Privacy Policy

The controller responsible for processing described in this policy is Denvo LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States. For all privacy requests, including requests from users in the European Economic Area, the United Kingdom, or Switzerland, contact: privacy@supaclone.io.

Account data: when you sign in with GitHub (the only supported sign-in method), we receive and store your GitHub user id, email address, name, and avatar URL, together with organization membership, role, settings, and authentication session metadata managed through Supabase Auth.

Integration data: to connect your Supabase projects, we store Supabase OAuth connection metadata, project references, project names, and clone configuration. If you provide a database password or connection string, we store the resulting connection string encrypted with AES-256-GCM before it is written to the database, and your Supabase OAuth access and refresh tokens are encrypted the same way. These credentials are used only to run the clone workflows you request.

Clone data: job status, run history, worker metadata, progress events, warnings, verification reports, selected schema metadata, and operational logs needed to complete and debug clone runs. Where a clone touches personal data inside your own project, we process it on your behalf as described in our Data Processing Addendum.

Billing data: Stripe customer identifiers, subscription status, billing plan, price, presentment currency, checkout metadata, invoices, and payment lifecycle events. Full payment details (such as card numbers) are collected and processed by Stripe, not by us.

Technical data: our hosting provider records server logs including IP address, request headers, and timestamps for security and operations. Our error-tracking provider receives error reports as described in section 5.

Location-derived country: our hosting provider derives a two-letter country code from your IP address. We use it transiently to decide which prices, currency, and payment methods to show you (regional pricing), and we store the country of your first and most recent authenticated visit with your account for regional pricing and product analytics. The IP address itself is never stored for this purpose. The legal basis is our legitimate interest in offering regionally appropriate pricing and understanding where our users are located (Art. 6(1)(f) GDPR) and, for the price shown at checkout, the performance of the contract (Art. 6(1)(b) GDPR).

Support data: if you contact us, we process the content of your message and your contact details to answer your request.

Sign-in provider feedback: our sign-in page asks whether you use GitLab or Bitbucket instead of GitHub. If you answer, we store the provider you selected together with the same pseudonymous, daily-rotating identifier, country, and device type described in section 5. Providing an email address in that step is entirely optional; if you do, we store it solely to notify you once when the provider you asked for becomes available.

Performance of a contract (Art. 6(1)(b) GDPR): creating and managing your account, connecting Supabase projects, queuing and running clone jobs, generating reports, enforcing plan limits, providing support, and processing subscriptions and payments.

Legitimate interests (Art. 6(1)(f) GDPR): securing the service, preventing abuse and fraud, monitoring errors and availability through Sentry, keeping operational logs, collecting aggregated, cookieless usage statistics for our public web pages, recording how the application itself is used by signed-in customers, measuring which campaigns lead to sign-ups, learning which sign-in providers our visitors need, and defending legal claims. Our interest is running a reliable, secure service and understanding how our pages and our product are used; you may object as described in section 10.

Consent (Art. 6(1)(a) GDPR): if you voluntarily leave an email address in the sign-in provider question described in section 2, we use it on the basis of your consent to send you a single notification when that provider becomes available. You can withdraw your consent at any time with effect for the future by writing to privacy@supaclone.io. Apart from that, we do not process personal data based on consent and do not use any consent-based analytics services or non-essential cookies.

Legal obligations (Art. 6(1)(c) GDPR): retaining billing and tax records and responding to lawful requests from authorities.

Strictly necessary cookies are set without consent because the service cannot work without them: Supabase authentication session cookies that keep you signed in, and short-lived OAuth security cookies (state and PKCE verifier, maximum age 10 minutes) used while connecting your Supabase account. These store no tracking profiles.

We do not set any analytics or tracking cookies. Usage statistics for our public pages are collected without cookies, local storage, or any other persistent identifier stored on your device (see section 5). The product usage records described in section 5 are linked to your account through the sign-in session you already have; no additional cookie or identifier is placed on your device for that purpose.

If you answer the sign-in provider question on our sign-in page, your browser stores a single local storage entry recording that you already answered, so we do not ask again. It contains only the selected provider, no identifier, and is never sent to any third party. You can remove it at any time through your browser's site data settings.

First-party usage statistics: we collect page-view statistics for our public web pages using our own infrastructure (the SupaClone application database). No cookies or persistent identifiers are used and no data is shared with third-party analytics providers. Your IP address and browser user agent are processed transiently to compute a pseudonymous identifier that rotates daily and cannot be linked back to you or across days; the IP address and user agent themselves are not stored. Stored data is limited to the page visited, the referring website, country, device type (mobile or desktop), and time of the visit. Legal basis: legitimate interest in understanding how our public pages are used (Art. 6(1)(f) GDPR). If you reach our site through a campaign link, the campaign tags contained in that link (utm_source, utm_medium, utm_campaign, utm_content) are stored alongside the visit; no other part of the web address is stored.

Product usage inside your account: once you are signed in, we record which pages of the application you open and which steps of the cloning process you reach (for example: opening the clone form, verifying a database connection, seeing a plan selection screen, starting a clone). These records are linked to your user account and organisation, and are used to find where the product is confusing or failing. We do not record keystrokes, screen contents, database credentials, connection details, or any content of your databases. If you arrived through a campaign link, the campaign tags are stored once on your organisation so we can tell which channels lead to sign-ups. Legal basis: legitimate interest in improving our service and measuring our own advertising (Art. 6(1)(f) GDPR). These records are deleted after 12 months, and immediately if you delete your account.

Sentry (Functional Software, Inc.): we use Sentry to collect error and crash reports so we can detect and fix failures. Error reports can include IP address, browser and device information, request metadata, and a pseudonymous user identifier. Legal basis: legitimate interest in operating a reliable service (Art. 6(1)(f) GDPR). Data is hosted in European Union (EU).

We share personal data with service providers only as needed to operate SupaClone, under contracts that restrict how they may use it. The current service-provider list is:

We do not sell personal data and do not share it with third parties for their own advertising. We may disclose data where required by law, to enforce our terms, or as part of a merger or acquisition, in which case this policy continues to apply.

Denvo LLC is located in the United States, so personal data of EU/EEA, UK, and Swiss users is transferred to and processed in the United States and other countries where our providers operate.

Where a provider is certified under the EU-U.S. Data Privacy Framework (including the UK Extension and the Swiss-U.S. DPF), such as Stripe, GitHub, and Google, transfers rely on that adequacy decision. For other transfers we rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) with supplementary measures such as encryption in transit and at rest. You can request a copy of the applicable safeguards via privacy@supaclone.io.

We protect personal data with HTTPS/TLS in transit, server-side authorization checks, Supabase row level security, service-role access only in trusted server contexts, and AES-256-GCM encryption for stored integration secrets such as OAuth tokens and database connection strings. Database connections to your projects use TLS certificate verification by default.

No service can guarantee perfect security. You should use least-privilege Supabase access, keep your accounts secure, and review clone targets before production use.

We keep account, project, billing, and clone job data while your account is active and as long as needed to provide the service, enforce billing, debug failures, and comply with legal obligations. Operational and error logs are retained only for as long as needed for security monitoring and debugging and are then deleted or anonymized. Sign-in provider feedback, including any email address you left there, is deleted automatically after 24 months at the latest, or earlier on request.

Organization owners can delete the account from settings. Deletion cancels in-flight clone jobs, deletes the related Stripe customer where present, deletes the organization and its records (including encrypted project credentials and connected project data), and deletes the authenticated user. Stripe may retain invoices and payment records where legally required for accounting and tax purposes, and we retain billing records for the statutory retention periods.

If the GDPR applies to you, you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and the right to object to processing based on legitimate interests (Art. 21). Where processing is based on consent, you may withdraw it at any time with effect for the future.

To exercise these rights, contact privacy@supaclone.io. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, workplace, or the place of the alleged infringement.

When SupaClone processes personal data contained in your own connected projects on your behalf, we act as processor and you are responsible for handling requests from your own end users; we will assist as described in the Data Processing Addendum.

Depending on your state of residence (for example under the California Consumer Privacy Act), you may have rights to know, access, correct, and delete personal information, and to opt out of the sale or sharing of personal information. We do not sell personal information and do not share it for cross-context behavioral advertising. To exercise these rights, contact privacy@supaclone.io. We will not discriminate against you for exercising them.

SupaClone is a developer tool intended for business and professional use and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy as the service, our providers, or legal requirements change. We will post the updated version on this page with a new "Last updated" date and, for material changes, notify you in the application or by email where appropriate.

For privacy requests and questions about this policy, contact: privacy@supaclone.io. Postal address: Denvo LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States.