GDPR Commitment

Our role under GDPR

When you use GetLaunchDay for your own account, we act as the data controller. When you collect data from your landing page visitors (e.g., waitlist signups), we act as a data processor on your behalf.

Lawful basis for processing

We process personal data under the following legal bases:

• Contract performance — to provide the Service you signed up for.
• Legitimate interest — to improve the product, prevent fraud, and ensure security.
• Consent — for optional analytics, marketing emails, and cookies (you can withdraw at any time).
• Legal obligation — to comply with tax, financial, and regulatory requirements.

Your rights

Under GDPR, you have the right to:

• Access — request a complete copy of your personal data.
• Rectification — correct inaccurate or incomplete data.
• Erasure (Right to be forgotten) — request deletion of your data.
• Restriction — limit how we process your data.
• Portability — export your data in a machine-readable format (JSON/CSV).
• Object — opt out of processing based on legitimate interest.
• Withdraw consent — revoke consent for marketing or analytics at any time.
• Lodge a complaint — file a complaint with your local Data Protection Authority.

To exercise any of these rights, email privacy@getlaunchday.com. We respond within 30 days.

Data processing agreement

For customers who collect personal data from EU/EEA residents through GetLaunchDay, we offer a Data Processing Agreement (DPA) that meets GDPR Article 28 requirements. Enterprise customers can request a signed DPA.

International data transfers

Data may be transferred to the United States for processing. We rely on Standard Contractual Clauses (SCCs) as approved by the European Commission to safeguard your data during transfer. EU hosting is available on request.

Data Protection Officer

For GDPR-related inquiries, contact our Data Protection Officer at dpo@getlaunchday.com.

Sub-processors

We use a limited number of sub-processors to deliver the Service. Key sub-processors include:

• Amazon Web Services (AWS) — infrastructure and hosting
• Stripe — payment processing
• Resend / Amazon SES — email delivery
• PostHog — product analytics (self-hosted option available)
• Sentry — error monitoring

We notify customers of material changes to our sub-processor list with 30 days' advance notice.

Breach notification

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours and affected data subjects without undue delay, in accordance with GDPR Articles 33 and 34.