Privacy Policy

Introduction

SageTweaks ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services, and complies with the EU General Data Protection Regulation (Regulation (EU) 2016/679 — "GDPR") and the Dutch implementation thereof (Uitvoeringswet AVG — "UAVG").

By using our services, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Personal Information You Provide

When you register, make a purchase, or interact with our services, we collect:

• Account Information: Name, email address, password (encrypted)
• Payment Information: Billing address, payment method details (processed securely through Stripe)
• License Information: Device identifiers, operating system, hardware specifications
• Communication Data: Support tickets, emails, feedback you send us

1.2 Automatically Collected Information

When you use our services, we automatically collect:

• Usage Data: License activation timestamps, feature usage statistics, device activity
• Technical Data: IP address, browser type, device information, operating system
• Cookies: Session cookies for authentication, preference cookies for settings
• Log Data: Server logs including timestamps, API requests, error logs

1.3 Information from Third Parties

• Supabase Auth: Authentication tokens and email verification status
• Stripe: Payment transaction status, refund information (we never store credit card numbers)

2. How We Use Your Information

2.1 Service Delivery

• Create and manage your account
• Process payments and deliver license keys
• Activate and manage software licenses on your devices
• Send order confirmations and license expiration reminders
• Provide customer support

2.2 Service Improvement

• Analyze usage patterns to improve our software
• Monitor system performance and uptime
• Detect and prevent fraud or unauthorized access
• Troubleshoot technical issues

2.3 Communication

• Send transactional emails (order confirmations, password resets)
• Send service announcements (license expiration, product updates)
• Send marketing communications (with your consent - opt-out available)
• Respond to your inquiries and support requests

2.4 Legal Compliance

• Comply with legal obligations (tax, accounting, anti-fraud)
• Enforce our Terms of Service
• Protect our rights, property, and safety
• Respond to lawful requests from authorities

3. Legal Basis for Processing (GDPR)

If you are in the European Economic Area (EEA), we process your data based on:

• Contract Performance: Processing necessary to fulfill our service agreement (Art. 6(1)(b) GDPR)
• Legitimate Interest: Fraud prevention, security, and reliability telemetry (Art. 6(1)(f) GDPR)
• Legal Obligation: Tax compliance, accounting records (Art. 6(1)(c) GDPR)
• Consent: Marketing communications and non-essential analytics (Art. 6(1)(a) GDPR - withdrawable anytime)

4. Data Sharing and Disclosure

We share data only in these limited circumstances:

4.1 Service Providers

• Stripe: Payment processing (PCI-DSS compliant)
• Supabase: Authentication and PostgreSQL database hosting (encrypted at rest)
• SendGrid/SMTP Provider: Email delivery
• Sentry: Error monitoring (anonymized error logs)
• Vercel/Railway: Hosting infrastructure

All service providers are contractually bound to protect your data and use it only for specified purposes.

4.2 Legal Requirements

We may disclose your information if required by law or in response to:

• Court orders, subpoenas, or legal process
• Law enforcement requests (with proper legal authority)
• Protection of our rights, property, or safety
• Investigation of fraud, security threats, or violations of our Terms

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity (you will be notified via email).

5. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: HTTPS/TLS 1.3 for data in transit, AES-256 for data at rest
• Password Security: bcrypt hashing with salt rounds and Supabase-managed auth credentials
• Access Controls: Role-based access control (RBAC), least privilege principle
• Monitoring: Automated security scanning, intrusion detection, error monitoring
• Compliance: SOC 2 and ISO 27001 certified infrastructure providers (Supabase, Vercel)

6. Data Retention

We retain your data only as long as necessary for the purposes described in this policy:

After the retention period expires, we securely delete or anonymize your data.

7. Your Rights

You have the following rights regarding your personal data:

7.1 GDPR Rights (EEA Residents)

• Right of Access (Art. 15): Request a copy of your data
• Right to Rectification (Art. 16): Correct inaccurate data
• Right to Erasure (Art. 17): Delete your data ("right to be forgotten")
• Right to Restriction (Art. 18): Limit processing of your data
• Right to Data Portability (Art. 20): Export your data in machine-readable format
• Right to Object (Art. 21): Object to marketing or profiling
• Right to Withdraw Consent (Art. 7): Withdraw consent for marketing anytime

7.2 How to Exercise Your Rights

To exercise any of these rights:

1. Via Dashboard: Access, download, or delete your data in Account Settings
2. Via Email: Send requests to support@sagetweaks.com
3. Via Contact Form: Submit a request through our Support page

We will respond within 30 days (1 month as required by GDPR Article 12).

7.3 Right to Lodge a Complaint

If you believe we have violated your privacy rights, you may lodge a complaint with the competent data protection authority. Our lead supervisory authority is the Dutch DPA:

You may also lodge a complaint with the data protection authority in your country of habitual residence or place of the alleged infringement.

8. Cookies and Tracking Technologies

We use strictly necessary cookies by default. Optional analytics only load after you accept analytics cookies in the banner.

8.1 Essential Cookies (Required)

• Authentication Cookie: Session token for signed-in users
• CSRF Token: Security token to prevent cross-site attacks

8.2 Preference Cookies (Optional)

• Cookie Consent: Remembers whether you accepted or rejected optional analytics
• Preferences: May remember settings such as theme, language, or region when enabled

8.3 Analytics Cookies (Optional - Requires Consent)

We may use Google Analytics, Vercel Analytics/Speed Insights, PostHog, and web-vitals reporting to understand website usage and funnel quality. These non-essential analytics loaders check your cookie consent choice before loading. Reject keeps them off.

8.4 Advertising Cookies (Optional - Requires Consent)

We advertise SageTweaks on Google Ads and on X (Twitter). When you accept optional cookies, these platforms may set cookies that let us measure which adverts lead to a free trial or a purchase, so we can stop paying for adverts that do not work. Rejecting optional cookies keeps them off entirely — the tags are never loaded.

• Google Ads: Conversion measurement and click attribution (including the _gcl_* cookies and the gclid click identifier)
• X (Twitter) Ads: Conversion measurement for adverts shown on X

We do not use these cookies to build advertising profiles about you, and we do not sell your data. We record the advertising campaign associated with an order so we can measure cost per customer.

If we enable Google's Enhanced Conversions in future, your email address would be converted into an irreversible cryptographic hash inside your browser before being sent — your actual email address would not be transmitted to Google. This is currently disabled.

8.5 Managing Cookies

You can control cookies through:

• Our cookie consent banner (first visit)
• Your browser settings (disable all cookies)
• Clearing the `cookie-consent` local storage value if you want the banner to ask again
• Browser extensions (e.g., Privacy Badger, uBlock Origin)

Note: Disabling essential cookies may affect website functionality.

9. International Data Transfers

Your personal data is primarily processed within the European Economic Area (EEA). Some of our processors may transfer data outside the EEA (for example, Stripe processes certain payment data in the United States, and our analytics provider may transfer aggregated data internationally).

For all transfers outside the EEA, we ensure adequate protection through:

• EU Standard Contractual Clauses (SCCs): 2021 European Commission-approved data transfer agreements (Decision (EU) 2021/914)
• Data Processing Agreements (DPAs): GDPR Article 28-compliant agreements signed with all processors (Stripe, Supabase, Resend, etc.)
• Adequacy Decisions: Transfers to countries the European Commission has deemed to provide adequate protection (e.g. EU-US Data Privacy Framework where applicable)
• Supplementary Measures: Encryption in transit and at rest, access controls, and audit logging, in line with the post-Schrems II EDPB guidance

You may request a copy of the safeguards we apply for transfers by emailing support@sagetweaks.com.

10. Children's Privacy

We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected data from a child, please contact us immediately at support@sagetweaks.com, and we will delete it within 72 hours.

11. Residents Outside the EU/EEA

We extend the core data subject rights described in Section 7 — access, deletion, correction, objection, and portability — to all of our users, regardless of where you live.

Residents of certain jurisdictions (e.g. California — CCPA/CPRA, Brazil — LGPD, the United Kingdom — UK GDPR) may have additional or differently-named statutory rights under local law. To exercise any of these rights, email support@sagetweaks.com and we will respond within the timeframe required by applicable law (and within 30 days at most).

We do not sell or share your personal data with third parties for monetary or other valuable consideration.

12. Data Breach Notification

In the event of a data breach affecting your personal data, we will:

• Notify affected users via email within 72 hours of discovery (GDPR requirement)
• Notify relevant authorities (DPAs, state attorneys general)
• Provide details of the breach, data affected, and mitigation steps
• Offer credit monitoring or identity theft protection (if applicable)

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make changes:

• We will update the "Last Updated" date at the top
• We will notify you via email if changes are material
• We will display a prominent notice on our website

Continued use of our services after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data: