Privacy Policy

1. Introduction

This Privacy Policy describes how rackspecs.com (“we,” “us,” or “our”) collects, uses, and protects your information when you use rackspecs at rackspecs.com (“Service”).

We are committed to protecting your privacy. We collect only the minimum data necessary to operate the Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your email address and a password. Authentication is handled by Amazon Cognito. We do not store your password directly; it is managed by Cognito’s authentication infrastructure.

2.2 Payment Information

If you subscribe to a paid plan, payment processing is handled entirely by Stripe. We do not receive, store, or have access to your full credit card number or payment credentials. Stripe may share with us limited information such as the last four digits of your card, card brand, and billing country for display and fraud-prevention purposes. Stripe’s handling of your data is governed by Stripe’s Privacy Policy.

2.3 Usage Information

We track API request volume and access events for the purpose of enforcing rate limits and usage allowances associated with your subscription. Usage counts are stored in our database and are associated with your account.

We do not log or store the content of your catalog queries or export requests beyond what is necessary for the immediate processing of the request.

2.4 Analytics

We use Vercel Analytics to collect basic, anonymized usage metrics such as page views, visit duration, and general geographic region. Vercel Analytics does not use cookies and does not track individual users across sessions. For details, see Vercel’s Analytics Privacy Policy.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service.
• Authenticate your identity and manage your account.
• Process payments and manage your subscription.
• Enforce usage quotas and rate limits.
• Communicate with you about your account, billing, or service-related matters.
• Detect and prevent fraud, abuse, or violations of our Terms of Service.

We do not sell, rent, or share your personal information with third parties for marketing purposes.

4. Third-Party Services

The Service relies on the following third-party providers, each of which processes data under their own privacy policies:

• Amazon Web Services (AWS): Infrastructure, authentication (Cognito), data storage (DynamoDB), email delivery (SES), and the compute environment that runs the backend. Data is stored in the US-East-1 (N. Virginia) region.
• Stripe: Payment processing.
• Vercel: Frontend hosting and anonymized analytics.

5. Cookies

The Service uses the following cookies:

• Essential cookies: An encrypted session cookie set by us to keep you signed in. Cannot be disabled without breaking sign-in.
• Analytics: Vercel Analytics, which does not use cookies, as described in section 2.4.

6. Data Retention

Account information is retained for as long as your account is active. Usage metering data is retained for billing reconciliation and is subject to automatic expiration (TTL) in our database.

If you delete your account, we will delete your account information and associated usage data within 30 days. Stripe may retain transaction records independently as required for financial compliance.

7. Data Security

We implement reasonable technical and organizational measures to protect your information, including:

• Encryption in transit (TLS) for all communications.
• Encryption at rest for stored data (AWS-managed encryption).
• Secure authentication via Amazon Cognito with support for multi-factor authentication.
• WAF (Web Application Firewall) protection against common attack vectors.
• No direct storage of passwords or payment credentials.

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Your Rights

You have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information associated with your account.
• Delete your account and associated data.
• Export your account information upon request.

To exercise any of these rights, contact us.

9. Children’s Privacy

The Service is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will take steps to delete it.

10. International Users

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on the Service prior to the changes taking effect. Your continued use of the Service after such notice constitutes acceptance of the updated policy.

12. Contact

For questions about this Privacy Policy, contact us or email support@rackspecs.com.