Privacy Policy

The short version

HardLaunch stores what you put into your workspace so the product works: your account, your business details, your website, and your customer records. We don't sell data, we don't run advertising, and we don't set tracking cookies. You can export or delete everything yourself from Settings.

What we store and why

Account details: your name and email, managed through our sign-in provider Clerk. We store these so you can sign in and we can reach you about your account.

Business workspace data: your business profile and canvas, website content, brand assets, bookings, invoices, documents, and customer records. Storing and showing this back to you is the product.

Trial workspaces: you can build a business before creating an account. A trial workspace is stored on our servers like any workspace, is reachable only from the browser that created it (via a necessary cookie), and is deleted automatically about 30 days after your last visit unless you sign up, which attaches it to your account.

Billing records: your subscription status and Stripe identifiers. Card numbers never touch HardLaunch; Stripe handles all payment details.

AI history: the prompts you send and the drafts that come back are kept for 90 days so your history works, then deleted automatically.

Operational logs: basic technical logs (like errors and rate-limit counters) kept briefly to keep the service healthy and abuse-resistant.

Your customers' data (where HardLaunch is a processor)

When someone submits the contact form on your published site, their name, contact details, and message are stored in your workspace. For that data, you (the business) are the controller and HardLaunch is your processor: we store it, show it to you, and notify you about it, and we don't use it for anything else. Every published site includes a privacy notice page that explains this to your visitors.

HardLaunch's own page-view counting on published sites uses no cookies and does not identify visitors. Separately, you can add your own Google Analytics measurement ID in Website settings; if you do, Google Analytics runs on your published site, sets Google's cookies there, and processes your visitors' data for you under your own Google account. That is your choice and your responsibility to disclose. HardLaunch adds no analytics of its own beyond the cookie-free counts above.

Connected agents and the agent API

A business can let AI agents read its published catalogue and, with a key or connection the business grants, hold prices, place orders, and draft content. When a business connects an agent, HardLaunch stores the connection itself: the agent's name, which permissions were granted and when, the connecting client's registration details for OAuth connections, and hashed access artifacts (keys, tokens, and authorization codes are stored only as one-way hashes, never in usable form). Expired and superseded token records are deleted automatically after their replay-protection window; a consent that is never completed is deleted within a day.

When an agent places an order or asks for a quote on a buyer's behalf, the buyer's name, contact details, and note are stored in that business's workspace exactly as a website form submission would be (the business is the controller and HardLaunch its processor), and both the business and the buyer receive an email about the order. Buyer contact details on offers and quote requests that never became a sale are removed automatically after 30 days.

Anonymous catalogue reads by agents are rate-limited using a truncated one-way hash of the caller's network address; the address itself is not retained.

Who processes data for us

HardLaunch runs on a small set of infrastructure providers, each processing data only to provide their service: Vercel (hosting and file storage), Neon (database), Clerk (sign-in), Stripe (payments and payouts), OpenAI via Vercel AI Gateway (AI drafts you request; the gateway is configured for zero data retention), Resend (email notifications, when configured), and Sentry (error monitoring, which receives technical crash and error reports). Data is processed in the United States.

Google processes data in two places, both only if you turn them on: Google Analytics on your published site, when you add a measurement ID, and Google Calendar, when you connect it so bookings sync both ways.

Cookies

HardLaunch uses only cookies that are necessary to run the app: your sign-in session (set by Clerk), a small preference cookie that remembers whether your sidebar is open, and, if you try HardLaunch before creating an account, a trial cookie holding a random identifier that keeps your trial workspace reachable from your browser. HardLaunch sets no advertising or third-party analytics cookies anywhere, which is why the app shows no cookie banner.

A published business site sets no cookies either, unless its owner adds a Google Analytics measurement ID to it. Google Analytics then sets Google's cookies on that site, and whether that site needs a cookie notice or consent banner is up to the business that switched it on.

Your controls and rights

Export: Settings → Business details → Export data downloads everything HardLaunch stores for a business as one file.

Deletion: you can delete a business or your entire account from Settings. Deletion is immediate and permanent, removes uploaded images, and cancels billing. If you delete your account through the sign-in provider instead, we remove your HardLaunch data when we're notified.

If you are in the EU/EEA, UK, or a US state with a privacy law, you have rights to access, correct, delete, and port your data, and to complain to your supervisory authority. The built-in tools cover most of this instantly; for anything else, email privacy@hardlaunch.dev.

Retention and security

Workspace data is kept while your account exists and removed when you delete it. Trial workspaces you never attach to an account are deleted automatically about 30 days after your last visit. AI history is deleted after 90 days. Stripe billing records are retained as required for financial compliance.

Data is encrypted in transit, stored with access controls, and every workspace is isolated to its members. No internet service can promise perfect security, so we also give you the export tool to keep your own copies.

Changes and contact

If this policy changes in a way that matters, we'll say so in the product before it takes effect. Privacy questions and requests: privacy@hardlaunch.dev.