Privacy Policy

Last updated: May 22, 2026

This Privacy Policy explains how Pixelpal B.V. ("Pixelpal", "we", "us"), the controller of your personal data, collects, uses, and shares information when you use Launchlane (the "Service"). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Dutch UAVG.

1. Information we collect

• Account information. When you sign in with Google, we receive your name, email address, and profile image.
• Workspace and integration data. When you connect Linear, GitHub, or similar tools, we access issues, pull requests, metadata, and the OAuth tokens needed to read that data. Tokens are encrypted at rest.
• Content you generate. Changelogs, drafts, comments, and settings you create in the Service.
• Usage data. Pages visited, features used, device and browser type, IP address, approximate location derived from IP, and session replays (recordings of how you interact with the product, with passwords masked).
• Communications. Messages you send us by email.

2. Legal bases for processing (GDPR Art. 6)

• Performance of a contract — to provide the Service to you (account, integrations, changelog generation, billing).
• Legitimate interests — to secure the Service, prevent abuse, debug issues, and improve features. We balance these interests against your rights.
• Consent — for optional marketing communications. You can withdraw consent at any time.
• Legal obligation — to comply with bookkeeping, tax, and other laws.

3. How we use information

• To provide and operate the Service.
• To generate changelogs and AI-assisted summaries.
• To communicate with you about your account, security, and updates.
• To detect, prevent, and address fraud or abuse.
• To improve and develop new features.
• To comply with legal obligations.

4. Sub-processors

We rely on the following sub-processors to operate the Service. Each is bound by a data processing agreement and processes data only on our instructions:

• Vercel Inc. (USA / EU regions) — hosting and serverless compute.
• Neon, Inc. (EU region) — managed Postgres database.
• Anthropic, PBC (USA) — large language model for AI-generated content. We do not allow Anthropic to train models on your data.
• PostHog Inc. (EU region) — product analytics and session replay.
• Google LLC (USA) — sign-in (OAuth).
• Linear, Inc. / GitHub, Inc. — only when you connect these integrations.

We may update this list as our infrastructure evolves. Material changes will be reflected here.

5. International transfers

Some sub-processors are based outside the European Economic Area. Where data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses and apply supplementary measures (such as encryption in transit and at rest) where appropriate.

6. How we share information

We do not sell your personal data. We share information only:

• With the sub-processors listed above.
• To comply with the law or respond to lawful requests.
• In connection with a merger, acquisition, or sale of assets, with notice to you.
• With your consent or at your direction.

7. AI processing

We use large language models to generate changelog content from your connected data. We do not allow our AI providers to train their models on your data. AI output may contain errors — please review before publishing.

8. Cookies and analytics

We use the following categories of cookies and similar tech:

• Strictly necessary — session and authentication cookies. These are required for the Service to function.
• Analytics and session replay — PostHog cookies that help us understand product usage and improve Launchlane. We rely on legitimate interests (GDPR Art. 6(1)(f)) for this processing. Passwords are masked in recordings; we do not knowingly capture sensitive personal data. To opt out, email us at the address below and we will exclude your account from analytics and recordings.

9. Data retention

• Account data — kept while your account is active and for up to 90 days after deletion (to allow recovery), then erased.
• Integration tokens — kept while the integration is connected; deleted on disconnection.
• Analytics data — kept for up to 12 months.
• Billing and tax records — kept for 7 years to comply with Dutch tax law.
• Backups — overwritten within 30 days.

10. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased (where one of the GDPR grounds applies).
• Restrict or object to processing.
• Receive your data in a portable format.
• Withdraw consent at any time, without affecting prior processing.
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the supervisory authority in your country of residence.

To exercise these rights, email us at the address below. We will respond within one month.

11. Security

We use industry-standard safeguards including encryption in transit (TLS) and at rest for sensitive fields (such as integration tokens), access controls, and routine patching. No system is completely secure. If we discover a data breach affecting you, we will notify you and the relevant supervisory authority within 72 hours where required.

12. Children

Launchlane is not directed to children under 16. We do not knowingly collect data from children. If you believe a child has provided data, contact us and we will delete it.

13. Changes

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or in-product before they take effect.

14. Contact

For privacy questions or to exercise your rights, email hi@franklagendijk.com or write to us at: