Privacy Policy
Your privacy is fundamental to how we operate. This policy explains how Launchmind B.V. collects, uses, and protects your personal data — and how we handle data we access through third-party integrations such as Google Search Console.
Last updated: April 9, 2026 · Effective: April 9, 2026
Privacy at a Glance
Encrypted Data
All data encrypted in transit (TLS 1.3) and at rest (AES-256).
EU Data Storage
Primary storage and processing take place in the European Union.
No Selling
We never sell your personal data and never use it for advertising.
1. Data Controller
Launchmind B.V. ("Launchmind," "we," "us," or "our") is the data controller responsible for processing your personal data in accordance with the General Data Protection Regulation (GDPR / EU 2016/679) and applicable Dutch privacy legislation (UAVG).
Company: Launchmind B.V.
Address: The Netherlands, European Union
Chamber of Commerce (KvK): Registration pending
Contact: support@launchmind.io
2. Information We Collect
2.1 Information You Provide Directly
When you create an account, use our services, or contact us, you may provide:
- Identity Data: Name, email address, phone number.
- Account Data: Username, hashed password, account preferences, language.
- Business Data: Company name, industry, website URL, business goals, brand assets.
- Payment Data: Billing address and payment method details (processed securely by Stripe — Launchmind never stores your full card number).
- Content Data: Any content you provide or approve for publication, including briefs and brand guidelines.
- Communication Data: Messages, feedback, and support requests exchanged with our team.
2.2 Information Collected Automatically
When you visit our website or use our services, we automatically collect:
- Technical Data: IP address, browser type and version, operating system, device identifiers.
- Usage Data: Pages visited, actions taken, click patterns, navigation paths.
- Approximate Location: Country and region derived from your IP address, used for language detection and service optimisation.
- Performance Data: Page load times, error logs, API response times for reliability monitoring.
2.3 Information from Third-Party Integrations
When you voluntarily connect a third-party service to Launchmind, we receive data from that service using the permissions you grant at the time of connection. You can revoke these permissions at any time.
- Google Search Console: With your explicit OAuth consent, we read performance data (clicks, impressions, click-through rate, average position, indexed pages, sitemaps, query performance). We only read data — we never modify your Search Console settings. See section 4 for details.
- Content Management Systems: WordPress, Shopify, PrestaShop, and Laravel connectors receive an API key or access token so Launchmind can publish articles on your behalf to the blog or storefront you authorize.
- HubSpot: Optional CRM sync — when enabled, we read and write contact records to keep your sales pipeline aligned with Launchmind activity.
- Stripe: Billing and subscription data. Stripe is PCI-DSS Level 1 certified.
2.4 Cookies and Similar Technologies
We use strictly necessary cookies to operate the Launchmind dashboard and optional analytics cookies to understand aggregate usage. You can control non-essential cookies through our cookie banner or your browser settings. Read our Cookie Policy.
3. How We Access Data Through Google APIs
Launchmind integrates with Google Search Console so customers can see their SEO performance directly inside our dashboard. This integration is entirely optional — it only runs after you explicitly authorize it through the Google OAuth consent screen — and you can disconnect at any time.
3.1 Google OAuth Scopes We Request
https://www.googleapis.com/auth/webmasters.readonlyRead-only access to the verified Search Console properties you own. We cannot add, remove, or modify properties, users, sitemaps, or settings. This is the least-privileged scope available to read Search Console data.
https://www.googleapis.com/auth/userinfo.emailYour Google account email address, used solely to associate the Search Console connection with your Launchmind account.
3.2 What Data We Read
- Clicks, impressions, click-through rate, and average search position per page and per query.
- Indexed URLs and sitemap submission status.
- Country and device breakdowns of search performance.
- List of properties (domains / URL prefixes) you have verified in Search Console.
3.3 How We Use That Data
- To display SEO performance dashboards and charts inside your Launchmind account.
- To measure the impact of articles Launchmind has generated or published on your behalf.
- To identify content opportunities (queries you rank for but could rank higher) and inform future article recommendations.
- To compute aggregated, non-identifying metrics about overall SEO improvement after using Launchmind.
3.4 Google API Services Limited Use Statement
“Launchmind's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.”
Specifically, we do NOT:
- Transfer Google user data to third parties, except as necessary to provide or improve user-facing features that are prominent in the Launchmind interface and only with the user's consent.
- Use Google user data to serve advertisements, including retargeting, personalised, or interest-based advertising.
- Use Google user data to train, fine-tune, or otherwise improve generalised or large language models, including those of third parties.
- Allow humans to read Google user data, except (a) with the user's affirmative agreement for specific messages, (b) when necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) for internal operations where the data (including derivations) has been aggregated and anonymised.
3.5 Revoking Access
You can disconnect the Google Search Console integration at any time from your Launchmind account settings. You can also revoke the authorization directly at your Google Account security page. Upon disconnection, we stop reading any new data immediately and delete cached performance data within 30 days, except where retention is required by law. Manage third-party access in your Google Account.
4. Legal Basis for Processing
We process your personal data only when we have a lawful basis under the GDPR:
Contract Performance (Art. 6(1)(b) GDPR)
Processing necessary to fulfil our contract with you — delivering the service, managing your account, providing support, and handling billing.
Legitimate Interests (Art. 6(1)(f) GDPR)
Processing for our legitimate interests such as fraud prevention, service security, aggregate analytics, and product improvement, provided those interests do not override your fundamental rights.
Consent (Art. 6(1)(a) GDPR)
Where you have given explicit consent — for example, connecting your Google Search Console account, opting in to marketing emails, or enabling optional cookies. You may withdraw consent at any time without affecting prior lawful processing.
Legal Obligation (Art. 6(1)(c) GDPR)
Processing required to comply with applicable law — for example, retaining invoices for seven years under Dutch tax law.
5. How We Use Your Information
We use your personal data to:
- Deliver the service: Generate, enhance, and publish content, run SEO analyses, and provide the Launchmind dashboard.
- Manage your account: Authenticate logins, process payments, and operate customer support.
- Communicate with you: Send service notifications, security alerts, billing confirmations, and (with consent) marketing emails.
- Improve Launchmind: Understand how features are used so we can fix bugs, prioritise improvements, and develop new features.
- Protect users and the service: Detect and prevent fraud, abuse, and security incidents.
- Meet legal obligations: Comply with applicable law and respond to lawful requests from authorities.
6. Data Sharing and Disclosure
We do not sell your personal data, and we never share it with advertisers or data brokers.
6.1 Service Providers
We rely on a small number of trusted sub-processors who help us run Launchmind. Each is contractually bound to protect your data and process it only on our instructions:
- Supabase: Primary database, authentication, and file storage (EU region).
- Vercel: Hosting, edge network, and deployment infrastructure.
- Stripe: Payment processing and subscription billing (PCI-DSS Level 1).
- OpenAI: AI content generation. We do not use customer data to train OpenAI models; content submitted via the API is not used for training by default.
- Resend: Transactional email delivery (account notifications, receipts, alerts).
- Sentry: Error monitoring and reliability instrumentation.
A complete and up-to-date list of sub-processors is available on request via support@launchmind.io.
6.2 Legal Requirements
We may disclose information when required by law, regulation, legal process, or governmental request, or when necessary to protect our rights, property, or the safety of our users or the public.
6.3 Business Transfers
In the event of a merger, acquisition, reorganisation, or sale of assets, your data may be transferred as part of that transaction. You will be notified in advance and, where legally required, given an opportunity to object.
7. International Data Transfers
Your data is primarily stored and processed within the European Economic Area (EEA). When a sub-processor transfers data outside the EEA (for example, OpenAI in the United States), we rely on appropriate safeguards approved under Articles 45–47 GDPR:
- Standard Contractual Clauses (SCCs) approved by the European Commission.
- Adequacy decisions where they exist.
- Supplementary technical measures such as encryption in transit and at rest.
You can request details of the specific safeguards in place for any sub-processor by emailing support@launchmind.io.
8. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, unless a longer retention period is required by law:
Account data: For the duration of your account, plus 2 years after deletion to handle disputes.
Invoices & transactions: 7 years (required by Dutch tax law — Algemene Wet inzake Rijksbelastingen).
Marketing preferences: Until you withdraw consent or unsubscribe.
Support communications: 3 years after the last contact.
Analytics data: 26 months, then aggregated or anonymised.
Generated content: As long as your account is active.
Google Search Console cached data: 30 days after you disconnect the integration.
After the applicable retention period, data is securely deleted or irreversibly anonymised.
9. Your Data Protection Rights
Under the GDPR and Dutch privacy law you have the following rights regarding your personal data:
Right of Access (Art. 15)
Request a copy of the personal data we hold about you, including the purposes and categories of processing.
Right to Rectification (Art. 16)
Request correction of inaccurate or incomplete personal data without undue delay.
Right to Erasure (Art. 17)
Request deletion of your personal data — the "right to be forgotten" — under the circumstances listed in Article 17.
Right to Restriction (Art. 18)
Request that we temporarily limit processing of your data in specific situations.
Right to Data Portability (Art. 20)
Receive your data in a structured, commonly used, machine-readable format and transmit it to another controller.
Right to Object (Art. 21)
Object to processing based on legitimate interests, including any form of profiling and direct marketing.
Right to Withdraw Consent (Art. 7(3))
Withdraw previously given consent at any time, without affecting the lawfulness of prior processing.
Right to Lodge a Complaint (Art. 77)
File a complaint with a supervisory authority — in the Netherlands, the Autoriteit Persoonsgegevens.
To exercise any of these rights, email support@launchmind.io. We will respond within 30 days. We may need to verify your identity before acting on your request.
10. Data Security
We implement technical and organisational measures designed to protect your personal data from unauthorised access, alteration, disclosure, or destruction:
Encryption
TLS 1.3 in transit; AES-256 at rest.
Access controls
Role-based access, multi-factor authentication, and least-privilege principles for our team.
Infrastructure security
Hardened cloud infrastructure, regular patching, and automated monitoring.
Secret management
Third-party API keys (including Google OAuth tokens) stored in an encrypted secret store.
Incident response
A documented breach-response process; affected users and the Autoriteit Persoonsgegevens are notified within 72 hours where required.
Security reviews
Periodic internal reviews and dependency audits.
11. Children's Privacy
Launchmind is a business tool and is not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If we learn that we have collected such data without parental consent, we will delete it promptly.
12. Third-Party Links
Our website and dashboard may contain links to third-party websites or services that we do not operate. We are not responsible for their content or privacy practices. We encourage you to review the privacy policy of every site you visit.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or for legal or regulatory reasons. When we make material changes, we will notify you by:
- Posting the updated policy on this page with a new "Last updated" date.
- Sending an email notification to the primary address on your account for significant changes.
- Showing a prominent notice inside the Launchmind dashboard.
We encourage you to review this Privacy Policy periodically.
14. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please get in touch:
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.