Safe Retire Watch ("we", "us", "our") respects your privacy. This policy explains what information we collect, why, how long we keep it, who we share it with, and the choices and rights you have — including under the EU/UK GDPR and the California Consumer Privacy Act (CCPA/CPRA).

Who we are

Safe Retire Watch operates saferetirewatch.com and is the controller of the personal information described here. You can reach us any time through our contact page.

Information we collect

Account information: name, email address, and a hashed password.
Billing information: processed by Stripe. We receive a customer ID, plan, subscription status, and the last four digits and brand of your card. We never receive or store full card numbers.
Alert preferences: the scam categories and channels you choose.
Content you submit: contact-form messages, scam reports, newsletter sign-ups, and text, links, phone numbers, or emails you paste into our free AI tools.
Usage and device data: pages visited, alerts viewed, browser type, and coarse location derived from IP address, used for security, rate limiting, and aggregate analytics.
Cookies and local storage: see our Cookie Policy.

We do not knowingly collect information from children under 16, and we do not ask for Social Security numbers, account numbers, or health records — please do not send them to us.

How we use your information, and our legal bases

To deliver scam alerts, guides, and AI tool results — performance of a contract.
To process payments and manage subscriptions — performance of a contract.
To send transactional and account emails — performance of a contract.
To send our free weekly scam digest — your consent, withdrawable at any time.
To secure the service, prevent abuse, and debug — legitimate interests.
To measure and improve the product with analytics — your consent where required.
To comply with tax, accounting, and legal obligations — legal obligation.

AI features

What you paste into our AI tools is sent to our AI model provider solely to generate your result. We do not use your submissions to train third-party foundation models and we do not sell them. See the AI Disclaimer for details and limits.

Email and SMS communications

Marketing emails are sent only to people who ask for them. Every marketing email identifies us, includes a valid postal or contact route, and carries a working one-click unsubscribe link that we honor promptly, as required by the CAN-SPAM Act. Transactional messages (receipts, security notices, and alerts included in your plan) are part of the service and continue while your account is active.

We do not send marketing text messages or place automated marketing calls. If we ever add phone or SMS alerts, they will require your separate, express written consent before any autodialed or prerecorded message is sent, consent will never be a condition of purchase, message and data rates will be disclosed, and replying STOP will opt you out immediately — consistent with the TCPA.

Sharing

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose data only to service providers who process it on our instructions under contract:

Stripe — payments and subscription billing.
Lovable Cloud / Supabase — hosting, database, and authentication.
Our email delivery provider — transactional and newsletter email.
Our AI model provider — generating AI tool results.
Analytics provider — only with your consent.

We may also disclose information if required by law, to enforce our terms, or in connection with a merger or acquisition (with notice to you).

International transfers

We are based in the United States and our providers may process data there. Where personal data is transferred out of the EEA or UK, we rely on Standard Contractual Clauses and appropriate safeguards.

How long we keep data

Account data: while your account is active, then up to 12 months after closure.
Billing records: 7 years, to meet tax and accounting rules.
Contact messages and scam reports: up to 24 months.
AI tool submissions: retained only as long as needed to return your result and to prevent abuse, then deleted or aggregated.
Newsletter records: until you unsubscribe, plus a suppression record so we do not email you again.

Security

We use HTTPS everywhere, encrypted storage, hashed passwords, row-level access controls on our database, least-privilege service credentials, and secret management for API keys. No system is perfectly secure, but we work to protect your data and will notify you and regulators of a qualifying breach as required by law.

Your rights (GDPR / UK GDPR)

If you are in the EEA or UK you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests, and withdraw consent at any time. You also have the right to complain to your local supervisory authority.

Your rights (California — CCPA/CPRA) and other U.S. states

California residents may request to know the categories and specific pieces of personal information we collected, request deletion or correction, and limit the use of sensitive personal information. We do not sell or share personal information, so there is nothing to opt out of, but we honor Global Privacy Control signals as an opt-out anyway. We will not discriminate against you for exercising any right. Residents of other states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Texas, and Utah) have comparable rights, and we apply the same process.

How to exercise your rights

Send a request through our contact page from the email address on your account. We verify requests by confirming control of that email, respond within 30 days (45 days for CCPA requests, extendable once with notice), and authorized agents may submit requests with written proof of authority.

Cookie choices

Changes

We will post any changes here and update the date above. Material changes will be announced by email or an in-app notice.

Contact

Questions or privacy requests? Reach us through the contact form on this site.

Privacy Policy