Privacy Policy | Sell Micro SaaS

This policy explains what personal data Sell Micro SaaS collects, why, who processes it for us, how long we keep it, and what you can ask us to do with it.

Sell Micro SaaS is run by Alston Antony, Coimbatore, Tamil Nadu, India, who is responsible for your data (the "controller" or "data fiduciary"). Contact for anything in this policy: [email protected].

The short version

There are no accounts or passwords. We only have what you type into one of our forms.
A seller's email address is never shown on the site. We use it to forward buyer messages and to contact the seller about the listing.
When you send a message or submit a listing, we store a salted hash of your IP address, not the IP itself, to limit abuse.
We don't sell your data or use it for advertising.

What we collect, and why

When you list a product

The listing form stores:

Listing details: headline, descriptions, category, asking price and price type, revenue, MRR, costs, churn, traffic, customers, tech stack, what's included, reason for selling, timezone, screenshots, and similar fields you fill in.
Product name and website. These are public only if you tick the box to show them. Otherwise only we see them.
Your contact email. Never public. We use it to tell you we received the listing, to contact you about review or changes, and to forward buyer messages to you.
How you heard about us, if you answer. Never public.
A salted SHA-256 hash of your IP address, used only to spot abuse such as repeated spam listings. Never public.
Internal notes we add during review, such as a rejection reason.

Once a listing is approved, its details (except the private fields above) are published on the site. Screenshots are stored at public web addresses as soon as they're uploaded, so treat them as public and leave personal data out of them.

When you message a seller

The contact form on a listing stores, in our leads table:

your name, email address and message;
your budget, if you choose one;
which listing you wrote about, and when;
a salted SHA-256 hash of your IP address and your browser's user agent string (which identifies the browser and operating system);
whether the email was delivered, and the error if it wasn't.

We use this to send your message to the seller by email. The seller receives your name, email address, message and budget, and replies to you directly. The IP hash and user agent are used only to enforce rate limits (a few messages per hour, per day and per listing) and to investigate spam or abuse. They are never shown to sellers or anyone else.

When you report a listing

We store the listing, your reason, and your email address if you give one (it's optional), so we can review the report and follow up with you.

When you join the waitlist

We store your email address and whether you're a buyer or seller, to email you when new listings go live. Ask us and we'll remove you.

When you subscribe to the newsletter

Your email address is sent straight to SendFox, our newsletter provider, and isn't stored in our own database. We use it only to send the newsletter. Every newsletter has a one-click unsubscribe link.

About the IP hash

We combine your IP address with a secret value (a "salt") and store only the SHA-256 hash of the result. The hash lets us count requests from the same connection without keeping the address itself, and the secret salt stops anyone from reversing it by trying every possible IP. Because we could still match a known IP against it, we treat the hash as personal data.

Spam protection, hosting and logs

Our forms use Cloudflare Turnstile to tell people from bots. To run that check, Cloudflare processes information about your browser and connection. The site is hosted on Cloudflare, which processes your IP address and request details to deliver pages and protect the site from attacks. We don't add your raw IP address to our database.

Cookies and browser storage

We don't set cookies of our own. If you switch between light and dark mode, that choice is saved in your browser's local storage and never sent to us. Cloudflare may set strictly necessary security cookies.

Analytics

We don't use Google Analytics or any other analytics cookies.

Legal bases

Where data protection law applies (such as India's Digital Personal Data Protection Act 2023, the GDPR or the UK GDPR), we rely on:

Taking steps at your request: publishing your listing, forwarding your message to a seller.
Legitimate interests: preventing spam and abuse (the IP hash, user agent and rate limits), reviewing reports, and keeping the site secure.
Consent: the waitlist and newsletter. You can withdraw consent at any time.

Who processes your data

We use these service providers. They process data on our behalf and only for the purposes above.

Provider	What they do for us
Supabase	Database and file storage: listings, screenshots, leads, reports and the waitlist.
Cloudflare	Hosting, the form-handling functions, network security, and Turnstile spam checks.
Resend	Sending email: buyer messages to sellers, and listing notifications.
SendFox	Newsletter subscriptions and sending the newsletter.

The only other people who receive your data are sellers, who get the messages buyers send them. We may also disclose data if the law requires it, or to protect people from fraud. We never sell personal data.

International transfers

Our providers may process data outside your country, including in the United States and Australia. Where the law requires it, transfers rely on safeguards our providers offer, such as the European Commission's standard contractual clauses.

How long we keep data

Listings: while published, and for 24 months after they're sold, rejected or removed, so we can handle questions and repeat abuse. Ask us to delete yours sooner and we will, unless we need it to deal with fraud.
Buyer messages (leads), including the IP hash and user agent: 12 months from when they were sent.
Reports: 24 months.
Waitlist: until you ask to be removed, or until we stop running the waitlist.
Newsletter: until you unsubscribe.

How we protect it

The public site is built only from published listing fields. Contact emails, IP hashes, messages, reports and the waitlist can be read only by our server-side code and by us, never from the browser. Data travels over HTTPS.

Your rights

Depending on where you live, you can ask us to show you the data we hold about you, correct it, delete it, limit how we use it, or object to how we use it, and you can ask for a copy in a portable format. Email us from the address the data relates to, so we can confirm it's yours. We'll reply within one month.

If you think we've handled your data wrongly, please tell us first. You can also complain to your local data protection authority, such as the Data Protection Board of India.

Children

The site is for people buying and selling businesses, and isn't meant for anyone under 18.

Changes to this policy

We'll update this page when what we collect or who processes it changes, and change the date at the top. Significant changes will be noted on the site.