SMART LAUNCHER
Privacy notice
Updated 13 November 2026
Your saved work stays in your account. This notice explains what Smart Launcher processes, why it is needed and how to ask for access or deletion.
Who is responsible
Smart Launcher is operated by Andrew Hamilton trading as Evolutive X, United Kingdom. We are the controller of the personal information used to provide this service. Contact hello@evolutivex.com about privacy, your information or this notice.
Smart Launcher is a public proof of concept for preparing campaigns. Checkout, fulfilment and campaign performance examples are simulations. Do not enter payment-card details, sensitive personal information or customer lists.
Starting with a URL
When you request a preview, we retrieve the public URL you provide, extract source text and facts, and prepare a draft. Before you save, the campaign and its source documents are processed in application memory rather than saved as a workspace campaign.
The requested website receives the URL request from our hosting infrastructure; DNS services process the hostname. Your sign-in cookies and authentication tokens are not forwarded to the source website. Do not submit URLs containing passwords, private access tokens or personal information.
To prevent abuse, our application stores a hash derived from your IP address, request counts and expiry times for rate limits. This is a pseudonymous identifier, not a promise of anonymity. Hosting and authentication services also process network and device information to deliver and protect the service.
Sign-in information
You can preview without signing in. Saving requires Google, Microsoft or ChatGPT sign-in. We use the stable account identifier, sign-in provider, name and email address when supplied, and authentication claims needed to verify access. Some accounts do not provide an email address.
Our application stores your account identifier, available name/email, account status, creation time and last-active time. Firebase Authentication manages Google and Microsoft sign-in and its authentication records. Sites manages ChatGPT sign-in. Smart Launcher does not receive your Google, Microsoft or ChatGPT password.
Google sign-in requests only basic identity scopes: openid, profile and email. Microsoft sign-in requests basic identity and read-profile access. We use these details to sign you in, keep your workspace separate and provide account support. We do not request Gmail, Google Drive, calendar, contacts or mailbox access.
We do not sell Google user data, use it for advertising or pass it to an AI model for training. Different sign-in methods have separate workspaces, even when their email addresses match. Return using the same method to find your saved campaigns.
Saved work and questions
When you save, we store campaign briefs, page copy, supporting source URLs and text, extracted facts, review decisions, source timestamps and hashes, campaign versions and related activity. Your free-text inputs may contain personal information, so include only information you are entitled to use.
The visitor assistant processes questions and answers using the supplied source material within the application. This implementation does not send those questions to an external AI model. Application records retain answer status, source citations, timing, estimated cost and timestamps; they do not retain the question or answer text. Infrastructure logs are subject to the hosting providers’ practices.
The dashboard stores test visits/clicks, simulated checkout, order and fulfilment references, estimates, activity and retry records. These are test ledgers. No advertising pixels or third-party analytics integration is installed, and this release does not automatically track real visitors for campaign analytics.
Saved campaigns and their previews require the owning account. Administrators can manage account access and service totals; that role does not automatically grant access to another account’s private campaign content. Authorized service operators and infrastructure providers may need access for support, security or legal obligations.
Why we use this information
We use account information and saved work to provide the service you request, including authentication, saving, editing and retrieval. Where UK data protection law applies, our basis is performing our agreement with you or taking steps at your request before that agreement.
We use limited request, activity and technical records for our legitimate interests in preventing abuse, protecting accounts, troubleshooting and maintaining a reliable service. We consider the impact on your rights and keep access and data use limited to these purposes. We may also process information to meet legal obligations or establish, exercise or defend legal claims.
We do not send marketing messages or use your campaign information for targeted advertising through this release. If we introduce optional marketing or analytics, we will explain the change and obtain consent where required.
Services that process information
OpenAI Sites provides hosting and native ChatGPT authentication. Cloudflare provides application execution, network/DNS services and D1 database storage. Google Firebase Authentication provides Google/Microsoft sign-in, and Google or Microsoft processes the identity login you choose. Source websites process retrieval requests when you import their URLs.
These providers can process information in countries outside the United Kingdom. Their applicable data-processing and international-transfer terms govern that processing. Google describes its Firebase Data Processing and Security Terms and international-transfer safeguards in the privacy information linked below. Contact us for information about the safeguards applicable to your data; we do not promise UK-only storage.
We disclose information only as needed to provide and protect the service, respond to your request, comply with law or handle a lawful business transfer. A future change of operator would be communicated where required.
Cookies and browser storage
Sites uses authentication cookies. Firebase uses browser authentication storage, which may include IndexedDB, local storage or session storage, to maintain and refresh a sign-in. Authentication support can initialize when you open the application, including checking an existing session.
The application remembers your theme and selected sign-in method locally. Session storage can hold an unsaved preview handoff for up to a 30-minute validity window and a ChatGPT return reference for 15 minutes. These validity windows are checked when used; they are not background deletion timers. Closing the browser tab normally clears its session storage.
This storage supports sign-in, user-requested progress and your display preferences. We do not install advertising cookies or optional analytics cookies. You can sign out and clear site data through your browser; doing so does not delete a saved server-side workspace.
How long information is kept
Saved work, account profiles, source/history records and test ledgers are kept to provide your account and preserve the work and audit history you request. This release has no automatic account-inactivity purge or general timed-deletion job. Editing, revoking a source or suspending an account does not erase all historical records.
You can request deletion when you no longer need the service. We assess and handle verified requests under applicable law, including any narrowly necessary retention for security, legal obligations or claims. Expired rate-limit records are removed during later quota activity. Technical logs and backups are also subject to the relevant provider’s retention and deletion processes.
Firebase states that logged IP addresses are kept for a few weeks. Its other authentication information is retained until we delete the associated Firebase user, after which removal from Firebase live and backup systems can take up to 180 days. That provider period starts after our deletion action, not when you email a request; it does not mean every Smart Launcher record is removed on sign-out.
Your choices and rights
Contact hello@evolutivex.com to request access, correction, deletion, restriction or a portable copy of your personal information, or to object to processing based on legitimate interests. Rights depend on the circumstances and applicable law. You may withdraw any consent we rely on without affecting earlier lawful processing.
We may ask you to demonstrate control of the relevant account. Tell us which sign-in method you used; matching an email address alone is not sufficient to identify a private workspace. Account/deletion requests are handled manually; there is no self-service deletion button in this release.
The workspace export contains campaign/source and test records, but is not a complete personal-data access response: account-profile, authentication, quota, retry and provider records are handled separately. Revoking a Google or Microsoft connection does not necessarily end an existing Smart Launcher session immediately: an already-issued valid ID token can remain usable until it expires. Sign out and contact us if you need help securing access. Revocation does not by itself delete saved campaigns.
You can raise a concern with us or complain to the UK Information Commissioner’s Office, or another supervisory authority available to you. The service is intended for adults aged 18 or over. Contact us if you believe a child has supplied personal information.
We will update the date on this notice when it changes and provide further notice where a material change requires it.