Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address (required for account creation and authentication)
• Full name (optional)
• Avatar/profile photo (optional)
• Account creation and last update timestamps

1.2 Subscription and Payment Information

If you subscribe to a paid plan, we collect:

• Subscription plan type (Free, Starter, or Pro)
• Subscription status and billing period
• Payment information processed securely through our payment processor (we do not store full credit card details)
• Subscription identifiers for managing your plan
• Transaction amounts and currency
• Payment failure counts for subscription management

1.3 Research and Usage Data

When you use our service, we collect:

• Search queries (industry niches, regions, keywords)
• Generated business ideas and market analysis results
• Deep dive analysis results for ideas you explore
• Ideas you save with optional notes
• Research history with timestamps
• Number of searches used per billing period
• Web sources used in research (URLs and titles)

1.4 User Preferences and Settings

We store your personalization settings:

• Technology stack preferences (frontend, backend, database, etc.)
• Preferred deployment platforms and tools
• Currency preference for financial estimates
• Number of results to display per search
• Additional preference notes
• Theme preference (light, dark, or system)

1.5 Technical Information

We automatically collect certain technical information:

• Session information through secure HTTP-only cookies
• Authentication tokens for maintaining your login session
• API usage metrics for rate limiting and service optimization
• Token consumption data from AI API usage

2. How We Use Your Information

We use the collected information for the following purposes:

• Service Delivery: To provide AI-powered market research, generate business ideas, and deliver analysis results
• Account Management: To create and manage your account, authenticate your identity, and maintain your session
• Subscription Management: To process payments, manage subscriptions, track usage limits, and handle billing cycles
• Personalization: To tailor recommendations based on your technology preferences and settings
• History and Saved Content: To maintain your research history and saved ideas for future reference
• Service Improvement: To analyze usage patterns (in aggregate) to improve our service and develop new features
• Customer Support: To respond to your inquiries, troubleshoot issues, and provide assistance
• Communication: To send transactional emails (account notifications, subscription updates, payment confirmations)
• Rate Limiting: To enforce fair usage policies and prevent abuse
• Legal Compliance: To comply with applicable laws, regulations, and legal processes

3. Third-Party Services and Data Sharing

3.1 AI Service Providers

We use third-party AI services to generate market research, business ideas, and analysis. When you perform a search:

• Your search queries (niche, region, keywords) are sent to AI service providers
• AI service providers may process this data according to their own privacy policies
• Search grounding may be used to access real-time web data
• We track token usage for billing and rate limiting purposes

3.2 Payment Processing

Payment processing is handled by Polar, our Merchant of Record:

• Polar collects and processes payment information directly
• We receive payment confirmations via secure webhooks
• We store only subscription identifiers, not full payment card details
• Polar handles all tax compliance (VAT/GST/sales tax) as the Merchant of Record
• Polar's privacy policy governs their data handling practices

3.3 Supabase Infrastructure

Our database and authentication services are powered by Supabase:

• All user data is stored in Supabase PostgreSQL databases
• Authentication is handled through Supabase Auth
• Data is encrypted in transit and at rest
• Supabase complies with SOC 2 Type II and GDPR standards

3.4 No Selling of Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We share data only with the service providers listed above, and only to the extent necessary to provide our services.

4. Data Storage and Security

We implement industry-standard security measures to protect your information:

• Encryption: All data is encrypted in transit using HTTPS/TLS and at rest in our databases
• Authentication: Secure authentication using industry-standard protocols (JWT tokens, HTTP-only cookies)
• Access Controls: Strict access controls ensure only authorized personnel can access user data
• Regular Backups: Database backups are performed regularly and stored securely
• Monitoring: We monitor our systems for security threats and suspicious activity

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

5. Data Retention

We retain your data for the following periods:

• Account Data: Retained while your account is active and for a reasonable period after deletion for legal compliance
• Research History: Retained indefinitely unless you delete it or close your account
• Deep Dive Cache: Cached analysis results expire automatically based on timestamp to ensure fresh data
• Subscription Records: Retained for accounting and tax compliance (typically 7 years)
• Payment Records: Retained according to financial regulations and tax law requirements

6. Your Rights and Choices

You have the following rights regarding your personal information:

• Access: You can view and access your account data, research history, and saved ideas through your account dashboard
• Correction: You can update your profile information, preferences, and settings at any time
• Deletion: You can delete individual research sessions, saved ideas, or request full account deletion
• Export: You can export your research data, including business ideas and analysis, in PDF format
• Opt-Out: You can opt out of non-essential communications (we will still send transactional emails)
• Subscription Cancellation: You can cancel your subscription at any time from your account settings

To exercise these rights, please use the in-app controls or contact us at privacy@oppfinder.app.

7. International Data Transfers

Our services are provided globally, and your data may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws than your jurisdiction. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

8. Children's Privacy

Our service is not directed to children under the age of 18. We do not knowingly collect personal information from children under 18. If you become aware that a child has provided us with personal information, please contact us, and we will take steps to delete such information.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of our service after changes become effective constitutes acceptance of the revised Privacy Policy.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@oppfinder.app
• Support: Contact Form

11. GDPR Compliance (EU Users)

If you are located in the European Economic Area (EEA), you have additional rights under GDPR:

• Legal Basis: We process your data based on consent, contract performance, and legitimate interests
• Right to Object: You can object to processing based on legitimate interests
• Right to Restriction: You can request restriction of processing in certain circumstances
• Right to Portability: You can request your data in a structured, machine-readable format
• Right to Lodge a Complaint: You can file a complaint with your local data protection authority

12. POPIA Compliance (South African Users)

For users in South Africa, we comply with the Protection of Personal Information Act (POPIA). You have the right to access, correct, or delete your personal information, and to object to or restrict processing.