1. Who we are
SaaSlick (saaslick.com) is operated by Rorocode (rorocode.com), based in Dhaka, Bangladesh ("SaaSlick", "we", "us"). We are the data controller for the personal data described here. Privacy questions or requests: privacy@saaslick.com.
2. What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address and sign-in ID from Google or GitHub | Create and secure your account, contact you about it | Contract |
| Public profile: name, username, photo, bio, X handle, portfolio link | Your public builder card | Contract |
| Products, logos, links, journey updates, discussions, replies, upvotes, follows | Run the directory, Live Cooking feed and community | Contract |
| Payment records: order ID, amount, status (via Polar) | Deliver paid placements, refunds, accounting | Contract; legal obligation (tax) |
| Anonymous usage events: which product/placement was viewed or clicked, the day, and a daily-rotating visitor hash | Show builders their page views and show advertisers honest impressions and clicks; prevent click fraud | Legitimate interest |
| Reports you file and moderation notes | Keep SaaSlick safe | Legitimate interest |
| Short-lived rate-limit counters and server logs | Stop spam and abuse, debug problems | Legitimate interest |
We never collect or see your card details. Payments are handled entirely by our merchant of record, Polar.
How our analytics work (no IPs stored)
When a page is viewed or a placement is seen or clicked, we compute a one-way hash of your IP address and browser user-agent combined with a secret that changes every day. Only that hash is stored — never your IP. Because the secret rotates daily, the hash can't be used to follow you from one day to the next or be reversed to identify you. We drop known bots before counting.
3. What is public
Anything you add to your profile, products, journey updates, discussions and replies is visible to everyone, including search engines, and may be shared on social media by others. Follower and upvote counts are public, and your follower/following lists are visible on your profile. Metrics you post in updates are labeled "Founder-reported". Don't post anything you want kept private.
4. Listings added by our team
To help new builders get discovered, our team may list a product using information its builder has already made public (for example on their website or X profile). These profiles are marked as added by SaaSlick. If it's yours, you can claim it, edit it or ask us to remove it — use Report → "This is my product" or email privacy@saaslick.com. We remove listings within 7 days of a request.
5. Cookies
We only use strictly necessary cookies: the Supabase session cookie that keeps you signed in. No advertising cookies, no third-party analytics cookies, no cross-site tracking. That's why there's no cookie banner.
6. Who we share data with
We share data only with service providers that process it on our behalf under data-processing agreements:
- Supabase — database, authentication and file storage
- Vercel — hosting and content delivery
- Polar (merchant of record) — checkout, payment processing, invoices, taxes and refunds
- Upstash — rate limiting
- Google and GitHub — only if you choose them to sign in
We may disclose data if required by law or to protect SaaSlick and its users from fraud or abuse. We do not sell or rent personal data, and we don't share it for advertising.
7. International transfers
Our providers may process data outside your country (including the United States and the EU). Where required, transfers are protected by standard contractual clauses or equivalent safeguards offered by those providers.
8. How long we keep data
- Account, profile and content: until you delete them or your account.
- Raw view/click events: 13 months, then deleted automatically (aggregated counts may be kept).
- Notifications: 90 days.
- Reports and moderation notes: up to 2 years after resolution.
- Admin audit log: 2 years.
- Payment records: 7 years for tax and accounting — kept even after account deletion, but unlinked from your profile.
9. Your rights
Depending on where you live (including under GDPR/UK GDPR and California law), you have the right to:
- Access & portability — download all your data from Dashboard → Profile → Export my data.
- Correction — edit your profile and content anytime.
- Deletion — delete your account from Dashboard → Profile. This permanently removes your profile, products, updates, discussions and follows.
- Objection / restriction — ask us to stop a specific processing, e.g. remove a listing we added.
- Complaint — contact your local data protection authority.
For anything you can't do yourself, email privacy@saaslick.com. We reply within 30 days. We don't discriminate against anyone for exercising their rights.
10. Security
We use row-level security on every database table, OAuth sign-in (no passwords stored), HTTPS everywhere, strict upload checks, rate limiting and an audit log of every admin action. No system is perfectly secure; if a breach affects your personal data we'll notify you and, where required, the authorities within 72 hours.
11. Children
SaaSlick is not for anyone under 16. If we learn an account belongs to someone under 16, we delete it.
12. Changes
If we change this policy in a meaningful way, we'll update the date above and let signed-in users know in the app before the change takes effect.
13. Contact
Rorocode · Dhaka, Bangladesh · privacy@saaslick.com · Founder: @mafuzurrahman01