What we do to protect your account and your apps, and what we don't have yet. Each point was checked against our code or our legal texts on 3 November 2026. For personal data, the privacy policy remains the reference.
What reaches us
- We receive your site's address, not its source code.
- An app loads your site directly. The pages your users open and what they type do not pass through our servers.
- Card details stay with Stripe and never reach our servers.
Who can access your data
- Row-level security is on for every table of our database. A signed-in account only reaches its own projects, builds and connections.
- Our server functions check who is calling and who owns the project.
- Build files and signing keys sit in private storage. A download link is only issued to the account that owns the build.
- Images and legal pages meant to be public, such as your app icon, are stored publicly.
- Each Android build runs in its own container, removed when the build ends.
- Our servers accept SSH keys only, never a password.
Encryption
- All traffic to saastostore.com uses HTTPS, with HSTS.
- Your app's signing key is encrypted with AES-256-GCM, with a key derived for your account.
- Its password is filtered out of our logs and reaches you by email only.
- The free test build is signed with a throwaway key that we do not keep.
- If you let us publish for you, the credentials you give us are encrypted with AES-256-GCM and decrypted only for the publication.
Sign-in and sessions
- Sign-in runs on Supabase Auth: we do not store passwords ourselves.
- Sign out closes this browser only. Sign out everywhere, on your account page, closes every session.
- A closed session can no longer change your projects, even before its token expires.
AI agents
An AI agent connects through the MCP connector, after you approve it on a consent page.
- It can check a URL, create your app and run a build. A build it starts uses your plan like any other build.
- It cannot pay, publish, delete or change your connections. It can only prepare a payment link, which you open yourself.
- These limits are enforced in our server functions and again in the database, not only in the connector.
- Sign out everywhere disconnects agents too.
Payments
Payments run on Stripe, whose platform is certified PCI-DSS Level 1. That certification is Stripe's, not ours. We keep payment records for accounting, never card details.
Subprocessors
The main providers that process data for SaasToStore:
| Provider | Used for | Location |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | European Union |
| Ionos | Build servers, sign-in emails | Germany |
| Cloudflare | Website hosting and delivery | Global network |
| GitHub | iOS and desktop builds | United States |
| Stripe | Payments | United States |
| Resend | Transactional emails | United States |
| Anthropic | AI text and setup assistant | United States |
| Google Gemini | AI images | United States |
| Browserless | Screenshots of your site | United States |
| Google Firebase | App notifications | United States |
| PWABuilder (Microsoft) | Windows packages | United States |
Transfers outside the European Union rely on the European Commission's standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework.
GDPR and your rights
- SaasToStore is run by Méga Joule, in France, which is the data controller.
- You can ask to access, correct, delete or export your data at hello@saastostore.com. We answer within 30 days.
- You can also complain to the CNIL, the French data protection authority.
- We do not sell your data, and we do not use it to train AI models.
- If a breach puts your rights at risk, we notify the authority within 72 hours and you without undue delay.
Deleting your account
Open Account, choose Delete my account, type your email address to confirm, then choose Delete permanently. Deletion is refused while a build is running.
- Your projects, builds, files and signing keys are deleted. All personal data is erased within 30 days, except what the law requires us to keep.
- Payment records are kept for 10 years, as French accounting law requires, no longer linked to your account.
- An app already published stays on its store, and we can no longer build its updates.
Report a security issue
Write to hello@saastostore.com with the steps to reproduce the issue. We read every report. We have no paid bug bounty program.