This policy explains what personal data TemplatePort collects, why, and what rights you have. TemplatePort is run by Leote B.V., [Street and number], [postcode] [city], the Netherlands (KvK [KvK number]), the controller of your data. Questions: [privacy@yourdomain.com].
What we collect
- Account: your email address, name, and login details (passwords are stored hashed by our auth provider; with Google sign-in we receive your name and email).
- Your content: brand kit (logo, colors, fonts, footer text, company address, social links), templates, versions, and images you upload.
- Email provider connections: API keys for Resend, Postmark, SendGrid or Brevo, stored encrypted and only decrypted on our server to push templates and send test emails. You can disconnect at any time, which deletes the key.
- Usage: push history, test emails sent (recipient address and time), AI usage counts (to enforce plan limits and control costs), and which tools an MCP client called with your API key and when. API keys are stored only as a one-way hash.
- Billing: your plan, subscription status and order references from Lemon Squeezy. We don't receive or store card details.
- Referrals: if you sign up with someone's invite link, we record which account invited yours to give you both the bonus. They only see a count, not who you are.
- Testimonials: if we ask you for a testimonial and you send one, the quote, name, role, company, website and rating you enter. It appears on our website only after you give consent and we approve it; ask us and we remove it.
- Technical: server logs with IP address and browser details, kept briefly for security and debugging.
Why we use it (legal basis)
- To provide the service you signed up for: creating, storing and pushing your templates (performance of a contract).
- To bill you and keep financial records (contract and legal obligation).
- To keep the service secure, prevent abuse and fix problems (legitimate interest).
- To show testimonials you chose to share (your consent, which you can withdraw).
- To email you about your account, such as receipts and important changes (contract). We send marketing emails only if you opt in.
We don't sell your data and don't use your templates to train AI models. Our AI provider processes prompts to return a result and, under its API terms, doesn't train on them.
Who processes data for us
We use these service providers (sub-processors). Each processes data only on our instructions, under a data processing agreement.
| Provider | Purpose | Location |
|---|---|---|
| Supabase (via Lovable Cloud) | Database, login and file storage for your account, brand kit, templates and images | EU or US, depending on the project region |
| Lovable | Hosting of the TemplatePort app | EU / US |
| Anthropic | AI generation: your brand kit, prompts and template text are sent to Claude to write and edit emails | US |
| Lemon Squeezy | Payments, invoices and VAT as merchant of record (they process card details, we never see them) | US |
| Unsplash | Photo search; Unsplash photos in your emails load from Unsplash's servers | US |
| Umami | Cookieless website analytics: page views and product events, without names, emails or stored IP addresses | EU or US, depending on the chosen region |
When you push templates or send test emails, data goes to the email provider you connected (Resend, Postmark, SendGrid or Brevo) on your instruction, under your own agreement with them. Transfers outside the EU rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
How long we keep it
- Your account and content: until you delete your account.
- Push and test history: while your account exists.
- Billing records: as long as Dutch tax law requires (7 years), kept by Lemon Squeezy as merchant of record.
- Server logs: up to 30 days.
Your rights
Under the GDPR you can access, correct, export or delete your data, object to or restrict processing, and withdraw consent. Most of this is self-service: download your data and delete your account under Account in the app. For anything else, email [privacy@yourdomain.com]; we reply within one month. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local authority.
Security
Data is encrypted in transit, provider API keys are encrypted at rest and never sent to your browser, and every database table is protected so only your own account can read your workspace.
Cookies and analytics
We only use cookies and local storage that the app needs to work: keeping you signed in and remembering settings like dark mode. No advertising or tracking cookies.
To see which pages and features are used, we use Umami, which works without cookies and doesn't identify you: it counts page views and product events (like "template pushed") without your name, email or IP address being stored.
Changes
If we change this policy in a meaningful way, we'll tell you by email or in the app before the change takes effect.