Privacy Policy

1. Who we are

Competitor Move (“we”, “us”) is operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. We are the data controller for personal data described in this policy. You can reach us at hello@competitormove.com.

This policy covers the marketing site at competitormove.com (the “Site”) and the product dashboard at app.competitormove.com (the “App”), together the “Service”.

2. What we collect

Waitlist

When you join the waitlist we store your email address, the time you signed up and, if you are admitted to the beta, the time you were approved. We send you a confirmation email.

Account and workspace data

• Account: your email address and authentication records, managed by Supabase Auth. You sign in with a one-time email link or, if you choose, with Google (we receive your email address and basic profile from Google).
• Workspace: workspace name, members and their roles, and pending invitations (the invitee’s email address, role and expiry).
• Configuration: the website you add as your own baseline, the competitor domains you track, and delivery channels you set up — email addresses, Slack incoming-webhook URLs, and custom webhook URLs together with their signing secrets.
• Product activity: scans, detected changes, generated reports, delivery logs, feedback you give on detected changes (for example marking a change as wrong), and records of rate-limited actions (who triggered an action such as a manual re-check, and when).

Public website content we crawl

For each website you add, our crawler fetches publicly accessible pages only: the homepage, the pricing page, the sitemap (and robots.txt to find it), and changelog or release-notes pages. We do not log in, submit forms, or access anything behind authentication. We store extracted information (headline, call to action, pricing tiers, page lists, changelog entries) and short fingerprints of the page text so we can detect changes. This content is about businesses, not individuals; if a public page happens to contain personal data, it is processed only as part of that page’s content.

Technical data

• Logs: our hosting provider records standard request logs (such as IP address, user agent, URL and timestamp) for security and operations.
• Error reports: when something breaks in the App, Sentry may receive error details and request metadata, which can include your user identifier or IP address.
• Site analytics: the Site uses Vercel Web Analytics, which measures page views in aggregate without cookies and without building cross-site profiles.

3. How we use it

• To run the Service: authenticate you, crawl the websites you choose, detect changes, generate and deliver reports and alerts.
• To manage the waitlist and beta access, and to send service emails (sign-in links, confirmations, invitations, reports, alerts).
• To keep the Service secure and reliable: rate limiting, abuse prevention, debugging and monitoring.
• To improve detection quality, for example using your feedback on incorrect changes.

We do not sell personal data, we do not share it for advertising, and we do not use your data to train AI models. Page text sent to OpenAI for extraction and summaries is processed under OpenAI’s API terms, which do not use API data for model training by default.

4. Legal bases (EEA/UK)

• Contract: to provide the Service you signed up for.
• Legitimate interests: to secure and improve the Service and to crawl public business websites you ask us to monitor.
• Consent: for the waitlist and any optional communications; you can withdraw at any time.
• Legal obligation: where we must keep or disclose data by law.

5. Subprocessors

We use the following providers to run the Service. Each processes data only to provide its service to us.

Your own integrations. When you add a Slack or custom webhook, reports are sent to the destination you configure. That destination is chosen and controlled by you, not a subprocessor of ours (see section 9).

Where data is transferred outside the EEA/UK, we rely on our providers’ standard contractual clauses or equivalent safeguards. [CONFIRM DPAs / SCCs WITH EACH PROVIDER]

6. Retention and deletion

• Failed scans are deleted after 30 days.
• Completed scans are deleted after 180 days, except the latest 3 per competitor, which we keep so change detection keeps working. Detected changes and reports remain until you delete them or your workspace.
• Rate-limit records are deleted after 30 days.
• Account deletion: you can delete your account under Settings in the App. If you are the only member of your workspace, the workspace and all of its data (competitors, scans, changes, reports, delivery channels) are deleted. If others remain, you leave the workspace (a sole owner must hand over ownership first). Your waitlist entry and login are deleted too.
• Waitlist entries are kept until the beta ends or you ask us to remove them.
• Provider logs, error reports and backups are kept for the providers’ standard retention periods [CONFIRM: e.g. Supabase backups, Vercel logs, Sentry events], after which they are deleted.

7. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or the CCPA/CPRA), you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. We do not sell or “share” personal information as defined by the CCPA, and we will not discriminate against you for exercising your rights.

Email hello@competitormove.com to make a request. We will respond within 30 days and may need to verify your identity. You can also delete your account yourself in Settings. If you are in the EEA or UK you may complain to your local data protection authority.

8. Cookies

• App: we use only the strictly necessary authentication cookies that keep you signed in (Supabase session cookies). No advertising or tracking cookies.
• Site: no cookies are set for analytics; Vercel Web Analytics is cookieless.

9. Slack and webhook destinations

Reports you send to Slack or a custom webhook contain workspace data (competitor names, detected changes, report links). You are responsible for choosing destinations you control and trust, and for how data is handled once it arrives there. Webhook payloads are signed so you can verify they came from us — see the webhook docs.

10. Security

We protect data with encryption in transit, provider-managed encryption at rest, per-workspace row-level security and other safeguards described on our Security page. No system is perfectly secure; report vulnerabilities to security@competitormove.com.

11. Children

The Service is for businesses and is not directed to anyone under 16. We do not knowingly collect their data.

12. Changes to this policy

We will update this page when the Service or our practices change and revise the date above. For material changes we will notify account holders by email before they take effect.

13. Contact

[LEGAL ENTITY NAME], [REGISTERED ADDRESS] — hello@competitormove.com. [EU/UK REPRESENTATIVE, IF REQUIRED]