Privacy Policy

1. Information We Collect

LayoffSignal collects the following categories of personal data:

• Account data: email address, hashed password (managed by Supabase Auth)
• Subscription data: tier, tracked companies, target roles, target locations, competitor watchlists
• Integration data: webhook URLs (Slack, Teams, custom), API keys
• Payment data: Stripe customer ID and subscription ID. Card details are stored by Stripe and never by LayoffSignal.
• Usage data: votes, flags, alert history, saved searches

2. How We Use Your Information

• Provide and operate the LayoffSignal service
• Process payments via Stripe
• Send alert notifications (email, webhooks)
• Improve service quality

3. Legal Basis for Processing (GDPR)

LayoffSignal is designed with GDPR principles in mind, including data minimization, purpose limitation, and user rights.

• Contractual necessity: processing needed to deliver the service you signed up for
• Legitimate interest: service improvement and security
• Consent: email communications beyond transactional messages

4. Data Sharing & Sub-Processors

We share data with the following sub-processors to operate the service:

• Supabase (database hosting, authentication) — supabase.com
• Stripe (payment processing) — stripe.com
• Netlify (website hosting) — netlify.com

No data is sold to third parties.

5. Cookies

• We use functional cookies only (session management, preferences)
• No advertising or tracking cookies are used
• Cookie consent preference is stored locally in your browser

6. Your Rights (EU/EEA Residents)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access — view your data in Settings or via the data export feature
• Right to rectification — update your settings at any time
• Right to erasure — delete your account in Settings
• Right to data portability — export your data as JSON from Settings
• Right to restrict processing — contact us at the email below
• Right to object — contact us at the email below
• Right to withdraw consent — unsubscribe from emails at any time
• Right to lodge a complaint with your local Data Protection Authority

7. Data Retention

• Active accounts: data is retained while your account is active
• Deleted accounts: all personal data is deleted immediately upon account deletion
• Payment records: retained as required by financial regulations (typically 7 years), managed by Stripe

8. Data Security

• Row Level Security (RLS) ensures users can only access their own data
• All data is transmitted over HTTPS/TLS
• Passwords are hashed and never stored in plaintext
• API keys are generated securely

9. Children's Privacy

LayoffSignal is not directed at children under 16. We do not knowingly collect personal data from children under 16.

10. Changes to This Policy

We will update the “Last updated” date at the top of this page when changes are made. Material changes will be communicated via email to registered users.

11. Contact

For questions about this Privacy Policy, contact us at support@layoffsignal.dev.

For GDPR-specific inquiries, email the same address with the subject line “GDPR Request”.