Privacy Policy

Last updated: May 2026

Would I Buy? (“we”, “us”, “our”) is committed to protecting your personal data. This policy explains what we collect, why we collect it, and how you can exercise your rights.

1. What we collect

We collect only what is necessary to provide the service:

  • Account data: email address, display name (if provided via OAuth), and authentication tokens issued by our identity provider.
  • Analysis data: URLs you submit, the generated reports (scores, narrative, annotated screenshots), and associated metadata such as creation date.
  • Payment data: billing is handled by Stripe. We store your Stripe customer ID and subscription status only — we never see or store card numbers or bank details.
  • Usage analytics: page views and feature interactions, collected via Google Analytics 4. This data is anonymised and aggregated. It is only collected after you have given cookie consent.
  • Technical data: server logs (IP address, browser type, referring URL) retained for up to 30 days for security and debugging purposes.

2. How we use your data

  • To generate, store, and deliver analysis reports to your account.
  • To manage your account, billing, and subscription status.
  • To send transactional emails (report delivery, password resets, billing receipts).
  • To enforce fair-use quotas and protect against abuse.
  • To improve the product based on aggregate, anonymised usage patterns.

We do not sell your data. We do not use your data for advertising.

3. Cookies

We use two categories of cookies:

  • Strictly necessary: authentication session cookies set by our identity provider. These are required for you to sign in and cannot be disabled.
  • Analytics (optional): Google Analytics 4 cookies (_ga, _ga_*) that help us understand how the product is used. These are only set after you accept analytics cookies via the consent banner.

You can withdraw analytics consent at any time by clicking “Manage cookies” in the footer of any public page.

4. Third-party services

We share data with the following categories of sub-processors to operate the service:

  • Supabase: database, authentication, and file storage infrastructure. Your account data and reports are stored on Supabase-managed infrastructure.
  • Anthropic:AI analysis. Page content captured during an analysis is sent to Anthropic's API to generate scores and recommendations. Processed under Anthropic's Privacy Policy.
  • Stripe: payment processing. See Stripe's Privacy Policy.
  • Resend: transactional email delivery for reports and account emails.
  • Vercel: cloud hosting and edge delivery.
  • Google Analytics: anonymised usage analytics (only with your consent).

5. Data retention

Analysis reports are retained for as long as your account is active. You can delete individual reports at any time from your reports page. If you close your account, all personal data and reports are permanently deleted within 30 days. Server logs are retained for up to 30 days then automatically purged.

6. Your rights (GDPR / UK GDPR)

If you are in the UK or European Economic Area, you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate data.
  • Erase your data (“right to be forgotten”).
  • Restrict how we process your data.
  • Port your data to another service.
  • Object to processing based on legitimate interests.
  • Withdraw consent for analytics cookies at any time.

To exercise any of these rights, email hello@wouldibuy.com. We will respond within 30 days.

7. Security

Data is encrypted in transit (TLS) and at rest. Access to production data is restricted to authorised personnel. We conduct periodic reviews of our security practices.

8. Changes to this policy

We may update this policy from time to time. We will notify you of material changes by email or via an in-app notice. Continued use of the service after changes constitutes acceptance.

9. Contact

For privacy-related questions or to exercise your rights, contact us at hello@wouldibuy.com.