Privacy Policy

This Privacy Policy explains how Retainer Burn ("Retainer Burn", "we", "us") collects, uses, and protects your information when you use our website and application (the "Service"). By using the Service, you agree to this policy.

1. Information we collect

Account information. When you create an account, we collect your email address and, optionally, a display name. Your password is handled by our authentication provider and stored only as a salted hash — we never see it.

Information you create in the Service. To do its job, the Service stores the data you enter: your clients and their monthly budgets, your time entries and notes, and the alerts generated from them. This content belongs to you.

Technical information. Like most websites, our hosting provider automatically processes limited technical data — such as IP address, browser type, and request timestamps — to deliver and secure the Service.

We do not intentionally collect special categories of personal data, and we ask that you don't put any into your notes or client names.

2. How we use your information

We use your information to:

• provide, maintain, and secure the Service;
• authenticate you and keep you signed in;
• calculate burn and send the in-app alerts you ask for;
• respond to your support requests; and
• send essential, account-related emails (such as confirmation and password-reset links).

We do not use your client or time-entry data for advertising, we do not sell it, and we do not use it to train machine-learning models.

3. Legal bases (EEA and UK users)

Where the GDPR or UK GDPR applies, we process your data on the basis of: performance of our contract with you (to provide the Service); our legitimate interests (to secure and improve the Service); your consent (where we ask for it); and compliance with our legal obligations.

4. How we share information

We share information only with the service providers that make Retainer Burn work, under agreements that require them to protect it:

• Hosting and infrastructure (Vercel) — runs the application.
• Database and authentication (Supabase) — stores your account and data and handles sign-in.
• Email delivery — used to send account-related messages.

We may also disclose information if required by law, to protect the rights or safety of our users, or in connection with a merger or acquisition (in which case we will notify you). We never sell your personal information.

5. Cookies

We use a small number of strictly necessary cookies to keep you signed in and to operate the Service securely. We do not use advertising or cross-site tracking cookies. Because our cookies are essential, they cannot be disabled without breaking sign-in.

6. Data retention

We keep your information for as long as your account is active. If you delete your account, we delete your personal data and associated content within 30 days, except where we are required to retain certain records to comply with the law.

7. Security

We protect your data with encryption in transit and at rest, database-level row isolation, and secure authentication. Learn more on our security page. No system is perfectly secure, but we take protecting your data seriously.

8. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can view and edit most of your data directly in the app, or contact us to exercise any of these rights. EEA and UK users may also lodge a complaint with their local data-protection authority. California residents have rights under the CCPA, including the right to know and to delete; we do not sell personal information.

9. International transfers

Our providers may process data in countries other than yours, including the United States. Where required, such transfers are covered by appropriate safeguards, such as Standard Contractual Clauses.

10. Children

The Service is not directed to children. You must be at least 16 years old (or the age of digital consent in your country) to use it, and we do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the date at the top and, where appropriate, notify you. Continued use of the Service after changes means you accept the updated policy.

12. Contact

Questions or requests about your privacy? Email privacy@retainerburn.com or use our contact page.