Privacy Policy

The data controller is Axel Schapmann, sole proprietor (entrepreneur individuel), based in France. Questions and requests: axel.schapmann@gmail.com.

To count who has seen the Spotlight and who clicked it, we compute a one-way hash of your IP address and browser identifier with a secret salt. We never store your IP address. The hash lets us count you once per Spotlight and is deleted as soon as that Spotlight ends (at most a few days).

We use DataFast for site analytics (pages viewed, referrers, country, device). DataFast does not use cookies and aggregates this data; see their policy at datafa.st. We also show how many people are on the site at the moment, as an aggregate figure only.

We do not use advertising trackers.

When you sign in we store your email address and, with Google sign-in, the name and profile picture Google shares. Sign-in is handled by Supabase; one-time codes are sent by Resend.

Session cookies keep you signed in. They are strictly necessary for the service and contain no tracking.

Product name, tagline, category, website and logo are public by design: they are shown on the site to everyone. Your logo is stored with Supabase Storage. Links to your product carry parameters (utm_source, ref) that identify SaaSpotlight as the source; they do not identify individual visitors.

Payments are processed by Stripe, which collects your card details and billing information directly; we never see your card number. We keep the order reference, the amount, your email and the Stripe identifiers needed to run your Spotlight or sponsorship, handle taxes and answer disputes, for as long as accounting rules require.

We email you sign-in codes and the notifications you would expect (your product is on stage, your slot status). No newsletter without your consent. Emails are sent through Resend.

Only the providers we need to run the service, each bound by their own data protection terms:

• Supabase (database, authentication, file storage)
• Stripe (payments and invoices)
• Resend (transactional email)
• DataFast (aggregated analytics)
• Google (only if you choose Google sign-in)
• Vercel (hosting)

Some of them process data outside the European Union under standard contractual clauses. We never sell personal data.

• Visitor hashes: until the Spotlight they belong to ends.
• Account and product data: as long as your account exists, then deleted within 30 days of your request.
• Public Spotlight results (product, visitors, clicks): kept as part of the site's history.
• Payment records: as long as the law requires (typically 10 years in France).

Under the GDPR you can access, correct, export or delete your data, object to or restrict its processing, and complain to the CNIL (cnil.fr). Write to axel.schapmann@gmail.com; we answer within a month.

We may update this policy; the date at the top shows the latest version. Significant changes are announced on the site or by email.