Privacy Policy · Domshot

1. Information We Collect

1.1 Account Information

When you create an account, we collect information you provide directly to us, including:

Identity data: Name, email address, and profile picture (from your OAuth provider)
Authentication data: OAuth tokens from Google or GitHub when you choose to sign in with these services
Organization data: If you represent an organization, we collect organization name and associated metadata

1.2 API Usage Data

We automatically collect information about your use of our service:

Request metadata: Timestamp, number of requests, response times, and success/error status
Rate limiting data: Request counts and time windows to enforce fair usage limits
API key usage: Which API keys are making requests and their usage patterns

1.3 Payment Information

Payment processing is handled by our trusted payment processor, Polar. We do not store your complete credit card information.

Subscription data: Plan type, billing period, subscription status, and billing history
Payment tokens: We receive a secure payment token from Polar to manage recurring billing

1.4 Custom Settings

If you configure custom backgrounds or other settings, we store:

Background preferences (colors, gradients, directions)
API key names and configurations

2. How We Use Your Information

We use your information to:

Provide and improve our service: Process screenshot requests, manage your account, and maintain service quality
Authenticate users: Verify your identity and manage access to your account
Process payments: Handle subscriptions and billing through our payment processor
Enforce limits: Prevent abuse and ensure fair usage of our API resources
Communicate with you: Send service notifications, billing alerts, and important updates
Analyze usage: Understand how our service is used to improve performance and features
Comply with legal obligations: Meet our legal and regulatory requirements

3. Information We Share

3.1 Third-Party Service Providers

We share data with trusted third parties who help us operate our service:

OAuth providers: Google and GitHub for authentication (we receive only basic profile information)
Payment processor: Polar handles all payment transactions and securely stores payment details
Hosting providers: Cloudflare and other infrastructure providers to host and deliver our service
Database provider: Convex provides our backend database and real-time data synchronization

3.2 Content Processed Through Our API

When you use our screenshot API, we process the URLs you provide to capture screenshots. We do not:

Store the content of the webpages you screenshot
Access or store any data from the pages themselves
Use your screenshot requests for training purposes

Screenshots are generated on-demand and delivered to you. We may temporarily cache screenshots to improve performance, but cached content is automatically deleted after a short retention period.

3.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal requests from law enforcement or other government authorities. We will notify you of such disclosures unless prohibited by law.

3.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new owner.

4. Data Security

We implement industry-standard security measures to protect your information:

Encryption: All data is transmitted over HTTPS using TLS encryption
Authentication: API keys and OAuth tokens are securely stored and never logged
Access controls: Strict access limits on who can access your data within our organization
Regular audits: We regularly review our security practices and update them as needed

Despite these measures, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

5. Data Retention

We retain your data for the following periods:

Account data: Retained while your account is active. Deleted 30 days after account closure, except where legal requirements require longer retention.
Usage logs: Retained for up to 90 days for service improvement and security monitoring.
Payment records: Retained as required by tax and accounting laws (typically 7 years).
Screenshot cache: Temporary cached screenshots are deleted within 24 hours.

6. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information:

6.1 General Rights

Access: Request a copy of the personal data we hold about you
Correction: Request correction of inaccurate or incomplete data
Deletion: Request deletion of your personal data, subject to legal retention requirements
Objection: Object to certain processing activities
Restriction: Request that we limit how we use your data
Portability: Request your data in a structured, machine-readable format
Withdraw consent: Withdraw consent for processing where we rely on consent

6.2 How to Exercise Your Rights

To exercise these rights, please contact us at support@domshot.dev. We will respond to your request within 30 days.

6.3 Account Deletion

You can delete your account at any time from your dashboard settings. Upon deletion, all personal data will be removed within 30 days, except as required by law or for legitimate business purposes.

7. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable laws, including the use of Standard Contractual Clauses where required by European data protection laws.

8. Children's Privacy

Our service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal information, please contact us, and we will take steps to delete such information.

9. California Privacy Rights (CCPA)

If you are a California resident, you have specific rights regarding your personal information:

Right to know: Details about the categories of personal information we collect, use, and share
Right to delete: Request deletion of your personal information
Right to opt-out: Opt-out of the sale of personal information (note: we do not sell personal information)
Right to non-discrimination: Not receive discriminatory treatment for exercising your privacy rights

To exercise these rights under the CCPA, contact us at support@domshot.dev.

10. GDPR Compliance

For users in the European Economic Area (EEA), we comply with the General Data Protection Regulation (GDPR):

Legal bases for processing: We process your data based on contract performance, legal obligations, and legitimate interests
Data protection officer: You can contact our DPO at support@domshot.dev
Data breaches: We will notify you of any personal data breach within 72 hours of becoming aware, where required by law
International transfers: We use appropriate safeguards for data transfers outside the EEA

11. Cookies and Tracking

We use the following technologies on our website and dashboard:

Essential cookies: Required for authentication and security. These cannot be disabled.
Preference cookies: Remember your settings (like theme preferences)

Our API endpoints do not use cookies or tracking technologies for screenshot requests. We do not use third-party analytics services on our API.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on our website and updating the "Last updated" date. Your continued use of the service after such changes constitutes your acceptance of the updated policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: support@domshot.dev
Website: https://domshot.dev

For data protection inquiries from EEA residents, please include "GDPR Request" in your email subject line.