1. Data we collect
- Account: email, GitHub username, referral code.
- Payment: invoice ID, amount, transaction hash. We do not store wallet private keys.
- Integrations: API tokens you connect (Cloudflare, Vercel, GitHub) — encrypted at rest in Supabase Vault.
- Usage: domains recovered, jobs run, error logs.
2. How we use data
- To operate the Service (auth, billing, job orchestration).
- To send transactional emails and Telegram alerts.
- To detect abuse and fraud.
- To improve product features (aggregated analytics).
3. Sub-processors
- Supabase (auth, DB, vault) — EU/US
- Vercel (frontend hosting) — global
- Upstash (queues, Redis) — EU/US
- Google Cloud (worker containers) — EU
- Cloudflare (R2 storage) — global
- BillGang (crypto payments) — EU
- GitHub (auto-repo creation) — US
- Sentry (error tracking) — EU
- PostHog (product analytics) — EU
- Resend (email) — US/EU
4. Data retention
We retain account data for the lifetime of your account. Recovered site files live in your GitHub repos — not on our servers. Job logs are retained for 90 days.
5. Your rights (GDPR/CCPA)
You can export or delete your data from Settings. Email privacy@wayforge.org for requests.
6. Security
All tokens are encrypted in Supabase Vault (pgsodium). Row-Level Security isolates every user. HTTPS/TLS everywhere. No secrets in client bundles.