This policy explains what personal data we collect when you visit shipanysaas.com or our live demos (shipanysaas-demo.vercel.app and shipanysaas-mobile-demo.vercel.app), contact us, buy the shipanysaas starter kit, or hear from us about it, and what we do with it.
Who we are
shipanysaas is sold by Dataspecc LLC ("we", "us"), 2055 Limestone Road, Wilmington, DE 19808, United States. We decide how your personal data is used, so we are responsible for it (the "controller").
For any question or request about your data, use our contact page or email buildwitholga@gmail.com.
What we collect and why
When you buy. Checkout runs on Stripe. Stripe collects your email address, name, card details and billing country, and asks for your GitHub username. We never see your full card number. We use your email address and GitHub username to deliver the kit: we invite that GitHub account to our private repository, and GitHub and we each email you about it. We keep a record of each order (plan, GitHub username and delivery status) in Stripe, to manage your access and for our tax and accounting records. Legal basis: carrying out our contract with you, and our legal obligations.
When you contact us or list a product in the showcase. We receive your name, email address and message, and for the showcase the product details you enter. They reach our support mailbox by email. We use them to answer you and, for the showcase, to review your product. If we list it, its details and the maker name and link you gave are shown publicly on the showcase page. Legal basis: our legitimate interest in answering you, and your request to be listed.
When you create an account. The sign-in pages store your email address, your name, any profile picture you add and your sign-in details, and our database provider records the IP address and browser of each sign-in for security. If you sign in with Google, Google shares your name, email address and picture with us. If you create a team, we store its name and members and the email addresses of the people you invite, and we email them the invitation. You can delete your account at any time in its settings. Legal basis: carrying out our contract with you.
When you use the live demos. One shared demo account is open to every visitor, so anything you type there can be seen by others. You can also create your own demo account with an email address. Demo accounts and what they contain are deleted at the hourly reset; uploaded pictures are removed from storage later. Please don't enter real personal data in the demos.
When you use the SaaS idea generator. What you type into the free SaaS idea generator (your skills, the customers you can reach and the options you pick) is sent through Vercel's AI Gateway to an AI model provider, which writes your ideas and sends them back to your browser. We don't store what you type or the ideas you get, and we only use providers that don't train AI models on it. To keep the tool free for everyone, we count requests per visitor with a one-way hash of your IP address, kept in server memory for up to a day. Please don't enter confidential information. Legal basis: our legitimate interest in providing the tool you asked to use.
When we contact you about shipanysaas. We look for developers and businesses who write in public about building a software product, for example on Reddit, X, Hacker News, GitHub or Indie Hackers, or whose company website says they build apps for clients. We keep a short note about each person we may contact: your name or username, the link to the public post or profile where we found you, what it said in a few words, your company, role and country when they are public, and, for companies, the work email address published on their website for business enquiries. We never buy contact lists. We use AI tools to find relevant public posts and to draft messages; a person reads every message before it is sent. We first answer in public, in the thread you started, and we send a direct message only where you invited one. We email only work addresses published for business contact, and only where the law allows it without asking first; each email says where we found your address and how to stop further messages. If you don't reply, we follow up a few times at most, and if you ask us to stop, we stop. Legal basis: our legitimate interest in telling people about a product that fits what they are working on. You can object at any time, and we then stop contacting you.
Analytics. We use PostHog and Usermaven, on this site and on the web demo, to understand how they are used. They receive the pages you view, what you click, how you scroll and move the mouse, the page or ad link that brought you here (campaign tags and ad click IDs), browser errors, your device and browser type, and your IP address, which is used to estimate your location. PostHog can record sessions: what you type is never recorded, and text and pictures in signed-in areas are hidden. We may also show short on-page surveys through PostHog.
If you are signed in, PostHog and Usermaven also receive your user ID, email address and sign-up date, and Usermaven the name of the team you open. When you click a buy button, the checkout link passes your analytics IDs and campaign tags to Stripe. After you pay, we send the order (number, amount and plan) to PostHog and Usermaven, with your email address when your analytics IDs came with it. That links the purchase to your earlier visits.
In the EU, the EEA, the UK and Switzerland we ask first. Until you answer the cookie banner, PostHog collects no analytics (your browser only downloads its settings), and Usermaven counts your visit without cookies or an identifier; it briefly keeps unsent visit counts in your browser's storage. If you decline, both only count visits without cookies, PostHog stores your answer, and nothing is linked to you. Elsewhere, analytics runs without a banner. Legal basis: your consent for analytics cookies, recordings and linking analytics to you, where we ask for it; otherwise our legitimate interest in understanding and improving the site. You can object at any time by contacting us.
Server logs. Our hosting provider, Cloudflare, records technical data such as your IP address, your browser and the pages you request, to run and protect the site. Legal basis: our legitimate interest in keeping the site secure.
We don't sell your personal data, share it with advertising networks or use it to target ads. Our site doesn't respond to Do Not Track or Global Privacy Control signals.
Who we share it with
We use these providers to run the site and deliver the kit:
- Stripe: payments and order records
- GitHub: access to the kit's private repository
- Resend: sending email
- Google: our support mailbox runs on Gmail, so it receives the messages you send us; also sign-in, if you choose Google
- Cloudflare: hosting this site
- Vercel: hosting the live demos, and the AI Gateway that passes idea generator requests to an AI model provider
- AI model providers, picked by Vercel's AI Gateway from those that don't train on your data: writing the ideas in the idea generator
- Supabase: the database and sign-in
- PostHog and Usermaven: analytics
- Anthropic (Claude) and Notion: finding public posts, drafting our messages and keeping our notes about the people we contact
- Lemlist: sending our emails to the people we contact, when we email them
Most of them process data for us under data processing terms. Stripe, Google and GitHub also use some data under their own privacy policies, for example to prevent fraud. We may also share data when the law requires it, or to protect our rights or other people's safety.
Where your data is processed
Our providers process data mainly in the United States, and some of them in other countries. When data from the EU, the EEA, the UK or Switzerland is transferred, we rely on our providers' safeguards, such as the European Commission's Standard Contractual Clauses.
How long we keep it
- Orders: as long as tax and accounting law requires.
- Messages: as long as we need to answer them and handle any follow-up.
- Accounts: until you delete your account or ask us to. Analytics already linked to you stays until it is deleted from PostHog and Usermaven, or until you ask us to delete it.
- Analytics: for as long as it helps us understand how the site is used, within the retention limits of PostHog and Usermaven, and deleted earlier if you ask.
- Demo accounts and content: deleted every hour; uploaded pictures are removed from storage later.
- People we contact about shipanysaas: up to 12 months after our last message, unless you become a customer. If you ask us to stop, we keep only your name, username or email address on a do-not-contact list, so that we never contact you again.
Your rights
Depending on where you live, you can ask to see the personal data we hold about you, to correct it, to delete it, to receive a copy of it, or to object to or limit how we use it. Where we rely on your consent, you can withdraw it at any time, for example on our Cookie Policy page.
To use any of these rights, contact us. We answer within one month. If you are in the EU, the EEA, the UK or Switzerland, you can also complain to your data protection authority.
Children
The site and the kit are meant for developers and businesses, not for children under 16, and we don't knowingly collect data about them.
Security
We choose providers with strong security practices, limit who can access personal data, and encrypt it in transit. No system is perfectly secure: if you think something is wrong, tell us straight away.
Changes to this policy
When our practices change, we update this page and the date at the top.
Contact
Dataspecc LLC, 2055 Limestone Road, Wilmington, DE 19808, United States. Use our contact page or email buildwitholga@gmail.com.