoint a data protection officer. For any privacy question, write to the email address above.

2. Overview

We process personal data when you visit the Site, create an account, submit a startup, vote, buy a paid product or subscribe to the newsletter. We do not sell personal data, we do not use advertising or tracking cookies, and we do not build cross-site profiles.

3. Visiting the Site

Hosting and server logs

The Site is hosted by Vercel Inc., USA. Our server functions run in Vercel's Washington, D.C., USA (East) (iad1); static content is delivered through Vercel's global content delivery network. When you open a page, Vercel processes your IP address, the requested URL, date and time, browser type (user agent), referrer and similar technical data. This is needed to deliver the Site, keep it secure and investigate errors and attacks.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and stable operation of the Site. Vercel keeps these logs for 30 days.

Web Analytics and Speed Insights

We use Vercel Web Analytics and Vercel Speed Insights to understand which pages are used and how fast they load. Both work without cookies and without storing anything on your device. Visitors are not identified or tracked across websites; we only see aggregated figures such as page views, referrers, countries, device types and loading times.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is improving the content and performance of the Site.

Cookies and local storage

We only use storage on your device that is strictly necessary for a service you request:

• a session cookie that keeps you signed in after you sign in;
• short-lived cookies that hold the state of a sign-in with Google and protect it against cross-site request forgery;
• a local storage entry that remembers whether you chose the light or dark theme.

Storing and reading this information does not require consent under § 25(2) No. 2 TDDDG. The related processing is based on Art. 6(1)(b) GDPR (sign-in) and Art. 6(1)(f) GDPR (theme preference). Because we use no other cookies, we do not show a cookie banner.

4. Account and sign-in

To submit a startup, vote or buy a paid product, you need an account. We store your email address, name, profile picture (if provided), sign-in timestamps and active sessions.

• Email sign-in link: we send a one-time sign-in link to your email address through Resend (see section 9).
• Sign in with Google: if you choose this option, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, sends us your name, email address and profile picture after you agree in Google's dialog. Google may also process data in the USA through Google LLC. Google's privacy policy applies: policies.google.com/privacy.

Legal basis: Art. 6(1)(b) GDPR (providing the account you asked for).

5. Listings, maker profiles and votes

When you submit a startup, we store and publish its name, tagline, description, website URL, logo, screenshots, categories, stage, pricing model and any discount codes you add, together with a link to your maker profile. Your maker profile shows your name, handle, bio and avatar, and your website and X handle if you add them. Listings and profiles are public and can be found by search engines.

When you vote, we store which account voted for which listing so that each account can vote only once and so that we can detect manipulation. We publish vote totals only, not who voted.

Legal basis: Art. 6(1)(b) GDPR (providing the directory service). Checking votes for manipulation is also based on Art. 6(1)(f) GDPR; our legitimate interest is fair rankings.

Uploaded logos, avatars and images are stored in Vercel Blob, a storage service of Vercel Inc.

6. Automated screening of submissions

We screen every submission automatically to keep spam, scams and prohibited content off the Site. Only the listing's name, tagline and description are sent through the Vercel AI Gateway to an AI model (gpt-oss-safeguard-20b, an open-weight model published by OpenAI and run by an inference provider that Vercel selects). The model assesses whether the text breaks our listing rules. Based on this assessment, a submission is approved, passed to manual review or rejected.

A rejection can be a decision based solely on automated processing within the meaning of Art. 22 GDPR. We use it because screening every submission by hand is not feasible and the screening is necessary for performing our contract with you (Art. 22(2)(a) GDPR). You have the right to obtain human review, to express your point of view and to contest the decision. Email us at contact@launchboost.dev and a person will review your submission.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR (our legitimate interest in a directory free of abuse).

7. Autofill from your website

If you use the optional autofill feature, our server fetches the public web page at the URL you enter, extracts its text and sends that text through the Vercel AI Gateway to an AI model (Gemini 2.5 Flash Lite by Google), which drafts your listing. You can edit the draft before submitting. We do not intend to process personal data with this feature, but the page may contain some, such as a founder's name.

Legal basis: Art. 6(1)(b) GDPR (a feature you choose to use).

8. Paid orders

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe collects your payment details, name, email address and billing address directly in Stripe Checkout. We receive your name, email address, billing details, the amount, the payment status and a payment reference, but never your full card details. Stripe also generates and sends your invoice.

Stripe acts as our processor for handling the payment. For fraud prevention and its own legal obligations (for example under anti-money laundering law), Stripe acts as an independent controller. See stripe.com/privacy.

Legal basis: Art. 6(1)(b) GDPR (performing the contract) and Art. 6(1)(c) GDPR (tax and accounting obligations).

9. Emails and newsletter

Transactional emails

We send sign-in links, order confirmations, moderation decisions and notifications about your listings through Resend (Plus Five Five, Inc., USA). Legal basis: Art. 6(1)(b) GDPR.

Newsletter

Our weekly newsletter presents new launches and editorial picks. It also contains paid placements, which are labelled as sponsored or featured. You can subscribe on the newsletter page.

We use double opt-in: after you sign up, we send a confirmation email, and you only receive the newsletter after clicking the link in it. To prove your consent, we log the time of signup, your IP address and the time of confirmation (Art. 7(1) GDPR).

The newsletter is sent through Resend. Open and click tracking is disabled; we do not measure whether you open an issue or click a link in it.

You can unsubscribe at any time with the link at the end of every issue or by emailing us. This withdraws your consent with effect for the future.

Legal basis: Art. 6(1)(a) GDPR (your consent). Storing the consent log is based on Art. 6(1)(c) and (f) GDPR; our legitimate interest is being able to prove consent.

10. Contacting us and reports

If you email us, for example to report content or ask for a human review, we process your email address, your message and any data you include, to handle your request. Legal basis: Art. 6(1)(b) GDPR where the request relates to a contract, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering requests) and Art. 6(1)(c) GDPR for reports under the Digital Services Act.

11. Processors and recipients

We use the following service providers. We have concluded data processing agreements under Art. 28 GDPR with each processor.

• Vercel Inc., USA: hosting, content delivery, Web Analytics, Speed Insights, Vercel Blob file storage and the Vercel AI Gateway, which forwards AI requests to model providers.
• Neon Inc., USA: database. The database is hosted in the AWS region eu-central-1 (Frankfurt, Germany).
• Plus Five Five, Inc. (Resend), USA: transactional emails and newsletter.
• Stripe Payments Europe, Ltd., Ireland: payment processing and invoices (partly as an independent controller, see section 8).
• Google Ireland Limited, Ireland, and Google LLC, USA: only if you choose Sign in with Google (independent controller).
• AI model providers reached through the Vercel AI Gateway: Google (Gemini, for autofill) and the inference provider serving gpt-oss-safeguard-20b (for screening).

We also disclose data to authorities where we are legally required to, and to tax advisers who are bound by professional secrecy, for accounting.

12. Transfers to third countries

Some providers are based in the USA or may access data from there. Transfers to the USA are based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified under it. Where a provider is not certified, or as an additional safeguard, we rely on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which are part of our agreements with these providers. You can request a copy of the safeguards by emailing us.

13. How long we keep data

• Account, profile, listings and votes: until you delete your account. We then delete them or remove their link to you, unless we must keep them for the reasons below.
• Orders, invoices and accounting records: 8 years for invoices and other accounting vouchers, 6 years for business correspondence, and 10 years for books and annual records, under § 147 AO and § 257 HGB. The period starts at the end of the calendar year in which the record was created.
• Newsletter consent log: for as long as you are subscribed and for 3 years after you unsubscribe, so that we can prove consent if a claim is made (§§ 195, 199 BGB). We keep your email address on a block list after you unsubscribe only if you ask us not to email you again.
• Moderation records and reports: for as long as the listing exists and up to 12 months afterwards, so that we can handle complaints about our decisions.
• Server logs: see section 3.

14. Your rights

You have the right to:

• access the personal data we hold about you (Art. 15 GDPR);
• have inaccurate data corrected (Art. 16 GDPR);
• have your data deleted (Art. 17 GDPR);
• restrict processing (Art. 18 GDPR);
• receive your data in a structured, machine-readable format (Art. 20 GDPR);
• withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR);
• not be subject to a decision based solely on automated processing, as described in section 6 (Art. 22 GDPR).

Right to object (Art. 21 GDPR): where we process your data based on our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is needed for legal claims.

You can delete your account in your account settings or by emailing us. To exercise any other right, email contact@launchboost.dev.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work or where the alleged infringement took place.

15. Do you have to provide data?

You can browse the Site without providing personal data. An email address is required for an account and for the newsletter, and payment and billing data are required for paid orders. Without them we cannot provide these services.

16. Changes

We update this policy when our services or the law change. The date at the top shows the current version.