Privacy notice

Who is responsible

Golden Frijoles, operated from Mexico City, Mexico. Write to [email protected] about anything on this page.

What we collect

Your account: your email address, a password (stored hashed by our authentication provider) or your Google sign-in, the name you choose to show, your workspace and its products, and the credentials you create. API keys and share links are stored only as hashes; connector tokens and webhook signing secrets are stored as issued, because the service has to present them.

Billing: when you buy Growth we give Stripe your account email, and Stripe collects your card and billing details. We keep only the Stripe customer and subscription identifiers and your plan; we never see your card number.

Your products’ data: the events, flags and settings your products send. For this data you decide what is sent and why; we process it on your behalf to run the service, and send it on only to the destinations (webhooks) you configure.

Our own product use: we record what visitors do on our site (visits to the home page and the methodology, which landing version they saw, joining the waitlist, starting a sign-up) and what accounts do in the product (for example signing up, creating a product, a product sending its first event, opening a shared report), in our own Golden Frijoles project, to improve the product. These records carry a random visitor id or an account id, never your name or email.

Cookies and browser storage: gb_vid, a random visitor id kept for a year, so a visit and a later sign-up count as the same visitor; gb_variant, which version of the home page you were shown, kept for 90 days; and, when you sign in, the session cookies that keep you signed in. Your browser also stores your analytics answer (gf_consent) and which methodology chapters you have read (gf.methodology.read.v1); neither leaves your device.

Abuse protection: we keep a one-way hash of your IP address for a short time to rate-limit sign-ups, the waitlist and other public forms.

The waitlist and booking: if you join the waitlist we keep your email. The /talk page embeds the Cal.com calendar, so opening it sends your browser’s request (your IP address and browser details) to Cal.com, and booking a session gives Cal.com your booking details.

Analytics, only with your yes

On our public pages (the home page, the methodology, /talk, sign-up and sign-in) we ask before loading Google Analytics and Microsoft Clarity. Clarity records how the page is used, including clicks and scrolling. Nothing loads until you say yes, it never loads inside the console, and you can change your answer at any time from “Cookie settings” in the footer of our home page.

Who else handles it

Supabase (database and sign-in; stored in the United States, AWS us-east-1), Vercel (hosting; United States), Cloudflare (network), Stripe (payments), Google (sign-in with Google, and Google Analytics with your consent), Microsoft (Clarity, with your consent) and Cal.com (bookings). Each processes data under its own terms and only for the service it provides us. We do not sell personal data, and we do not use your products’ data for advertising.

Public numbers

Golden Frijoles is built in the open: aggregate numbers about our own product (funnels, North Star, roadmap, flags) are public. They never name or identify a person, and they never include your products’ data.

How long we keep it

Account and workspace data: while your account is open. Your products’ data: until you purge a deleted product or close your account. Billing records: as long as tax law requires. Server logs: as long as our hosting providers keep them, typically days to weeks.

Your rights

You can ask to see, correct, export or delete your personal data, or object to how we use it, by writing to [email protected]. We answer within 30 days. Depending on where you live (for example under Mexico’s data-protection law, the GDPR in Europe or the CCPA in California), you can also complain to your data-protection authority.

Our servers are in the United States. By using the service from elsewhere you understand your data is processed there, under the safeguards our providers offer.

Changes

We will update this notice when what we collect or who handles it changes, and tell account owners about a material change before it applies.