TANFUST
> LegalPrivacy PolicyLast updated MMXXVI

Privacy.

Last updated: May 22, 2026

Tanfust ("we," "us," or "our") operates the Tanfust marketplace at tanfust.com. We sell digital products for builders — boilerplates, components, templates, prompts, SOPs, and integrations. This Privacy Policy explains what we collect, how we use it, and the choices you have.

We don't sell, rent, or trade your personal data. We collect the minimum we need to run the marketplace, deliver what you've bought, and keep things working.

Definitions

For the purposes of this Privacy Policy:

  • Company ("Tanfust," "we," "us," or "our") refers to Tanfust, the operator of the Tanfust marketplace.
  • Service refers to the Tanfust website and the digital products available at tanfust.com.
  • Personal Data is any information that relates to an identified or identifiable individual.
  • Usage Data refers to data collected automatically about how you use our Service.
  • Account means a unique account created for purchasing and accessing digital products.
  • Product means any digital asset (boilerplate, component, template, prompt, SOP, integration, or similar) sold through the Service.

What We Collect

Account Information

When you create an account or check out, we collect:

  • Email address
  • Display name (optional)
  • Authentication identifiers (if you sign in with Google or GitHub via OAuth)
  • Purchase history and product entitlements

We use Supabase for authentication. We do not store passwords for OAuth providers.

Payment Information

All purchases on Tanfust are sold and processed by Paddle.com Market Limited (and its affiliates, collectively "Paddle"), which acts as the Merchant of Record for these transactions. Paddle — not Tanfust — is the seller of record. Paddle handles billing, payment processing, sales tax and VAT collection, invoicing, and chargebacks.

Paddle may collect:

  • Name and billing address
  • Payment method details (handled securely by Paddle and its sub-processors)
  • Transaction data (amount, currency, timestamp)
  • Device, browser, and IP information for fraud prevention and tax determination

Paddle is an independent data controller for this payment data. See Paddle's Privacy Policy for details.

From Paddle, Tanfust receives only:

  • Order status (paid, refunded, chargeback)
  • Paddle customer and order identifiers
  • Billing email

We do not store credit card numbers or any sensitive payment details.

Usage Data

We automatically collect limited usage data to improve the Service:

  • Browser type and version
  • Device type and operating system
  • Pages visited and time spent
  • Referring website
  • General location (country/region level only)

We use Vercel Analytics, a cookieless, privacy-friendly analytics service that does not track users across sites.

Content You Submit

If you contact support, leave a comment, or submit feedback, we receive whatever you choose to send (subject line, message body, attachments).

How We Use Your Data

We use your information only for:

  • Service Delivery: giving you access to products you've purchased
  • Account Management: authentication, license validation, download history
  • Customer Support: responding to your questions and refund requests
  • Service Improvement: understanding how the marketplace is used so we can make it better
  • Security: detecting and preventing abuse, fraud, and security issues
  • Legal Compliance: meeting our legal obligations

We do not use your data for:

  • Marketing emails (unless you explicitly opt in)
  • Selling or sharing with third parties for their marketing
  • Cross-site tracking
  • Advertising profiles

Cookies and Tracking

We use minimal cookies:

  • Essential Cookies: required for the Service to function (authentication, session, cart)
  • Analytics: Vercel Analytics is cookieless and sets no analytics cookies

We do not use advertising cookies, cross-site tracking cookies, or social media tracking pixels.

You can disable cookies in your browser settings, but some features (sign-in, checkout) may not work.

Data Security

We implement industry-standard security measures:

  • All data transmitted over HTTPS
  • OAuth-based authentication (no passwords stored by Tanfust)
  • Row-Level Security (RLS) on all database tables
  • Regular security reviews and updates
  • Limited internal access to stored data
  • No storage of payment card information (handled by Paddle)

No method of transmission or storage is 100% secure, but we take it seriously.

Data Retention

  • Account Data: retained while your account is active; deleted within 30 days of account deletion (except records we must keep for legal or accounting reasons)
  • Purchase Records: retained as required for tax and accounting law (typically 7–10 years), via Paddle
  • Usage Analytics: aggregated data retained for up to 24 months
  • Server Logs: retained for up to 90 days for security purposes

Your Rights

Depending on your location, you may have rights including:

  • Access: request a copy of your data
  • Correction: update inaccurate information
  • Deletion: request deletion of your data
  • Portability: receive your data in a portable format
  • Objection: object to certain processing of your data
  • Withdrawal: withdraw consent at any time

To exercise these rights, contact us at contact@wassimbenr.com.

Third-Party Services

We use select third-party services that may process data:

ServicePurposePrivacy Policy
PaddleMerchant of Record — billing, payment processing, sales tax/VAT, invoicing, fraud preventionpaddle.com/legal/privacy
SupabaseAuthentication and account storagesupabase.com/privacy
VercelWebsite hosting and infrastructurevercel.com/legal/privacy-policy
Vercel AnalyticsCookieless usage analyticsvercel.com/legal/privacy-policy
ResendTransactional email deliveryresend.com/legal/privacy-policy
Google / GitHubOAuth authentication (optional)See respective privacy policies

We vet third parties and require they meet reasonable privacy standards.

International Data Transfers

Tanfust is hosted on Vercel's global infrastructure. If you access our Service from outside the United States or the European Union, your account data may be transferred internationally. We rely on appropriate safeguards (Standard Contractual Clauses, or equivalent) for international transfers where required.

Children's Privacy

Tanfust is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

  • Posting the new policy on this page
  • Updating the "Last updated" date
  • Emailing you (if you have an account and the change is material)

GDPR (EU Users)

If you are in the European Union, we comply with GDPR requirements:

  • We process data lawfully, fairly, and transparently
  • We collect data only for specified, explicit purposes
  • We minimize collection to what's necessary
  • We keep data accurate and up to date
  • We retain data only as long as necessary
  • We implement appropriate security measures

Our legal basis is typically (a) contract performance — delivering the product you bought; (b) legitimate interest — running and securing the marketplace; or (c) consent — where you've opted in.

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights:

  • Right to know what personal data is collected
  • Right to know if personal data is sold or disclosed
  • Right to opt out of sale of personal data
  • Right to deletion of personal data
  • Right to non-discrimination

Tanfust does not sell personal data.

Contact Us

For any privacy-related questions, concerns, or requests:

Tanfust

We will respond to all requests within 30 days.

Tanfust is committed to transparency. We only collect what we need to run the marketplace, deliver the products you buy, and keep things working. If you have questions, reach out.