Privacy Policy

LaunchAmp is a very small, clearly defined service, and this privacy policy is correspondingly short. We use no tracking, no advertising networks, no analytics services and no social media plugins. Public pages of launchamp.eu load no content whatsoever from third-party servers — no fonts and no JavaScript libraries from a CDN either. Your IP address is therefore not transmitted to anyone outside our hosting provider when you visit this website.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for the operation of this website and of the LaunchAmp service is:

We have not appointed a data protection officer; the statutory conditions of Section 38 BDSG (German Federal Data Protection Act) are not met. For all data protection enquiries, please use the email address above.

2. What LaunchAmp does

LaunchAmp helps with Product Hunt launches, and does three separate things which are described separately throughout this document because they process different data:

• Advice before a launch (Launch Kit) — a paid written assessment of a planned launch, offered until 2 October 2026 and no longer sold. Requests sent before then are handled as set out in clause 10.
• Board comparison after a launch — free and without any email address since 2 October 2026; from 26 September 2026 until then it asked for a confirmed email address, and before that it was a one-time paid unlock. We store the Product Hunt address you enter and the figures publicly reported for that launch (clause 9). Addresses confirmed before 2 October 2026 are handled as set out in clause 9a. Records of the earlier paid unlocks are kept for as long as tax law requires us to keep the receipt.
• Launch Report — a one-time purchase of a document calculated for one figure, offered until 2 October 2026 and no longer sold; the same calculation is now shown free of charge in the launch planner. For any purchase made before then we keep the figure, a random access token, the amount paid and the email address Stripe reported for the payment, for as long as tax law requires us to keep the receipt.
• Featured products — a paid placement of one of your Launch Lounge listings in the box of that name, for 14 or 30 days. Stored for it are: which listing, the period booked, the amount paid and the payment reference from our payment service provider, plus the email address given at checkout so that a question about the purchase can be answered at all. We additionally count, per day and per placement, how often the box was delivered and how often the link was clicked — these counts are not linked to any visitor and identify no one. The record of the purchase is kept for as long as tax law requires us to keep the receipt.
• Free tools and measurements — the pages at /launch-check, /launch-planner (including the full planning data shown there), /launch-stats, /product-hunt-alternatives, /best-day-to-launch-on-product-hunt, /upvotes-to-get-featured, /pre-launch-checklist and /launches, which need neither an account nor an email address and are described in clauses 8 and 9.
• Shovels — a separate offer by the same operator at /services/shovels/: ready-to-use tool templates sold as source code. The purchase is described in clause 10a.
• GEO-bot — automatic GEO checks (how AI assistants answer buying questions about your brand) and SEO checks (an examination of your website), sold as a one-time purchase at /services/geo-bot/. The processing is described in clause 10b.

Understanding this scope explains everything else in this document: we need an account only in order to list your tool in the Launch Lounge and to attach a paid placement to it, a payment process in order to collect the price of a placement, and access to the public interfaces of the launch platforms in order to fetch the figures shown. Nothing more happens.

3. Hosting and email delivery

This website, the database and the email mailbox are operated at:

The servers are located in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with STRATO AG. Emails sent by LaunchAmp (e.g. replies to support enquiries) are routed via the STRATO mail server smtp.strato.de and therefore likewise via German infrastructure.

As with any web server, our hosting provider records technical access data in server log files when a page is retrieved, including the IP address. These log files are created and administered by STRATO AG; we do not evaluate them and do not combine them with other data. The scope and retention period of these host-side logs are governed by STRATO AG's own information.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and functional operation of the website).

4. Data we store ourselves

4.1 Account data

• Email address — to identify your account, for signing in and for messages concerning the purchase.
• Password only as a hash — stored using bcrypt (PHP password_hash()). The plaintext password is never stored at any point and is not known to us.
• Username — generated automatically from the part of your email address before the @ sign plus a random number. You do not enter it yourself.
• Time the account was created.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract and pre-contractual measures).

4.2 Resetting your password

If you use "Forgot password?" on the sign-in page, we generate a one-time link and email it to the address stored for your account. For this we store, for that link: a cryptographic hash of the token, the account it belongs to, its expiry time and the time it was used.

The token itself — the part in the emailed link — is not stored, only its hash. Anyone reading our database therefore cannot use it to take over an account. The link expires after one hour and works exactly once. Requesting a new one immediately invalidates any earlier link.

The page answers identically whether or not an account exists for the address you enter. This is deliberate: otherwise the form could be used to find out which people hold an account with us.

These records are deleted together with your account (see clause 15).

Legal basis: Art. 6(1)(b) GDPR (performance of a contract — restoring access to your account) and Art. 6(1)(f) GDPR (legitimate interest in the secure operation of the sign-in process).

4.3 Data from earlier sign-ins with Google

Signing in with Google is no longer offered. There is no Google button on our sign-in or registration pages, no redirect to Google takes place, and no data is transmitted to Google at any point — no Google scripts, fonts or tracking pixels are embedded on our pages.

While the option existed, accounts created through it received two pieces of data from Google: the email address and the unique Google account identifier (the so-called sub). Where such an account still exists, we continue to store both. We never stored further profile data such as name or profile picture.

That identifier is now dormant: it is not used for signing in and is not passed on to anyone. It is erased together with the account — either when you delete the account yourself in your dashboard under "Account", or on request to hello@launchamp.eu.

If your account was created this way and you have no password, you can still reach it: use "Forgot password?" on the sign-in page. We will email you a link that lets you set a password for the account.

Legal basis for continuing to store this data: Art. 6(1)(b) GDPR (performance of a contract — it identifies the account). The transfer to Google that took place at the time was based on Art. 6(1)(a) GDPR (consent by clicking the sign-in button) in conjunction with Art. 49(1)(a) GDPR; the provider was Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google's privacy policy: policies.google.com/privacy.

4.4 Launch data

For every launch you create, we store the details you enter or that follow directly from them:

• the Product Hunt URL of your launch that you entered,
• the product name and tagline of the launch,
• an internal short identifier derived from it (slug),
• the contact email address of the launch,
• the address of your own website, if you enter one in the dashboard — it is used solely as the link target behind your product name in the "Recently Featured" list on our homepage, and can be removed there again at any time,
• the public metrics retrieved from Product Hunt: upvote count, aggregated rating and up to three public comments (see clause 6),
• the payment status, the time of purchase and the time of the last update via the Product Hunt interface.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

5. Payment processing via Stripe

For all paid services we use the payment service provider Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

When making a purchase you are redirected to a payment page operated by Stripe. You enter your payment details exclusively there. Card numbers, bank details or other payment method data are never transmitted to LaunchAmp and are consequently not stored by us.

In order to create the payment, we transmit to Stripe:

• your email address (as the buyer identifier in the payment process),
• the name of the product and the amount paid,
• internal identifiers for assigning the payment to your launch (the internal launch number, your user number and the slug of the launch).

From Stripe we receive back only the confirmation that the payment was successful. In our database, this confirmation sets the payment status of the launch concerned to "paid" and records the time of purchase. We do not store a Stripe customer number or payment ID. This applies to the placements; for a Shovels or GEO-bot purchase the payment reference is kept with the order (clauses 10a and 10b).

Stripe belongs to a group of companies headquartered in the USA (Stripe, Inc.), so a transfer to a third country may take place. Stripe bases this transfer on the European Commission's standard contractual clauses and is certified under the EU-U.S. Data Privacy Framework.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract); for the third-country transfer, Art. 46(2)(c) GDPR (standard contractual clauses). Stripe's privacy policy: stripe.com/privacy.

Invoices and payment records are kept at Stripe and retained there in accordance with commercial and tax law retention periods.

6. Retrieval of public data from Product Hunt

So that we can count launch days and look up an individual launch rather than estimate it, LaunchAmp retrieves data via Product Hunt's official GraphQL interface. Important for understanding this:

• This query originates from our server and uses our own developer token. Your visitors' browsers never contact Product Hunt themselves. No website visitor's IP address is therefore transmitted to Product Hunt.
• Only the launch whose Product Hunt URL you yourself provided is queried — never anyone else's data.
• What is retrieved and cached in your record: the upvote count, the aggregated rating and up to three public comments on your launch, each consisting of the publicly displayed name of the commenting person, the comment text and the creation date.
• Retrieval happens at most once per hour per launch.

The comments are content which the persons concerned have themselves published publicly on Product Hunt. We cache them in order to display them in the same form in which they are publicly visible on Product Hunt.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in accurately presenting publicly available responses to a launch; no non-public data is processed). If, as a commenting person, you do not wish your comment to be displayed via LaunchAmp, an informal message to hello@launchamp.eu is sufficient — we will then remove it from the cache.

7. Prospect list for approaching new customers

For our own customer acquisition we maintain an internal list of recent Product Hunt releases. It stores exclusively publicly available information that Product Hunt's official interface provides about a published product: product name, tagline, Product Hunt URL, the product's own website, the publicly displayed name of the maker, the maker's public Product Hunt profile URL, the maker's public X (Twitter) username, the upvote count and the time of retrieval. No email addresses are collected — Product Hunt's interface deliberately does not expose any, and we do not invent any. This list is visible only to the operator and is not published, not sold and not passed on to third parties.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in approaching potential business customers in a B2B context on the basis of publicly accessible information). You may object to this storage at any time under Art. 21 GDPR; we will then delete the entry concerned without undue delay. An informal message to hello@launchamp.eu is sufficient.

8. Reach measurement without cookies

We count how often our public pages are called up and through which channel visitors arrive. This is built to get by with as little data as possible and without a cookie. Exactly one row is stored per page view, containing:

The daily rotating checksum is a SHA-256 value calculated from your IP address, your browser's user agent, the calendar date and a secret value known only to us. It lets us count several page views by the same person on the same day as one visit. The IP address and the user agent are only used to calculate it and are not stored. Because the date is part of the calculation, the value changes every day: it cannot be used to recognise you on another day or to link your visits across days. It is nevertheless pseudonymous data within the meaning of the GDPR, which is why we name it here.

Actions. With the same checksum we also count a few actions that are not a page of their own: a click on a link to one of our product or tool pages (Featured products, launch planner, launch check, pricing — with the page it happened on), creating an account, opening a payment page (with the product), and getting a result from the launch check or the launch planner (with the size class of the upvote number, such as “5–19”, not the number itself and not the launch), and on the Shovels pages a click on a buy button, the live demo or a product (with where on the page it was), and on the GEO-bot pages whether a check went to the payment page, was cancelled or was paid. This tells us which channel leads to a purchase and how often the free tools are actually used — within a single day, not across days.

What is expressly not stored:

• the IP address, neither in full nor truncated,
• a cookie, a session identifier or any other identifier that survives the day,
• the full user agent string,
• the full referrer URL (which could contain a search query),
• the query string of the page called up, apart from the campaign identifiers listed above.

No cookie is set for this measurement and nothing is stored on your device; clicks are reported with a small script at the moment you click. No data is passed to third parties and no profiles are created. That is why LaunchAmp shows no cookie banner. Requests from recognisable search engine crawlers, preview bots and script clients are not stored.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in knowing how the website is used and which channels bring visitors).

9. Free launch analysis (/launch-check)

On /launch-check you can enter the address of a Product Hunt launch and have it compared against the rest of its launch day. No account and no registration are required for this.

The launch itself is fetched from Product Hunt live for each enquiry, shown to you and then discarded. Its name, tagline, image and comments are not stored by us.

What we do keep is one row per launch that has been analysed at least once, containing:

What is expressly not stored:

• no IP address — neither in full, nor truncated, nor as a hash,
• no user agent, no session and no visitor identifier of any kind,
• no email address and no other contact detail — the analysis asks you for nothing about yourself,
• no content from the Product Hunt page: no product name, no tagline, no image, no comments.

These entries therefore record which launch was looked at, never who looked at it. Two different people analysing the same launch produce one entry with two enquiries; they cannot be distinguished from one another.

Purpose: to see which launches our free tool is used for, and to be able to approach the operators of those products about our paid offering. The address of a launch is a publicly accessible product identifier, not information about you as a visitor. Where a product can nevertheless be attributed to a single natural person — a solo founder, for instance — you may object to this at any time and have the entry deleted; see clause 16.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the evaluation and further development of our own free offering and in direct advertising, Recital 47).

9a. Email addresses given for the board comparison (until 2 October 2026)

No email address is collected for this any longer. Since 2 October 2026 the board comparison under the launch check and on the launch planner is open to everyone, with no address and no account. From 26 September 2026 until then it asked for an email address, which was used for one thing: we sent a confirmation link to it, and clicking that link opened up the board comparison for the launch being looked at. The rest of this clause describes how the addresses given in that period are handled.

There is no mailing list and no newsletter. We do not send a regular email of any kind, and an address entered here is not used to advertise to you. The confirmation email described above is the only message this form produces.

Double opt-in. Entering an address did not by itself unlock anything. We sent one confirmation email to it and nothing else. Only when the link in that email was clicked did the comparison open. If the link was never clicked, the entry stays dormant and is never written to again — which is also what protects you if somebody else typed your address into the form.

What is stored: the email address, the wording agreed to, the launch being looked at, the times of the entry and of the confirmation, and the IP addresses at those two moments.

The two IP addresses are the one place on this website where we store an IP at all — reach measurement only uses it to calculate a daily checksum and does not store it (see clause 8). They are kept for a single purpose: we have to be able to show that the confirmation link was actually clicked by the holder of the address, and not by somebody who typed it in for them. They are not used for statistics, are not combined with anything else, and are not displayed anywhere in our administration.

Having the entry removed takes one message to us and no reason given; see clause 16. The entry is then marked as withdrawn rather than deleted — that marking is what stops the same address being unlocked again on a later visit without a fresh confirmation. Ask for full erasure instead and you get it.

Legal basis: Art. 6(1)(a) GDPR (consent). Consent can be withdrawn at any time with effect for the future; the withdrawal does not affect the lawfulness of anything done before it. § 7(2) no. 2 UWG is no longer cited here: it governs advertising by email, and no advertising is sent to these addresses.

10. Launch Kit requests (until 2 October 2026)

Until 2 October 2026 you could request a paid written assessment of a Product Hunt launch you were planning (the Launch Kit). It is no longer offered and the form no longer exists. This clause describes how requests sent before then are handled.

What was stored when the form was submitted:

We store the entry before we send ourselves a notification about it. That is deliberate: a review has a deadline, and an email that fails to arrive must not be able to make your request disappear.

What is expressly not stored:

• no IP address, in any form, and no browser fingerprint,
• no account — a review request creates no user account and no password,
• no payment data. Nothing is charged until we confirm we can take the review on; if it comes to that, payment runs through Stripe as described in clause 5.

Purpose and use: your entry is used to write your review and to correspond with you about it. It is not added to any mailing list, not used for advertising other services, and not passed to anyone else.

Legal basis: Art. 6(1)(b) GDPR — pre-contractual measures taken at your request, and performance of the resulting contract. Retention: see clause 15.

10a. Shovels (source code purchases)

The pages under /services/shovels/ are part of this website and are covered by clauses 3, 8, 11 and 12 like every other page here: no third-party content, page views and clicks counted as described in clause 8. The order form, the confirmation page, the download and the live demo are part of launchamp.eu too, and the orders are stored in its database (clause 3). Only the payment itself is handled by Stripe (clause 5).

What is processed when you buy:

• your name and email address, which you enter in the order form,
• the order: product, price, time, status and the number of downloads of your link,
• the time you accepted the terms, together with the version of the terms,
• the Stripe payment reference, and the billing address Stripe collects at payment,
• a hash of your IP address, formed with a secret key and not reversible, used only to slow down floods of unpaid orders from one connection (the IP address itself is not stored), and the daily checksum of the visit described in clause 8, which lets us see which channel led to an order on that day.

Payment runs through Stripe as described in clause 5. Card details are entered only on Stripe’s page and never reach us. Email: the order confirmation and the download link are sent to the address you entered, from hello@launchamp.eu. Stripe sends the receipt and invoice separately. Cookies: the order form uses the session cookie described in clause 11 to protect it against forged requests. The demo sets a session cookie of its own (dirsess) for the same purpose and for its sample login; nothing you enter there is saved.

Retention: orders that are never paid are deleted after 30 days. Paid orders are a receipt and are kept for as long as tax law requires (up to 10 years, Section 147 AO).

Legal basis: Art. 6(1)(b) GDPR (performance of the contract and delivery of the download), Art. 6(1)(c) GDPR in conjunction with Section 147 AO (retention), and Art. 6(1)(f) GDPR (proof of your declarations at checkout, protection against abuse). The Terms and licence of Shovels apply to the purchase.

10b. GEO-bot (GEO check and SEO check)

The pages under /services/geo-bot/ are part of this website and are covered by clauses 3, 8, 11 and 12 like every other page here. The checks are produced automatically; nobody reads your entries in the process. The German version of this section, which is legally binding, is on the GEO-bot privacy page.

What is processed:

• GEO check: brand name, website (domain), the description of your offer and, if you give it, the location, plus the measurement results (questions, answers, competitors, sources and the written actions).
• SEO check: the domain of your website, the report language and the results of the examination (measured values, addresses, titles, short quotes and findings).
• Order: the name, email address and billing address you give to Stripe, the order (check, domain, brand, offer, place, language, amount, payment date) and the Stripe payment reference. The link to your report is sent to that email address, from hello@launchamp.eu.
• Account: only if one exists from before 4 October 2026 — email address, a bcrypt hash of the password, your brands and their results.

Anthropic PBC (Claude API, USA) receives, for the GEO check, the description of your offer, the location and the brand name, so that buying questions can be generated and answered with web search, plus publicly accessible pages of competitors and sources for evaluation. For the SEO check it receives text excerpts of up to four pages of your website and the findings, to write assessments and suggested fixes. If those public pages show names or contact details, they can be contained in them. Your name and email address from the payment are not passed on. The transfer rests on standard contractual clauses. Google LLC (PageSpeed Insights, USA) receives, for the SEO check, the address of your home page to measure load speed; the transfer rests on the EU-U.S. Data Privacy Framework and standard contractual clauses. ChatGPT and Gemini (GEO check, optional): nothing is sent to OpenAI or Google by us — you ask them in your own chat. If you paste their answer into the form, only the provider names and source links read from it are kept with your report (not the pasted text) and deleted with it; our server opens those links (as “GeoBot”) to check that they exist and whether your brand appears there.

Retrieval of your website: for the SEO check and the quick check of the GEO check, our server retrieves publicly accessible pages of your website (up to 30 pages, robots.txt, sitemap). This appears in your server log files under the identifier “GeoBot”. Nothing is changed and nothing is passed on outside the examination.

Protection against abuse: to slow down floods of requests, the number of checks started from one connection per hour is counted in a temporary file named after a hash of the IP address and the hour. The IP address itself is not stored, and the file is deleted automatically.

Retention: reports and measurement results stay available under your personal link for 14 days after the check is complete and are then deleted automatically. The details of the order are kept as invoice data for as long as tax law requires (up to 10 years, Section 147 AO). Anonymous free checks from before 4 October 2026 are deleted after 90 days.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract), Art. 6(1)(c) GDPR in conjunction with Section 147 AO (retention) and Art. 6(1)(f) GDPR (protection against abuse and secure operation).

11. Cookies

LaunchAmp uses exactly two cookies, neither for advertising nor analytics purposes (the Shovels demo under /services/shovels/directory/demo/ adds one more; see clause 10a. The session cookie is also used by the GEO-bot order form; see clause 10b):

• Session cookie (PHPSESSID) — technically necessary in order to recognise you after signing in and to protect forms against cross-site request forgery. It is set with the HttpOnly and SameSite=Lax flags, is transmitted exclusively via cookies (not via the URL) and additionally carries the Secure flag on the live website. It is deleted when you close your browser or sign out.
• Operator opt-out cookie (la_notrack) — serves solely to ensure that the operator's own page views are not counted in the statistics described in clause 8. It can only be set from within the password-protected administration area, contains no personal information whatsoever and is never set in the browser of ordinary visitors.

No consent is required, as only strictly necessary cookies within the meaning of Section 25(2) no. 2 TDDDG are used.

12. No third-party services embedded on public pages

• Fonts, stylesheets and JavaScript libraries (including Tailwind CSS and Alpine.js) are served entirely from our own server. No content delivery network is embedded.
• There are no Google Fonts, no analytics tools, no advertising networks, no social media plugins, no tracking pixels and no embedded videos.
• Merely calling up a public page of launchamp.eu therefore creates not a single connection to a third-party server.

14. Recipients of data

• STRATO AG — hosting of the website, the database and the email mailbox (processor, servers in Germany).
• Stripe Payments Europe, Ltd. — payment processing (see clauses 5 and 10a).
• Google Ireland Limited — only if you actively use the sign-in with Google (see clause 4.3).
• Anthropic PBC — receives the content of a GEO or SEO check you order, in order to produce it (see clause 10b).
• Google LLC — receives the home page address of a website that is given for an SEO check, for the speed measurement (see clause 10b).
• Product Hunt, Inc. — receives only our server-side request for the public data of your launch; no data of your website visitors is transmitted (see clause 6).

Beyond this we do not pass on any data. We do not sell personal data and do not use it for automated decision-making or profiling.

15. Retention periods

• Account data: until the account is deleted. You can do this yourself at any time under "Account" in your dashboard, without asking us and without giving a reason. The deletion takes effect immediately and removes the account together with every launch it contains, including paid ones, and any password reset records (clause 4.2). It cannot be undone, and it does not trigger a refund — see the note on payment records below.
• Launch data: the launches you add to your account, and the figures publicly reported for them, are kept for as long as the account exists. You can delete your account yourself in the dashboard at any time; the launches belonging to it are deleted with it.
• Paid placements (a month in „Featured products“): which listing, the period booked, the amount paid, the payment reference and the email address given at checkout. The counts of how often a placement was shown and clicked are kept as pure numbers per day and are linked to no visitor. The record of the purchase is a receipt and is retained for as long as tax law requires (up to 10 years, Section 147 AO) — it therefore outlives the deletion of your account, which is the one exception to the point above.
• Payment records: are kept at Stripe and retained there in accordance with the statutory retention periods (up to 10 years, Section 147 AO, German Fiscal Code).
• Reach measurement rows and actions: contain only the daily rotating checksum described in clause 8, which cannot be linked to you once the day has passed. They are kept for as long as they are needed for our usage statistics.
• Entries from the free launch analysis: until the purpose ceases to apply, at the latest 24 months after the last enquiry, or without undue delay following an objection (clause 9).
• GEO-bot checks (clause 10b): reports and measurement results are deleted automatically 14 days after the check is complete; the order record is kept as a receipt for up to 10 years (Section 147 AO).
• Launch Kit requests (clause 10): deleted 12 months after the review was delivered or the request declined, and at any earlier point on request. Where a review was paid for, the payment record itself stays with Stripe under the statutory period above — but the free text you sent us is not part of that and goes with the rest.
• Prospect list entries: until the purpose ceases to apply, at the latest 24 months after retrieval, or without undue delay following an objection.
• Server log files of the hosting provider: according to STRATO AG's specifications.

16. Your rights

You have the following rights vis-à-vis us:

• right of access to the data stored about you (Art. 15 GDPR)
• right to rectification of inaccurate data (Art. 16 GDPR)
• right to erasure (Art. 17 GDPR)
• right to restriction of processing (Art. 18 GDPR)
• right to data portability (Art. 20 GDPR)
• right to object to processing that we base on a legitimate interest (Art. 21 GDPR) — this concerns clauses 7 and 8 in particular
• right to withdraw a consent given, with effect for the future (Art. 7(3) GDPR)

An informal message to hello@launchamp.eu is sufficient to exercise these rights. We reply within the statutory period of one month.

You do not have to wait for us in order to exercise your right to erasure (Art. 17 GDPR): under "Account" in your dashboard you can delete your account and all launches in it yourself, taking effect immediately. The same section lets you change your password. What we cannot delete on request are the payment records held at Stripe, which are subject to the statutory retention periods stated in clause 15.

Independently of this, you have a right to lodge a complaint with a data protection supervisory authority. The authority responsible for our place of business is:

17. Data security

• Transmission between your browser and our servers is encrypted via SSL/TLS.
• Passwords are stored exclusively as a bcrypt hash, never in plaintext.
• All database access uses prepared statements and is bound to the respective session.
• Forms in the administration area are protected against cross-site request forgery; payment notifications from Stripe are cryptographically signature-verified before they unlock a purchase.
• Operator accounts are completely separate from customer accounts and live in their own table.

18. Changes to this privacy policy

We adapt this policy when the scope of LaunchAmp's functionality or the legal requirements change. The current version is always available at launchamp.eu/legal/datenschutz. The version published at the time of your visit is the authoritative one.