Privacy Policy

Cottage Launchpad LLC ("we," "us," or "our") operates the Cottage Launchpad website and platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

By creating an account, you consent to the collection and processing of your personal data as described in this policy. If you do not agree with the practices described in this Privacy Policy, please do not use our Services.

1. Information We Collect

Information You Provide

When you create an account, use our tools, or contact us, we may collect:

• Name and email address
• State of residence
• Business information (business name, product categories, experience level)
• Payment information (processed securely through Stripe — we do not store your full card number)
• Content you submit through our AI Compliance Copilot, Label Builder, or other tools
• Communications you send to us (support requests, feedback)

Information Collected Automatically

When you access our platform, we automatically collect certain technical and usage information:

• Device type, browser type, and operating system
• IP address and approximate geographic location
• Pages visited, features used, and time spent on pages
• Referring URL and search terms that led you to our site

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve our platform and services
• Generate personalized compliance roadmaps, startup kits, and labels for your state
• Process payments and manage your subscription
• Send you regulatory updates, newsletters, and service announcements (you can opt out at any time)
• Respond to your support requests and inquiries
• Analyze usage patterns to improve user experience
• Detect and prevent fraud or abuse

3. Third-Party Services

We use the following third-party services to operate our platform. Each processes data according to their own privacy policies:

• Stripe — Payment processing. Stripe collects and processes your payment information directly. See Stripe's Privacy Policy.
• Anthropic (Claude) and OpenAI — AI-powered compliance tools. Prompts you submit to our AI features may be sent to these providers for processing. We do not share your personal account information with them.
• PostHog and Plausible — Product analytics. PostHog helps us understand how users interact with our platform. Plausible provides privacy-friendly, cookieless website analytics.
• Resend and ConvertKit — Email delivery. Used to send transactional emails (account confirmations, password resets) and marketing emails (newsletters, regulatory alerts).
• Railway and Cloudflare R2 - Hosting, managed Postgres, and object storage. Our application services run on Railway and file-backed assets and backups use Cloudflare R2.

Data Processing Agreements

We maintain Data Processing Agreements (DPAs) with our key service providers including Stripe, OpenAI, Anthropic, Railway, and Cloudflare. These agreements ensure that our service providers process your data in accordance with applicable data protection laws and maintain appropriate security measures.

International Data Transfers

Your data may be transferred to and processed in the United States. By using our service, you consent to this transfer. For users located in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission for EU data transfers where applicable. We ensure that any international transfer of personal data is subject to appropriate safeguards as required by applicable data protection law.

4. Data Storage and Security

Your data is stored in a PostgreSQL database hosted on secure cloud infrastructure. We implement industry-standard security measures including encryption in transit (TLS/SSL), secure authentication, and access controls. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

5. Cookies and Tracking

We use cookies and similar technologies to maintain your session, remember your preferences, and analyze site usage. Specifically:

• Essential cookies — Required for authentication and core platform functionality.
• Analytics cookies — Used by PostHog to understand feature usage and improve our product. You can opt out through your browser settings or our cookie preferences.
• Plausible — Does not use cookies. Collects anonymous, aggregated analytics only.

6. Data Sharing

We do not sell your personal information. We may share your information only in the following circumstances:

• With service providers listed in Section 3, solely to operate our platform
• If required by law, regulation, or legal process
• To protect the rights, safety, or property of Cottage Launchpad, our users, or the public
• In connection with a merger, acquisition, or sale of assets (you would be notified)

7. Data Retention

We retain different types of data for different periods based on the nature of the data and our legal obligations:

• Account data (name, email, profile information) — Retained for the duration of your active account plus 30 days after account deletion to allow for account recovery
• Financial records (payment history, invoices, subscription records) — Retained for 7 years after the transaction date, as required by tax and legal obligations
• AI conversation logs (Compliance Copilot queries, Label Builder sessions, Business Plan Generator interactions) — Retained for 90 days, then automatically purged
• Analytics data (page views, feature usage, session data) — Retained for 26 months in identifiable form, then aggregated and anonymized
• Support communications — Retained for 3 years after resolution for quality assurance and legal purposes

Anonymous, aggregated analytics data may be retained indefinitely. Upon account deletion, all personally identifiable data will be removed within 30 days, except where retention is required by law as specified above.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing of your data
• Request a portable copy of your data
• Opt out of marketing communications at any time

To exercise any of these rights, contact us at [email protected].

9. Children's Privacy

Cottage Launchpad is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a minor, please contact us immediately so we can delete it.

10. California Residents

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information, including the right to know what data we collect, the right to delete your data, and the right to opt out of the sale of your data. As noted above, we do not sell personal information. To exercise your CCPA rights, contact us at the email address below.

11. Security Incident Response

In the event of a data breach affecting your personal information, we will notify affected users within 72 hours of becoming aware of the breach, in accordance with applicable data breach notification laws. We will also notify relevant supervisory authorities as required by law. Notifications will include:

• A description of the nature of the breach
• The categories and approximate number of individuals affected
• The likely consequences of the breach
• The measures taken or proposed to address the breach and mitigate its effects
• Contact information for our data protection point of contact

12. Automated Decision-Making

Our AI features — including the Compliance Copilot, Label Check, Business Plan Generator, nutrition estimator, and pricing calculators — use automated processing to provide recommendations and generate content. These outputs are advisory only and do not constitute legally binding decisions, legal advice, or guaranteed compliance determinations. You are responsible for independently verifying all AI-generated outputs before relying on them for business or legal decisions.

You may request human review of any AI-generated output by contacting [email protected]. We do not use automated processing to make decisions that produce legal effects or similarly significantly affect you without human oversight.

13. Analytics Opt-Out

You may opt out of analytics tracking through any of the following methods:

• Enable the "Do Not Track" (DNT) setting in your browser — we honor DNT signals
• Adjust your cookie preferences through our cookie settings panel
• Contact us at [email protected] to request a permanent opt-out

Note that Plausible Analytics does not use cookies and collects only anonymous, aggregated data by default. Opting out of analytics will not affect the functionality of the platform. Essential cookies required for authentication and core functionality cannot be disabled.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the effective date. For significant changes, we may also notify you by email.

15. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Cottage Launchpad
Email: [email protected]