Privacy Policy

1. Who we are

WantBorn is operated by [LLC NAME — PENDING FORMATION] (in formation); until formation completes, by its founder directly. Registered address: [REGISTERED ADDRESS — PENDING FORMATION]. For privacy questions, contact privacy@wantborn.com.

EU representative (GDPR Art. 27): [EU REPRESENTATIVE — PENDING DESIGNATION]. We serve EU residents from outside the EU, so a formal Art. 27 representative is legally required — the founder living in the EU does not satisfy this on its own. Until a representative is designated, EU data-subject requests can be sent to the privacy email above and will be handled directly by the founder.

2. What we collect

Verified against the code and schema, not assumed:

• Account data: your email, name, and profile image. Sign-in is passwordless (magic link) — we never collect or store a password.
• Content you post: Forum quests and solutions (public, with your email/name attached as the author), votes and “I have this problem too” checks (identity kept, not displayed), LaunchOS project data you write about your own product.
• Research reports: the topic you submit for analysis. Free/anonymous teaser reports are generated without requiring an account and are published publicly by default, with your identity never attached unless you explicitly opt in. Full member reports are private by default; you can choose to publish one.
• Referral data: who invited you. We hash the signup IP address and user agent for abuse control — the raw values are never stored.
• Waitlist / lead data: email and any message you submit.
• Document access logs: for shared documents (e.g. investor materials), we log the accessing account, timestamp, IP address, and user agent for security and audit.

What we do not collect: no passwords (magic-link only) · no payment card data (Stripe, when active, holds that directly) · no raw IP address for referral attribution (hashed) · no scraped contact details for people quoted in research reports · no tracking cookies (our analytics is cookieless).

3. Why we use it (legal bases)

• To operate the service — Forum, LaunchOS, reports, competitions — contract / legitimate interests.
• To send transactional email (magic links, notifications) — contract.
• To analyze public discussion (Hacker News, Stack Exchange, GitHub Issues, and similar sources) for research reports — legitimate interests, based on a documented balancing test; we process only public post text, never infer private contact details for the people quoted, and respect each source's own terms.
• To secure the platform and keep access logs — legitimate interests / legal obligation.
• To send optional product updates where you opted in — consent.

4. Sharing & sub-processors

We don't sell your personal data. We use the following service providers to run WantBorn; each processes only what is needed for its function.

• Resend (US) — all transactional email, including magic links. Receives recipient email and message content.
• OVH AI Endpoints (EU/France) — bulk research analysis. Receives public post text only, never account data.
• Anthropic and/or OpenAI (US) — an optional deeper analysis tier for research reports. Receives public post text only, never account data.
• Stripe — payment processing for membership. Not currently active — no card is charged and no payment data is sent today. When membership billing is switched on, Stripe will receive your email and handle card data directly; we never see or store full card numbers.
• Plausible (EU) — cookieless website analytics. No personal data.
• OVH / Coolify (EU/France) — application and database hosting for everything above.
• Cloudflare — DNS only; does not proxy or see your traffic content.

We have not yet formally verified each provider's current training-on-input posture with a signed data processing agreement for every one of the above; where that verification is still pending, we do not send personal data to that provider beyond what's listed here.

5. Retention

We do not enforce a fixed retention period in our systems today. We keep your data for as long as your account is active or as needed to operate the service and meet legal obligations, then delete or anonymize it on request. We are not going to claim a retention number we don't actually enforce in code.

6. Your rights

Depending on where you live (including under the GDPR and, for California residents, CalOPPA), you may have rights to access, correct, delete, port, or restrict processing of your data, and to object or withdraw consent. To exercise these, email privacy@wantborn.com. You may also complain to your local data protection authority. We do not currently meet the revenue or user-volume thresholds that trigger the CCPA/CPRA, so we do not claim compliance with those specific statutes, but we honor the same access/delete/opt-out requests regardless.

7. Publicly visible content

Some content is public by design: Forum quests and solutions (with your author name), free/anonymous research report teasers (never with your identity, unless you opt in), and competition or showcase entries you submit. Research reports quote real people's public posts with their handle and a link back to the original — we verify the quote is accurate and never infer or publish anyone's private contact details. If you're quoted in a report and want it removed, email privacy@wantborn.com.

8. International transfers & security

Your data may be processed in countries other than your own, including the US (Resend, Anthropic/OpenAI) and the EU (OVH, Plausible). Where required, we rely on appropriate safeguards (such as standard contractual clauses) for transfers out of the EU/UK. We apply reasonable technical and organizational measures, including signed, expiring URLs for any shared documents.

9. Children

WantBorn is not directed at children under [AGE MINIMUM: 18 — DEFAULT], and we do not knowingly collect personal data from anyone younger.

10. Changes & contact

We may update this policy; material changes will be posted here with an updated date. Questions? Email privacy@wantborn.com (default privacy address — [PRIVACY EMAIL — CONFIRM INBOX IS LIVE]). See also our Terms and FAQ.