Privacy Policy

This policy explains what we collect, why, and what you can demand from us. It covers saasledge.com and everything under it.

Who is responsible. SAASLEDGE is run by Ruslan Nazarov, based in Odesa, Ukraine. He is the data controller for everything described here. Write to [email protected] about anything on this page.

What we collect

When you create an account. Your email address, the password you choose, and optionally your name and company. The password is never stored as you typed it: we keep a PBKDF2-SHA256 derivation with a unique salt, which cannot be reversed back into your password.

When you list a product. Everything you type into the listing form: product name, website, category, description, pricing, screenshots and video links. All of it is meant to be published, that is the point of a catalogue.

When you donate. Everything on this site is free, so the only payment that can happen is a voluntary donation. Card details go to the payment provider, never to us: we never see or store a card number. What our records hold is the fact of the payment and its amount, kept because accounting rules require it.

When you subscribe to promotional email. Your email address, the language of the page you subscribed from, the exact wording of the consent you agreed to, and the moment you agreed.

When you accept measurement cookies. Google Analytics 4 and Microsoft Clarity record pages viewed, referrer, approximate location from a truncated IP address, device and browser, and in Clarity’s case how the pointer moved on a page. Typed text and form fields are masked.

None of this runs unless you accept the banner, and declining leaves the site fully usable. Details are in the Cookie Policy.

When you simply visit. Our host, Cloudflare, processes your IP address and request metadata to deliver pages and to stop abuse. We do not run advertising trackers and we do not build advertising profiles.

Security logs. Sign-in attempts, password reset requests and form submissions are rate-limited. To do that we briefly keep a record tied to your IP address. These records are deleted automatically.

Why we are allowed to hold it

• To provide the service you asked for. Your account and your listings exist because you created them. Legal basis: performance of a contract.
• To keep the books. Records of donations received. Legal basis: a legal obligation to keep accounting records.
• To send promotional email. Only if you ticked the box. Legal basis: your consent, which you can withdraw at any time without giving a reason.
• To measure how the site is used. Analytics and session recording. Legal basis: your consent, given in the cookie banner and withdrawable there.
• To keep the site working and unabused. Rate limits, spam prevention, fraud checks. Legal basis: our legitimate interest in running a service that is not overrun.

Promotional email, specifically

We ask separately, we never pre-tick the box, and an account works exactly the same whether you subscribe or not. We store the consent text you saw so that neither of us has to rely on memory about what you agreed to.

Every promotional email carries an unsubscribe link that works without signing in. Unsubscribing is immediate and permanent unless you ask to come back.

Service email is different: password resets, listing status, payment receipts and account notices are part of the service and are not marketing.

Who else sees your data

• Cloudflare hosts the site, the database and the uploaded images. Data lives on their infrastructure.
• Google and Microsoft receive analytics data, but only after you accept the cookie banner.
• Resend delivers transactional email such as password resets, when configured.

Some of these companies are based outside Ukraine and the EU. Transfers rely on the standard contractual clauses those providers publish.

We do not sell personal data. We do not share it with advertisers or data brokers.

How long we keep it

• Account data lives while your account exists. Delete the account and it goes, along with your listings.
• Published listing pages stay up while the listing is live, since they are the product you asked for.
• Donation records are kept as long as accounting rules require, which is longer than your account may live.
• Subscriber records live until you unsubscribe, then we keep the fact of the unsubscribe so we do not email you again by accident.
• Analytics data follows the retention set in Google Analytics and Clarity, which is at most 14 months and 1 year respectively.
• Rate-limit records are cleared automatically within days.

Your rights

Wherever you live, you can ask us to show you what we hold, correct it, delete it, hand it over in a portable form, or stop processing it.

If you are in the EU, the UK or a similar jurisdiction, these are legal rights under the GDPR and equivalents, and you may complain to your data protection authority. In Ukraine the equivalent rights come from the law on personal data protection.

Three of them you can exercise yourself, without asking anyone: delete your account from the account settings, unsubscribe from any promotional email using its link, and change your cookie choice on the Cookie Policy page. For everything else, email [email protected]. We answer within 30 days.

Cookies

One cookie keeps you signed in and cannot be switched off without breaking sign-in. Analytics cookies only exist if you accepted them. The full list, with lifetimes and the companies behind them, is in the Cookie Policy.

Children

This is a business tool. It is not directed at children and we do not knowingly hold data about anyone under 16.

Information about companies added by other people

Anyone can add any company to this catalogue, so pages here contain information about businesses that did not put it there themselves. Most of that is company information rather than personal data: product name, website, pricing, category, logo.

Sometimes it touches a person anyway, such as a founder’s name in a description, or a face in a screenshot.

On what basis. Where such information is personal data, we rely on our legitimate interest in running a catalogue of publicly available business information, and on the interest readers have in finding it. We do not build profiles of individuals, we do not enrich pages with data from other sources, and we do not sell any of it.

What we do not accept. A private individual’s home address, private phone number, personal email, identity document, or a photograph published without consent. If it is submitted, it is removed.

If a page names you. Write to [email protected] and tell us which page. We take your name out, or take the page down, and we do it within thirty days and usually within two working days.

You do not have to explain why, and you do not need an account. This is your right to object and your right to erasure under Articles 17 and 21 of the GDPR, and we do not make you argue for it.

If it is your company rather than you personally, the faster route is Claim Your Page, which also lets you take the page over and run it yourself.

Changes

If this policy changes in a way that affects you, the date at the top changes, and material changes are announced on the site before they take effect.