Privacy policy

The SaaS Harbor is run by The SaaS Harbor Team, which is responsible for the personal data described here. For privacy questions and requests, write to the contact address we will publish soon.

• Account. Your email address and your password, which is stored only as a salted hash. We also record account events, such as sign-ins, with their time and IP address, to keep accounts secure.
• Profile. Your name, headline, location, About text, experience, skills, links and photo, and the page address made from your name. You decide what to fill in.
• Products. Name, tagline, description, category, website, logo and launch date.
• Revenue verification. If you connect a payment provider (Stripe, Paddle, Polar or Dodo Payments): which one, the read-only key you paste, stored encrypted, and the results of verification, kept as one result per day, the latest of that day. That is your monthly recurring revenue, the number of paying customers, totals per currency, revenue at each of the last twelve month-ends, and one-way hashes of subscription IDs, which stop one account from verifying two products.
• Messages. The messages you send and receive, how far you have read each conversation, and the users you block.
• Reports and moderation. When you report something: the reason, your explanation and a copy of what you reported, which for a message is its text and time. When an admin decides about your product or account: the decision, its reason and explanation, when it was made and by which admin.
• Email notifications. Which emails you want, emails waiting to be sent to you, and a record of sent ones. A message email names the sender but never contains the message.
• Preferences. Whether you chose the light or dark theme, in a cookie on your device.

With the key you provide, our server reads from the account you connect: subscriptions, invoices, coupons and prices from Stripe; subscriptions and transactions from Paddle; your organization, subscriptions and orders from Polar; and brands, subscriptions and payments from Dodo Payments. It only sends requests that read, and never changes anything in your account.

These records can include your customers' names, email addresses and countries. We use only amounts, taxes, currencies, dates, plan details and customer IDs, the last only to count paying customers, to calculate the figures above, and we never store or log details about your customers.

Disconnecting deletes the stored key at once. Earlier verification results stay in your private history until you delete the product or your account. You can also delete the key with your payment provider.

• To run your account and publish the profile and products you create. This is the service you sign up for (performance of a contract, GDPR Article 6(1)(b)).
• To verify revenue through the payment provider you connect, and show the figures you choose to share. This is part of the same service (Article 6(1)(b)).
• To deliver the messages you send to other users, and to email you about unread messages, also part of the service (Article 6(1)(b)). You can turn message emails off.
• To keep the service secure and fair, through the sign-in records, the subscription hashes described above, and limits on how many messages, reports and products an account can add and how often it checks revenue. The limits keep the times you added a product for a day and the times you checked revenue for an hour (our legitimate interests, Article 6(1)(f)).
• To handle reports and moderate the site. The EU Digital Services Act requires us to act on reports of illegal content and to explain our decisions (a legal obligation, Article 6(1)(c)). Other reports and decisions keep the site safe for its users (our legitimate interests, Article 6(1)(f)).

We do not sell data, show ads, or use analytics or tracking of any kind.

• Everyone: your profile, your products and their logos, and the verified figures you choose to share. Sharing MRR also shows its month-end history and 30-day growth. Paying customers and the launch date each have their own setting. A badge you embed on your own site shows the shared MRR there, and browsers and caches may keep it for up to ten minutes after you stop sharing.
• Only you: your connection status, your verification history and any figures you keep private. Stored keys are never shown, not even to you. Which payment provider verified the figures is public once they are verified.
• The two of you: a conversation and its messages are visible only to the two users in it. A block is visible only to the user who made it. Messages are not end-to-end encrypted, so people who run the site's systems could technically access them; we only do so when the law requires it.
• Admins: the people the operator appoints to review reports. They see your email address, when you joined and last signed in, reports about you or by you, and the decisions about your account. An admin sees a private message only when one of the two users reports it, and then only a copy of that message. A user who is reported never learns who reported them.
• Service providers: our hosting, database and email providers process data on our behalf to run the site. The site runs on Vercel, with its servers in Frankfurt, Germany. The database, sign-in and image storage run on Supabase, in its Frankfurt, Germany region. Account emails, such as confirmation and password reset messages, and notification emails are sent through Resend. Vercel and Resend are based in the United States. If a provider handles data outside the EU or EEA, we use the safeguards the GDPR requires, such as the EU standard contractual clauses.

Exchange rates for other currencies come from a public service. Those requests contain only currency codes.

We only use cookies the site needs: sign-in cookies that keep you signed in, and a theme cookie that remembers light or dark mode. There are no advertising or analytics cookies.

We keep your data for as long as you have an account. When you delete your account, your profile, products, images, provider keys, verification history, conversations and sign-in records are deleted right away. A conversation is deleted for both users when either of them deletes their account. Deleting a single product removes its details, its logo, its provider key and its verification history in the same way. Logos and photos you replaced earlier are kept until you delete your account. Copies in backups disappear when those backups expire.

An email waits in a queue until it is sent, and a record of it is kept for a week afterwards, then deleted. The notices that update an open conversation live hold only ids and are deleted within a few days; deleting your account deletes the ones about you at once, as well as emails queued to others about your messages.

A report is deleted when either the user who sent it or the user it is about deletes their account. Deleting a reported product or message keeps the report and its copy, so admins can still review it. Admin decisions are deleted with the account they concern.

Information that was public may already have been copied by others, such as search engines, before it was deleted.

You can see and change your profile and products at any time in your dashboard, follow the reports you sent under Your reports, choose which emails you get under Email settings, delete a product at the bottom of its editor, and delete your account yourself under Profile → Delete account.

Under the GDPR you also have the right to access your data, have it corrected, erased or moved to another service, restrict how it is used, and object to use based on our legitimate interests. To use these rights, write to the contact address we will publish soon. You can also complain to a data protection authority, for example in the country where you live or work.

When this policy changes, we update the date at the top. We will email registered users about changes that affect how we use data they have already given us.