Privacy Policy

1. Introduction

Vacato ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our domain availability monitoring service.

By using Vacato, you consent to the data practices described in this policy. If you do not agree with the practices described here, please do not use our Service.

2. Information We Collect

We collect the following types of information:

2.1 Account Information

• Email address (for authentication and notifications)
• Display name (optional)
• Profile avatar (optional)

2.2 Service Data

• Domain names you choose to track
• Domain monitoring history and status changes
• Notification contact details (email, Telegram ID, Slack webhook URL, Discord webhook URL, custom webhook URLs)
• Notification preferences and settings
• Organization/team membership (for Business and Enterprise plans)

2.3 Usage Data

• Pages visited and features used
• Session duration and frequency of use
• Device information (browser type, operating system)
• IP address (for security and rate limiting)

2.4 Payment Information

Payment processing is handled entirely by Polar.sh. We do not store your credit card numbers, bank account details, or other sensitive financial information on our servers. We only receive limited information from Polar.sh necessary to manage your subscription (e.g., subscription status, plan type, billing cycle).

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Vacato service
• Monitor domains and send availability alerts through your configured channels
• Process and manage your subscription
• Respond to your inquiries and provide customer support
• Send service-related announcements and updates
• Detect, prevent, and address technical issues and security threats
• Analyze usage patterns to improve user experience
• Enforce our Terms of Service and protect our rights

4. Third-Party Services

We use the following third-party services to operate Vacato:

• Supabase: Database hosting, authentication, and serverless functions (SOC 2 Type II compliant)
• Polar.sh: Payment processing and subscription management
• Resend: Transactional email delivery for notifications

Notification Integrations (User-Enabled)

If you choose to enable these notification channels, we will share relevant notification data with:

• Telegram: For bot-based notifications (your Telegram user ID)
• Slack: Via webhook URLs you provide (notification content only)
• Discord: Via webhook URLs you provide (notification content only)
• Custom Webhooks: To any URL you configure (notification payload)

Each of these third-party services has their own privacy policy governing their use of your data. We encourage you to review their policies.

5. Data Storage & Security

Your data is stored securely using Supabase's infrastructure, which provides:

• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• Regular automated backups
• SOC 2 Type II compliance
• Row Level Security (RLS) for data isolation
• Regular security audits and vulnerability assessments

While we implement industry-standard security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your data using commercially reasonable measures.

6. Data Retention

We retain your data as follows:

• Account data: Retained until you delete your account
• Domain monitoring history: Retained for 12 months after domain removal or account deletion
• Usage logs: Retained for 90 days for security and debugging purposes
• Billing records: Retained for 7 years as required by law

When you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required by law to retain it.

7. Data Sharing

We do not sell, rent, or share your personal information with third parties for marketing purposes. We may share data only in the following circumstances:

• Service Providers: With trusted third parties who assist us in operating the Service (as listed in Section 4)
• Legal Requirements: When required by law, legal process, or government request
• Protection of Rights: To protect the rights, property, or safety of Vacato, our users, or others
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with appropriate confidentiality protections
• With Your Consent: When you have explicitly agreed to the disclosure

8. Your Privacy Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your account and associated personal data
• Data Portability: Request export of your data in a machine-readable format
• Restriction: Request limitation of processing in certain circumstances
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent where processing is based on consent

To exercise these rights, please contact us at support@vacato.io. We will respond to your request within 30 days.

9. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. When we transfer data internationally, we implement appropriate safeguards (such as standard contractual clauses) to protect your data.

10. Cookies & Tracking

We use the following types of cookies:

• Essential Cookies: Required for authentication, session management, and security (cannot be disabled)
• Functional Cookies: Remember your preferences (e.g., theme, language)
• Analytics Cookies: Help us understand how users interact with our Service (can be disabled)

We do not use third-party advertising cookies or sell data to advertisers. You can manage your cookie preferences through the cookie consent banner or your browser settings.

11. Children's Privacy

Vacato is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected data from a minor, please contact us immediately at support@vacato.io.

12. GDPR Compliance (EEA Users)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

• Legal Basis: We process your data based on: (a) contract necessity to provide the Service, (b) your consent, (c) our legitimate interests, or (d) legal obligations
• Data Protection Authority: You have the right to lodge a complaint with your local supervisory authority

13. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect and how it's used
• Right to delete your personal information
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to non-discrimination for exercising your rights

14. Beta-Specific Data Practices

During the beta period, the following additional considerations apply:

• Debugging & Diagnostics: We may collect additional diagnostic data (error logs, performance metrics, feature usage patterns) to identify and fix bugs. This data is used solely for improving the Service and is not shared with third parties for marketing purposes.
• Data Migration: As the Service evolves, data structures may change. We may migrate your data to new formats, which could result in temporary inconsistencies or, in rare cases, partial data loss.
• Feature Changes: Features that collect or process data may be modified or removed. If a feature you use is discontinued, we will make reasonable efforts to notify you and provide options for your data.
• Third-Party Integration Data: Notification configurations (Telegram IDs, Slack/Discord webhook URLs, custom webhook endpoints) may need to be reconfigured if integration methods change during the beta period.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will notify you of material changes by:

• Posting the updated policy on this page
• Updating the "Last updated" date at the top
• Sending an email notification for significant changes

Your continued use of the Service after changes become effective constitutes acceptance of the revised Privacy Policy.

16. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

• Email: support@vacato.io