Privacy Policy
Last updated: 2026-10-06
Who is responsible for your data
The data controller is Mirko Salvalaggio. For anything in this policy, including the requests described below, write to founder@framejet.dev.
What we collect, why, and on what basis
| Data | Why | Lawful basis |
|---|---|---|
| Your email address | It is your account — we have no passwords. Used to send verification links and to attach your plan. | Performance of a contract (Art. 6(1)(b)) |
| A hash of your API key, plan and monthly usage count | To authenticate your calls and enforce your quota. | Performance of a contract (Art. 6(1)(b)) |
| Request logs: the URL you asked us to capture, timestamp, result, render time | To debug failures, detect abuse, and keep the service standing up. | Legitimate interest (Art. 6(1)(f)) — running a reliable service |
| Rendered screenshots | Cached so repeat captures are fast and don't re-spend your quota. | Performance of a contract (Art. 6(1)(b)) |
| A billing customer ID from Lemon Squeezy | To match your payment to your account. | Performance of a contract (Art. 6(1)(b)) |
| Account activation milestones and first-touch campaign/referrer information | To understand which product pages and campaigns lead to a verified key, a first successful capture, or a paid plan. We do not create an anonymous advertising profile. | Legitimate interest (Art. 6(1)(f)) — improving the service and measuring our own acquisition |
We do not ask for your name, address or phone number. We run no advertising trackers, and analytics cookies are set only if you accept them (see below). We never sell data, and we make no automated decisions with legal effects about you.
Payment details never reach us. Lemon Squeezy acts as Merchant of Record: they take the card, issue the invoice and handle tax. Their own privacy policy governs that data.
Cookies and analytics
The website uses Google Analytics 4 to count visits and see which pages are used. It is off until you click “Accept” on the banner: before that, no Google script is loaded and no request reaches Google. If you accept, Google sets the _ga and _ga_<id> cookies (up to 2 years) and receives the pages you view, an approximate location, and device and browser details. Advertising features are off.
Separately, Vercel Web Analytics counts page views without cookies or any identifier stored in your browser. It records the page, the referring site, country, device and browser type; visitors are distinguished only by a hash that is discarded every 24 hours, so no one can be recognised across days. Lawful basis: our legitimate interest in knowing which pages are used (Art. 6(1)(f) GDPR).
Lawful basis: your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code). You can withdraw it at any time with “Cookie settings” in the footer, which deletes the cookies. We remember your choice in your browser's local storage under fj-consent — that is strictly necessary and holds only the word “granted” or “denied”. The API itself sets no cookies.
We also keep a first-touch record in your browser's local storage underfj-attribution for up to 30 days. It contains only campaign parameters, the landing-page path and an external referrer, when present. It is sent to us only when you request and verify an API key; it contains no cross-site identifier and is not shared with an advertising network.
How long we keep it
- Account data — Until you ask us to delete it, or 12 months after your last API call.
- Request logs — 30 days, deleted automatically by a daily job.
- Cached screenshots — 7 days, deleted automatically by a daily job.
- Activation and acquisition milestones — 13 months, then deleted automatically.
Who else processes it, and where
| Provider | Role | Where the data sits |
|---|---|---|
| Vercel Inc. (USA) | Hosting, screenshot rendering, and the screenshot cache | United States (us-east-1 / iad1) |
| Supabase | Database — your email, API key hash and plan | European Union (eu-central-1, Frankfurt) |
| Resend (Resend Inc., USA) | Transactional email — delivering verification links | European Union (eu-west-1, Ireland) |
| Lemon Squeezy (USA) | Merchant of Record — takes the payment and issues the invoice | United States |
| Google Ireland Ltd. (Google Analytics) | Website analytics — only after you accept analytics cookies | European Union and United States (EU-US Data Privacy Framework) |
| ImprovMX | Forwards email sent to our domain to our own mailbox | European Union |
Transfers outside the EU
Your account data sits in the European Union. Some things do not: screenshot rendering and the screenshot cache run on Vercel in the United States, payments are handled by Lemon Squeezy in the United States, and — only if you accept analytics cookies — Google may process analytics data in the United States (Google LLC is certified under the EU-US Data Privacy Framework). These transfers rely on the safeguards in those providers' data processing agreements, including the European Commission's Standard Contractual Clauses.
Your rights
Under the GDPR you can ask us to:
- give you a copy of the data we hold about you (access);
- correct anything wrong (rectification);
- delete your account and its data (erasure);
- restrict or object to processing based on legitimate interest;
- hand your data over in a portable format.
Write to founder@framejet.dev and we'll act within one month. There is no charge.
If you think we've handled your data badly, you can complain to your national data protection authority — in Italy, the Garante per la protezione dei dati personali.
When you capture someone else's website
A screenshot can contain personal data belonging to people who are not our customers. For those captures you are the controller and we act as your processor: we render what you ask for, cache it for 7 days, and do nothing else with it. You are responsible for having a lawful basis for the capture. If you need a data processing agreement in place with us, ask at founder@framejet.dev.
Security
Traffic is encrypted in transit. Database tables are locked down and reachable only through narrowly-scoped functions. API keys are shown once and can be replaced by you at any time from the home page — if you think a key has leaked, replace it immediately.
Changes
If we change this policy we'll update the date at the top. Material changes affecting existing customers will be emailed.