Privacy Policy

Effective Date: October 21, 2026

This Privacy Policy describes how PawlicaWeb Mateusz Pawlica (“we,” “us,” or “our”) collects, uses, and shares personal information when you use SaaS Cubes (saascubes.com, the “Service”). We are committed to protecting your privacy and handling your data transparently.

1. Data Controller

2. Information We Collect

Account Data

When you create an account, we collect your name and email address. You sign in with links we send to that address (magic links); we do not ask for a password. An account that set a password before sign-in moved to email links may still hold its hash (never the password itself), which can no longer be used to sign in.

Listing Data

When you submit a product listing, we collect the product name, URL, short and long descriptions, category, display preferences (color, letter, images), contact email, social media URLs (Facebook, Twitter, GitHub, LinkedIn, Discord), tags, uploaded screenshots, logos, and background images.

Payment Data

Payment processing is handled entirely by Stripe. We do not store your credit card number, CVC, or other payment card details on our servers. We store Stripe customer, checkout, subscription and payment identifiers, payment amounts, currencies and statuses, and the billing name, email, address and tax ID supplied by Stripe for order management and billing records. New purchases use Stripe Managed Payments through Link, which collects the billing information it needs, handles taxes in supported countries, and provides receipts, invoices and payment support. Existing ordinary Stripe subscriptions keep their existing billing arrangement.

Technical Data

When you use the Service, we automatically collect your IP address, user agent (browser and device information), session tokens, and timestamps. This data is stored in our session logs. When you submit a listing or change one, our audit log records what was done, when, from which account, and the IP address the request came from.

Analytics Data

With your consent, we use Google Analytics 4 to collect usage data, including cookie identifiers, browser and device information, pages visited, and interactions. This data is pseudonymous, not necessarily anonymous. Separately, our own listing analytics record a listing ID, event type (view or click), and timestamp for every published listing. Those event records do not include a visitor ID, IP address, or user agent. To count each visitor once a day, we keep a salted hash of their IP address for 24 hours, apart from those records, and we read the user agent only to leave automated traffic uncounted.

Contact Form Data

When you use our contact form, we collect your name, email address, subject, and message content.

AI-Processed Data

When you submit a URL for listing, our system fetches and analyzes the publicly available content of that URL using AI services to generate suggested listing metadata and editorial descriptions. Analysis results are cached and reused for up to 7 days. Public page snapshots are stored separately and scheduled for cleanup after 90 days. Generated content included in a listing is retained with that listing.

3. How We Use Your Information

We use the information we collect to:

• Authenticate your account and manage sessions.
• Display and manage your product listings in the directory.
• Process payments and manage subscriptions via Stripe.
• Send transactional emails (authentication links, listing moderation and status notices, billing notices). We keep a record of each email we send (recipient, subject and delivery status, including whether it was opened or a link in it was clicked, where our email provider reports it) for 180 days.
• Send occasional emails about your listing, such as its statistics, tips, or an offer to upgrade it, and a short upgrade offer inside some transactional emails. Every email has an “Email preferences” link where you can turn these off; doing so never stops the transactional emails.
• Send one email to a listing's contact address with its Good for Bots score when the listing first goes live (or a live listing moves to a new website address), including how to show the Good for Bots badge on your own site.
• Analyze submitted URLs using AI to generate listing suggestions.
• Count views and outbound clicks for every published listing, and show them to owners of paid plan listings.
• Respond to contact form inquiries.
• Monitor and improve the security and performance of the Service.
• Maintain audit logs for security and compliance purposes.

4. Legal Bases for Processing

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data based on the following legal grounds:

• Contract performance: Processing necessary to provide the Service (account management, listing display, payment processing).
• Consent: Analytics cookies and tracking are only activated after you give explicit consent through our cookie banner.
• Legal obligations: Keeping records required by tax and accounting law and responding to legally required requests.
• Legitimate interest: Security monitoring, fraud prevention, audit logging, Service improvement, the one-time email telling a listing's owner its Good for Bots score, and the occasional emails about your listing described above. You can turn those emails off at any time from the “Email preferences” link at the bottom of every email, or by contacting us. If an email to you bounces permanently or is reported as spam, we stop sending you these optional emails.

5. Third-Party Services

We use the following third-party services. Their roles depend on the service: some process data on our behalf, while Stripe / Link also acts as an independent controller for its payment, fraud prevention, tax, legal compliance, and buyer services.

Stripe / Link determines the purposes and means of its own processing separately from SaaS Cubes. Its handling of personal data, retention, international transfers and privacy rights is described in the Link Privacy Policy and the Stripe Privacy Policy. Our handling of the order information we receive is covered by this policy.

Some pages display third-party directory badges loaded from their providers, and listing pages may display a Good for Bots badge loaded from goodforbots.com. Loading those images sends ordinary request information, including your IP address, browser headers and the address of the page you are viewing, to those providers. Good for Bots counts badge views and notes which websites show a badge.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

6. Cookies and Tracking Technologies

Essential Cookies

We use session cookies to authenticate your account and maintain your login session. These cookies are strictly necessary for the Service to function and do not require consent.

Analytics Cookies

We use Google Analytics 4 cookies (such as “_ga” and “_ga_*”) to understand how visitors interact with the Service. These cookies are only set after you explicitly accept cookies through our cookie consent banner. By default, all analytics tracking is disabled until consent is given. Google Analytics is not loaded before you accept. Accepting analytics does not grant consent to advertising storage, advertising data use, or ad personalization.

Local Storage

We store your cookie consent preference (“granted” or “denied”) in your browser's local storage under the key “cookie-consent” so we do not ask you again on every visit.

You can change or withdraw analytics consent using “Cookie settings” in the footer. You can also manage cookies through your browser settings. Disabling essential cookies may prevent the Service from functioning properly.

Links to Listed Products

When you follow a link from SaaS Cubes to a listed product, the link carries parameters such as “utm_source=saascubes.com” and the part of our site it was on (for example, the listing page or the homepage grid), so the product's analytics can tell the visit came from us. They are the same for every visitor and contain nothing that identifies you. Your browser also tells that site our domain, never the page you were on. Once you leave SaaS Cubes, what the product's site collects is governed by its own privacy policy.

7. Data Retention

We retain your personal data for as long as necessary to provide the Service and fulfill the purposes described in this policy:

• Account data: Retained until you request account deletion.
• Listing data: Retained while your listing or draft is maintained. Deleted listings are soft-deleted (hidden from the directory but retained in our database for record keeping).
• Payment records: Retained as required by applicable tax and accounting laws.
• Session data: Retained for authentication and session security. Session expiration prevents further use of a login token; it does not necessarily immediately erase the underlying database record.
• URL analysis cache: Results are reused for up to 7 days and deleted within an hour after that.
• Public page snapshots: Scheduled for cleanup after 90 days.
• Audit logs: A record of actions on listings and in our administration panel (what was done, when, by which account, and the IP address it came from), kept for security, investigation and record keeping. IP addresses are removed from entries after 90 days, and entries are deleted after 12 months. You may request earlier erasure, subject to applicable legal exceptions.
• Analytics events: Listing-level view and click events are stored individually without visitor identifiers and displayed as aggregate statistics. After about six months they are combined into daily totals per listing, which are kept while the listing exists.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data, subject to legal retention requirements.
• Restriction: Request that we limit the processing of your data in certain circumstances.
• Data portability: Request a machine-readable copy of your data.
• Objection: Object to processing based on legitimate interest.
• Withdraw consent: Withdraw your consent for analytics at any time using “Cookie settings” in the footer. Withdrawal does not affect processing lawfully carried out before withdrawal.

To exercise any of these rights, please contact us at hello@saascubes.com. We will respond without undue delay and normally within one month. If an extension is permitted because of the complexity or number of requests, we will explain the reason within that first month.

You may lodge a complaint with your competent data protection supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO).

9. International Data Transfers

Your data may be processed in countries outside of your country of residence, including the United States and the European Union, through our third-party service providers (Stripe, Google, Cloudflare, Browserless, Resend). These providers maintain appropriate safeguards for international data transfers in compliance with applicable data protection laws.

10. Data Security

We implement reasonable technical and organizational measures to protect your personal data, including:

• HTTPS encryption for connections to our public website and API.
• Secure, httpOnly session cookies with SameSite protection.
• Rate limiting to prevent abuse.
• Webhook signature verification for payment processing.
• Input validation for submitted data.

While we strive to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

11. Children's Privacy

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe that we have collected data from a child under 16, please contact us immediately and we will take steps to delete such information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. Changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically. This policy is a notice about our processing; continued use does not itself constitute consent to new processing that requires your consent.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at: