Privacy Policy

Last updated: December 7, 2025

1. Data Controller

The data controller responsible for processing your personal data is:

2. What Personal Data We Collect

We collect and process the following categories of personal data:

2.1 Account Information

• Name and email address (when you create an account)
• Profile picture (if provided via Google OAuth)
• Account preferences and settings

2.2 Usage Data

• Landing pages you create and their content
• Analytics data (page views, conversions, bounce rates)
• A/B test configurations and results
• Form submissions and lead data you collect

2.3 Technical Data

• IP address (anonymized where possible)
• Browser type and version
• Device information
• Operating system
• Referral source
• Session duration and page interactions

2.4 Payment Information

• Billing address
• Payment method details (processed securely by our payment provider)
• Transaction history

3. Legal Basis for Processing (Art. 6 GDPR)

We process your personal data based on the following legal grounds:

• Contract Performance (Art. 6(1)(b) GDPR): Processing necessary to provide our services to you
• Consent (Art. 6(1)(a) GDPR): Where you have given explicit consent (e.g., marketing communications, cookies)
• Legitimate Interests (Art. 6(1)(f) GDPR): For fraud prevention, security, and service improvement
• Legal Obligations (Art. 6(1)(c) GDPR): To comply with applicable laws and regulations

4. How We Use Your Data

• To provide and maintain our landing page generation service
• To process your transactions and manage your subscription
• To provide AI-powered optimization and A/B testing
• To analyze and improve our service performance
• To communicate with you about updates, support, and marketing (with consent)
• To detect and prevent fraud and abuse
• To comply with legal obligations

5. Data Sharing and Third Parties

We may share your personal data with:

5.1 Service Providers

• Supabase: Database hosting and authentication (EU servers)
• Google Cloud: AI services for content generation
• Stripe: Payment processing (PCI-DSS compliant)
• Microsoft Clarity: Analytics and heatmaps (with anonymization)
• Vercel: Website hosting and CDN

5.2 Legal Requirements

We may disclose your data if required by law, court order, or governmental authority.

6. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA). We ensure appropriate safeguards are in place, including:

• EU Standard Contractual Clauses (SCCs)
• EU-US Data Privacy Framework certification
• Binding Corporate Rules where applicable

7. Data Retention

We retain your personal data for as long as necessary to:

• Provide our services to you
• Comply with legal obligations (e.g., tax records: 10 years in Germany)
• Resolve disputes and enforce agreements

When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law.

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of Access (Art. 15): Request a copy of your personal data
• Right to Rectification (Art. 16): Correct inaccurate or incomplete data
• Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to Restriction (Art. 18): Limit how we process your data
• Right to Data Portability (Art. 20): Receive your data in a structured format
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Withdraw Consent (Art. 7): Withdraw consent at any time

To exercise these rights, contact us at privacy@paglify.com. We will respond within 30 days.

9. Cookies and Tracking

We use cookies and similar technologies. For detailed information, please see our Cookie Policy.

Categories of cookies we use:

• Essential Cookies: Required for the website to function
• Analytics Cookies: Help us understand how visitors use our site
• Functional Cookies: Remember your preferences

10. Data Security

We implement appropriate technical and organizational measures to protect your data:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• Regular security audits and penetration testing
• Access controls and authentication mechanisms
• Employee training on data protection

11. Children's Privacy

Our services are not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority. In Germany, you can contact:

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our website. The "Last updated" date at the top of this policy indicates when it was last revised.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: