Privacy Policy

We collect several different types of information for various purposes to provide and improve our Service to you.

Personal Data

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you (“Personal Data”). This may include, but is not limited to:

• Email address
• First name and last name
• Startup information (name, URL, description, etc., for the purpose of submission)
• Inquiry details you send through a form on our website, such as the Sell Your Directory and Add Your Directory forms: your email address, the website address you submit and the option you choose (sell, white label, affiliate or adding your directory to our catalog). The Add Your Directory form also takes an optional promo code and an optional note
• Abuse-prevention data collected when you send a form: a keyed hash of your IP address, your approximate country, how long the form took to fill in and the result of an automated bot check that our website host (Vercel) runs in your browser
• Payment information (processed securely by Stripe; we do not store full credit card numbers)

Submitator uses the collected data for various purposes:

• To provide and maintain our Service
• To process your payments and prevent fraud
• To perform the submission service you purchased
• To provide customer support
• To answer inquiries you send us, including offers to sell us a website, white label requests and affiliate program questions. We reply personally and do not add inquiry emails to any mailing list
• To protect our forms against spam and abuse
• To notify you about changes to our Service
• To allow you to participate in interactive features of our Service when you choose to do so
• To monitor the usage of the Service
• To detect, prevent and address technical issues

We process inquiry details because you asked us to respond, as a step taken at your request before any agreement (Article 6(1)(b) GDPR). We process abuse-prevention data in our legitimate interest in keeping our forms free of spam (Article 6(1)(f) GDPR).

We keep inquiries for 12 months from the date you send them and then delete them. Inquiries we mark as spam are deleted 30 days after they arrive, and inquiries held back by our abuse checks that we never review are deleted after 90 days. Hashed IP addresses are removed after 30 days. You can ask us to delete your inquiry sooner by writing to vlad@submitator.com. If we write to you about a directory you sent us, we keep your email address and our messages with our record of that directory until you ask us to delete them.

Agencies on our white label plan use the Submitator API with API keys, directly or through our MCP server, which lets an AI assistant call the API for them. This is what we keep for them and how we use it.

• API keys. A key you create in the agency console is shown once. We keep only a SHA-256 digest of it and its key ID, the part that is not secret, so we cannot show the key again: if you lose it, you create a new one. You can revoke a key in the console at any time.
• Request log. For each API request we record the time, the method, the path without its query string, the status, the error code, how long it took, the request ID, the mode (test or live) and the key that sent it. The agency console's own requests are recorded the same way, without a key. This log never holds a request or response body, the Authorization header or the query string. For calls from the MCP server, the request ID also names the assistant app that made them. You can read the log in the console under Developers, and every night we delete the entries older than 14 days.
• Server log. Our application also writes a server log, which our host (Koyeb) keeps for up to 30 days. For each request to the API, the agency console or the sign-in, it records the path with its query string, the IP address the request came from and the request's parameters, the project details it sends included, with email addresses, keys, tokens and passwords filtered out. It holds no request headers, so never the Authorization header, and no response body.
• MCP server. The remote MCP server at https://mcp.submitator.com/mcp runs on Vercel and keeps nothing between requests: it passes each request on to our API with your key and forgets both. Apart from the request records Vercel keeps as our host, it logs only the type of an error when something fails, never the error's message, a header or a key. The npm package runs on your own computer and sends your key only to our API.
• Signing in from an assistant. An AI assistant app can connect by signing in (OAuth) instead of with a key. The sign-in goes through the agency console's login, where you choose test or live mode and full or read-only permissions. We then create an API key for that assistant, labelled with its name, which the assistant receives only inside encrypted tokens. We record the grant: the assistant that asked, the console user who allowed it, the mode, the permissions and digests that identify its sign-in code and refresh token, never a code or a token itself. The sign-in ends when you revoke that key in the console, or once the assistant has not used it for 90 days. A revoked grant stays on record with your agency account, marked as revoked.
• What your assistant sends. The project details your assistant sends through the server, such as the product's name, URL and descriptions, its logo and screenshots and the contact email, are used to provide the service: we submit the project to the directories you launch it on, and some directories register the listing to the contact email and write to it. Some of the service providers listed below handle these details for us, and that list says what each one does. Our answers go back to the assistant you chose, and its provider handles them under its own privacy policy.
• How long we keep it. Test mode data is deleted once no test project, listing or report has changed for 30 days, or at once when you press Delete all test data in the console. A report's file is deleted 7 days after it is ready, and the events the API lists and webhooks deliver are deleted after 90 days. A draft you delete is removed with its images. A launched project has no end date: its launch is spent, so neither the console nor the API deletes it. We delete it when you ask us to at vlad@submitator.com; listings that directories have already published stay on their own sites.

The security of your data is important to us but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

To report a security vulnerability, write to vlad@submitator.com. Our security.txt gives the same address.

We may employ third-party companies and individuals to facilitate our Service (“Service Providers”), such as payment processors (Stripe), analytics providers, and hosting services. These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

Our website uses three analytics and referral tools: Umami and Google Analytics (GA4) measure page visits and on-site events, and PromoteKit records affiliate referrals when you arrive through an affiliate link. We do not send the email address, website address, promo code or note from an inquiry form to any of them.

Inquiries sent through our forms pass through our website host (Vercel) and are stored in our own application (hosted on Koyeb, database on Neon). We notify ourselves of a new inquiry through Telegram; that message contains the inquiry number, the website address and the option you chose, never your email address. Your email address is visible only to us, inside our own admin panel. We never send automated emails to the address you submit.

The service providers this page names, what each does for us and where to read its own policy:

• Stripe: processes payments (privacy policy)
• Clerk: runs sign-in to our app at app.submitator.com, the agency console included, which is also where an AI assistant's sign-in happens (privacy policy)
• Vercel: hosts this website, our app at app.submitator.com (the agency console included) and the remote MCP server, and runs the bot check on our forms (privacy notice)
• Koyeb: hosts our backend and the API at api.submitator.com, and keeps our server log (data processing agreement)
• Neon: hosts our database (privacy policy)
• Hetzner: stores our files: project logos and screenshots, the screenshots that show a listing, and reports (privacy policy)
• Anthropic: writes texts from your project's details where a directory needs them, such as a description of the length it takes or an article, and checks a project's website for disallowed content (privacy policy)
• Ahrefs: reads the Domain Rating of a project's website and of the competitors listed for it (privacy policy)
• Postmark: sends the emails our application sends (privacy policy)
• Sentry: receives our application's error reports, which leave out request bodies, cookies, query strings and IP addresses (privacy policy)
• Umami: measures page visits and on-site events (privacy policy)
• Google Analytics (GA4): measures page visits and on-site events (privacy policy)
• PromoteKit: records affiliate referrals (privacy policy)
• Telegram: carries the alerts we send ourselves: about a new inquiry, without your email address, and about a project, a submission, a payment or a reward claim, which can name the project and its URL, the agency or the customer's email address (privacy policy)

Our Service does not address anyone under the age of 18 (“Children”). We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your Child has provided us with Personal Data, please contact us.

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. You are advised to review this Privacy Policy periodically for any changes.

If you have any questions about this Privacy Policy, please contact us: