Privacy Policy

1. Who we are

LaunchPist ("LaunchPist", "we", "us") provides software-as-a-service tools for app marketing, hosted at launchpist.com. LaunchPist is a trading name of Catsoft Apps Limited, a company registered in England and Wales under number 15682101, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

Catsoft Apps Limited is the data controller for the personal information described below. For any privacy question, or to exercise the rights in section 9, write to privacy@launchpist.com or to app@catsoftapps.studio. Full company information is on our Company Details page.

2. Information we collect

Account data

• Email address, full name, and password hash (or Google OAuth identity)
• Workspace name and team member roles
• Profile preferences and locale

Billing data

• Plan, subscription status, trial dates, billing interval, and Stripe customer/subscription IDs
• Payment card details are entered directly into Stripe and are never stored on our servers. We only see a reference token and the last four digits.

App and content data you provide

• Apps you connect: App Store / Google Play listings, names, icons
• Brand assets, voice guidelines, target keywords, competitors, and other inputs you upload for content generation
• Articles, social posts, ad creatives, and emails generated by the platform

Integration tokens

• Encrypted OAuth tokens for Google Search Console, X (Twitter), and LinkedIn when you connect those accounts
• App Store Connect API keys (.p8 files) and Google Play service account JSON, used only to fetch performance metrics for apps you own. These are encrypted at rest with AES-256-GCM.

Managed marketing (Autopilot + Expert and Expert Starter)

• The access you grant us as a manager or partner on your Google Ads account, Meta ad account, Facebook Page and Google Business Profile. We never ask for passwords, and you can remove our access in those platforms at any time.
• Campaign, keyword, ad, budget, review and performance data from those accounts, used to manage your marketing and build your reports. Ad spend is billed to you directly by Google or Meta.
• Leads on your site: when a visitor taps your phone number or WhatsApp button or sends a form, our code records the time, the page and where the visit came from (for example Google, an ad or an AI assistant). It does not record what the visitor typed.
• Your customers' names and email addresses that you give us for review requests, used only to send those requests on your behalf and deleted when you remove them or end the service.
• What you tell us in the application form at /expert (your business, website, contact details, budget and goals), used to prepare your plan and to contact you about it.

Usage and device data

• Pages visited, actions taken in the dashboard, and feature usage
• IP address, browser type, device model, and approximate location
• Cookies and similar technologies for sign-in sessions and analytics

3. How we use your data

• To provide, maintain, and improve the service you signed up for
• To generate marketing content (articles, posts, ad copy, emails) on your behalf using third-party large language models
• To process payments and manage your subscription
• To send transactional emails (sign-in, billing, product updates)
• To measure our own advertising and to show our ads to people who have visited our site, and to people similar to our customers (see sections 5 and 11)
• To detect, prevent, and respond to abuse, fraud, and security incidents
• To comply with legal obligations

4. Legal bases (GDPR / UK GDPR)

If you are in the EEA or UK, we rely on these legal bases:

• Contract: to deliver the features you subscribe to.
• Legitimate interests: to keep the product secure, analyze usage, improve features, and advertise our own service to businesses, including through matched audiences (you can object at any time, see section 8).
• Consent: for optional marketing emails and certain cookies, where required.
• Legal obligation: tax, accounting, and law enforcement requests.

For your customers' details and your visitors' lead events under managed marketing, we act as your processor and handle them only on your instructions; you are responsible for having a lawful basis to contact your customers.

5. Sub-processors and third parties

We use carefully selected vendors to operate LaunchPist. They process data on our behalf under data processing agreements:

• Cloudflare (USA / global edge): hosting, CDN, DDoS protection
• Supabase (USA): authentication, primary database, file storage
• Stripe (USA): billing, payments, invoicing
• Resend (USA): transactional and waitlist email delivery
• PostHog (USA / EU regions): product analytics
• OpenAI, Anthropic, and other LLM providers: text and image generation. Inputs you provide for content generation are sent to these providers for processing only and are not used by them to train public models when run through our enterprise endpoints.
• Meta Platforms (Ireland / USA): advertising. The Meta pixel on our site tells Meta which of our ads led to a visit, a trial or a purchase, and lets us show our ads again to people who visited. We may also share customers' email addresses with Meta in hashed (encrypted) form so Meta can find similar businesses and leave existing customers out of our ads; Meta deletes the hashed addresses after matching. Write to us and we will leave you out.
• Google, Apple, X (Twitter), LinkedIn: only when you explicitly connect those integrations.
• Google (Google Ads, Business Profile, Tag Manager) and Meta (ad accounts and Pages): under managed marketing, the accounts you add us to, to run the ads and reports we manage on your behalf.

6. International transfers

LaunchPist is operated globally. Data may be transferred to and stored in the United States and other countries. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

7. How long we keep data

• Account data: while your account is active, then up to 90 days after deletion request.
• Billing records: retained for at least 7 years to meet tax and accounting obligations.
• Generated content and app metrics: deleted within 30 days after you delete the app or close your workspace.
• Backups: encrypted backups may persist for up to 30 days after primary deletion.

8. Your rights

You can:

• Access and download your data from the dashboard.
• Correct inaccurate information from your profile and workspace settings.
• Delete your account at any time. We will erase your data in line with section 7.
• Object to or restrict certain processing.
• Withdraw consent for optional marketing emails using the unsubscribe link.
• Ask us not to use your data for advertising audiences: write to us and we will remove you from them.
• Lodge a complaint with your local data protection authority. We hope you talk to us first at privacy@launchpist.com.

9. Security

We use TLS in transit, AES-256-GCM for sensitive credentials at rest, Row Level Security on the database, role-based access for staff, and regular vendor reviews. No system is perfectly secure, so we encourage you to use a strong unique password and enable Google sign-in where possible.

10. Children

LaunchPist is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us information, contact us and we will delete it.

11. Cookies

We use a small number of cookies for authentication sessions, security, and product analytics, and the Meta pixel to measure and target our own ads. Essential cookies are always on. In the EEA, the UK and Switzerland the analytics and advertising cookies load only after you accept them in the cookie banner; elsewhere they can be disabled in your browser settings.

12. Changes to this policy

When we make material changes, we will post a notice in the dashboard and update the "Last updated" date above. Continued use of the service after changes means you accept the new policy.

13. Contact

Questions, requests, or complaints? Email privacy@launchpist.com. We respond to privacy requests within 30 days.