Privacy Policy — GetPaid (provisional name)
DRAFT — 2026-11-11. Not legal advice. This draft was prepared from the product’s code and has not been reviewed by a lawyer. Every
[REVIEW: …]needs a qualified lawyer; every[OWNER: …]needs a decision or fact from the publisher. Do not publish until all markers are resolved. Remove this box before publishing.
Effective date: [OWNER: effective date] Publisher (“we”, “us”): [Publisher name], [Registered address]. Contact: [Contact email]. [OWNER: legal form — individual trader or company; VAT/tax number if required to be shown] [REVIEW: trader identification duties under Portuguese/EU e-commerce law]
1. Short version
- The ebook collects no data. The sales platform that sells it handles your payment and checkout details.
- GetPaid Tracker in Local mode (default) keeps everything in your own browser. We receive none of it. No account, no cookies, no analytics, no tracking, no third-party scripts.
- GetPaid Tracker in Cloud mode (Premium, if offered) stores your account and your content with our hosting provider, Supabase, so you can use it across devices. Each user’s data is isolated from other users.
- We do not sell or share your data, we do not use advertising, and the app does not use AI or external APIs.
- The app never emails your clients. It drafts messages that you copy or open in your own email program.
2. What this policy covers
| Product / surface | Who decides what happens to the data |
|---|---|
| Landing page | We (controller) for server logs, via our host |
| Ebook “The Freelancer’s Payment Recovery Playbook” (PDF + DOCX) | The sales platform, for checkout data. The ebook files collect nothing. |
| GetPaid Tracker, Local mode | You. The data never leaves your device, so we do not process it. |
| GetPaid Tracker, Cloud mode: account and purchase records | We (controller) |
| GetPaid Tracker, Cloud mode: your content (clients, invoices, payments, messages, settings) | You (controller); we process it on your behalf (processor). See the Processor Terms annex in TERMS.md. |
3. Buying the products
We sell through a third-party merchant-of-record platform: [OWNER: platform name — candidates are Whop, Hotmart, Lemon Squeezy, Gumroad, Payhip]. That platform processes your payment, calculates and collects tax, and receives your name, email address, billing details and payment information. It acts as an independent controller for that data, under its own privacy policy: [OWNER: link to the platform’s privacy policy]. [REVIEW: confirm the chosen platform’s role (merchant of record and independent controller) against its terms]
From the platform we receive only what we need to deliver and support your purchase: [OWNER: list exactly what the platform shares with you, e.g. order reference, product, buyer email]. We never receive your full card details.
4. Landing page and static hosting
The landing page and the Local-mode app are static files. They set no cookies and run no analytics. Fonts are served from our own host, not from a font service.
Our hosting provider [OWNER: host — e.g. Netlify, Cloudflare Pages or Vercel] may automatically log technical data for each request: IP address, browser user agent, requested page, date and time. - Purpose: delivering the site, security and abuse prevention. - Legal basis: our legitimate interests in running a secure website (GDPR / UK GDPR Art. 6(1)(f)). - Retention: as set by the host: [OWNER: host’s log retention period]. We do not use these logs to profile visitors.
5. GetPaid Tracker — Local mode (default)
In Local mode everything you enter (clients, invoices, payments, message drafts, settings) is stored in your browser’s local storage on your device. It is not sent to us or to anyone else, so we cannot see, recover or delete it for you.
- Backups: you can export your data to a JSON file and import it again. Exported files are under your control; keep them safe, because they may contain your clients’ personal data and your payment details.
- Deletion: you can delete all data in the app. Clearing your browser’s site data also deletes it, and it cannot be recovered unless you have a backup.
- Device security: anyone with access to your browser profile can read this data. We do not add extra encryption on top of your browser’s storage.
[REVIEW: confirm that using browser local storage only for the user-requested function is “strictly necessary” under the ePrivacy rules (Portuguese Law 41/2004 and UK PECR), so no consent banner is required]
6. GetPaid Tracker — Cloud mode (Premium)
[OWNER: delete this section if Cloud mode is not offered at launch]
6.1 Data we process as controller
| Data | Purpose | Legal basis |
|---|---|---|
| Account email address | Creating and securing your account, sign-in, service messages | Contract (Art. 6(1)(b)) |
| Password | Sign-in. Hashed (bcrypt) by Supabase Auth — we never see your password | Contract |
| Session tokens | Keeping you signed in | Contract |
| Entitlement records: user id, product, status, sales platform name, external order reference, dates | Checking that you have purchased Premium | Contract; legitimate interests in preventing misuse |
Entitlement records are written only by our server; users cannot edit them. [OWNER: describe how the order reference reaches the server, e.g. a platform notification or manual entry]
6.2 Your content, processed on your behalf (processor)
| Category | Fields |
|---|---|
| Clients | name, email, company, country, notes |
| Invoices | number, description, amount, currency, dates, status, payment reference, notes |
| Payments | amount, date, method, notes |
| Follow-up messages | drafts logged as copied or sent: subject, body, stage, tone, timestamps |
| Settings | business name, business email, sender name, payment instructions (may contain bank details), default currency, formats |
We use this content only to provide the service to you. We do not read it except where needed to keep the service secure or where you ask for support, and we never use it for marketing, advertising or profiling.
Your clients’ data is your responsibility. You decide what you enter about your clients and you must have a lawful basis to do so. Do not enter more than you need (for example, avoid putting sensitive personal data in notes).
6.3 Emails we send
Account emails (confirmation, magic link, password reset) are sent by [OWNER: Supabase’s built-in email or a custom SMTP provider — name it]. We do not send marketing emails. [OWNER: confirm; if marketing emails are ever added, they need separate opt-in consent]
7. Who receives data (sub-processors and recipients)
| Recipient | Role | Data | Location | Safeguard |
|---|---|---|---|---|
| Supabase (database + authentication) | Our processor (Cloud mode only) | Account data, entitlements, your content | [OWNER: region — an EU region is recommended] | [REVIEW: Supabase DPA; SCCs / UK addendum if data leaves the EU/UK] |
| [OWNER: static host] | Our processor | Server logs (IP, user agent) | [OWNER: location] | [REVIEW: host DPA; SCCs or EU-US Data Privacy Framework] |
| [OWNER: sales platform] | Independent controller | Checkout and payment data | [OWNER: location] | Platform’s own policy |
| [OWNER: email provider, if not Supabase] | Our processor (Cloud mode only) | Account email, email content | [OWNER: location] | [REVIEW: DPA; SCCs/DPF] |
We may also disclose data where the law requires it (for example, a valid court order). We do not sell or share personal data with anyone else.
8. International transfers
We are based in the EU (Portugal). Where a provider processes personal data outside the EU/EEA or UK, we rely on an adequacy decision (including, for certified US companies, the EU-US Data Privacy Framework and the UK Extension), or on Standard Contractual Clauses (with the UK International Data Transfer Addendum where relevant). [REVIEW: confirm the transfer mechanism for each provider once chosen; list them here]
9. How long we keep data
| Data | Retention |
|---|---|
| Local-mode data | On your device until you delete it. We hold none. |
| Cloud account and content | Until you delete your account. Deleting your account in the app removes the account and all associated data. |
| Database backups | Deleted data may remain in Supabase backups until they expire: [OWNER: backup retention for the chosen Supabase plan] [REVIEW: is this disclosure sufficient] |
| Entitlement records | Deleted with the account. [REVIEW/OWNER: whether any purchase record must be kept longer for tax, accounting or dispute purposes; the sales platform keeps its own records] |
| Host server logs | [OWNER: host’s retention period] |
10. Your rights
If GDPR (EU) or UK GDPR applies to you, you have the right to: access your data; correct it; delete it; restrict or object to processing (including processing based on legitimate interests); receive your data in a portable format; and withdraw consent where processing is based on consent.
How to exercise them: - In the app: export your data as JSON (Settings → Export backup, in both modes), delete all your data, or in Cloud mode delete your account (Settings → Delete my account). - By email: write to [Contact email]. We will reply within one month. We may ask you to confirm your identity. - Purchase data: contact the sales platform directly, or ask us and we will forward your request. - Your clients: if one of your clients asks us about their data in your Cloud account, we will refer them to you, because you are the controller.
Complaints: you may complain to a data protection authority. In Portugal: Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt. In the UK: Information Commissioner’s Office (ICO), ico.org.uk. You may also complain to the authority where you live or work.
Other countries: - United States (California and other states): our assessment is that the California CCPA/CPRA does not currently apply to us, because we do not meet its thresholds (annual gross revenue above about USD 26.6 million, or buying, selling or sharing personal information of 100,000 or more consumers or households, or earning 50% or more of revenue from selling or sharing it). Other US state privacy laws have similar thresholds. In any case, we do not sell or share personal information. [REVIEW: confirm this assessment and the current inflation-adjusted figure] - Canada: you can contact us to access or correct your personal information. [REVIEW: PIPEDA compliance check] - Australia: [REVIEW: confirm whether the small-business exemption of the Privacy Act 1988 applies]
[REVIEW: whether a UK representative (UK GDPR Art. 27) or an EU representative is required]
11. Security
- Cloud mode: Row Level Security in the database ensures each user can access only their own rows; passwords are hashed by Supabase Auth; entitlement records can only be written by the server.
- Connections to the site and to Supabase use HTTPS. [OWNER: confirm HTTPS is enforced on the chosen host and custom domain]
- No third-party scripts run on the landing page or in the app.
- Local mode: security depends on your device and browser. Protect your device and your exported backup files.
- If a personal data breach affects you, we will notify the authorities and you where the law requires.
No system is perfectly secure, and we cannot guarantee absolute security.
12. Children
Our products are business tools for freelancers and are not directed at children. Do not use them if you are under 16 [REVIEW: age threshold; consider 18 since the products involve contracts and payments]. We do not knowingly collect children’s data.
13. Changes
We may update this policy. We will change the “Effective date” above and, for significant changes affecting Cloud-mode users, notify you by email or in the app before they take effect.
14. Contact
[Publisher name], [Registered address] — [Contact email]