Privacy policy
Last updated:
Who we are
Sell a Pen is a text-based coach for founders writing their own cold outreach. It is run by Sparkeit SRL, VAT number RO49625010, registered in Romania. We are the data controller for the data below. Email contact@sellapen.com about any of it. It is a business tool, not for anyone under 16.
What we collect, why, and on what basis
Six things, and nothing else. We do not sell personal data, share it with advertisers, or build advertising profiles. Nothing here runs on consent today. If that changes we will ask first, and you can withdraw consent at any time.
| What we collect | Why | Lawful basis |
|---|---|---|
| Account data: your name and email. Clerk runs sign-in and holds the credentials themselves. | Creating your account, signing you in, contacting you about the service | Our contract with you |
| Billing data: subscription status and your Stripe identifier. Card numbers go to Stripe and never reach our servers. | Taking payment, renewals and cancellations, tax records | Our contract, and a legal obligation for the tax records |
| Business context: what you sell, who to, pricing, differentiators, competitors, and any website address you give us. | Generating personas and feedback grounded in what you sell | Our contract with you |
| Sessions and the messages you submit, with their scores and feedback. Most likely to hold somebody else’s name, so read where your text goes too. | Producing the coaching, tracking the weak spots it works on next | Our contract with you |
| Server logs: IP address, browser, page requested, timestamp. | Keeping the service up, debugging, blocking abuse | Legitimate interest in a secure, working service. Logs are short-lived and never used to profile you. |
| Usage analytics: the pages you open, where you arrived from, how long you stay, your browser, operating system and language, and the country and city worked out from your IP address, which is not stored. | Seeing which pages get read and where people give up | Legitimate interest in knowing whether the site works. No cookies, and a repeat visit is recognised only by a hash whose salt changes daily, so it cannot be tied to you tomorrow or joined to your account. |
Who processes it for us
Each subprocessor is bound by a data processing agreement and may only use your data to provide its service to us. We also disclose data where the law requires it, such as a valid court or regulator order.
| Subprocessor | What it does | What it can see |
|---|---|---|
| Vercel | Hosting, and routing our requests to the AI model | Requests to the site, including server logs, and the text passed through it on its way to the model |
| Clerk | Accounts and authentication | Your name, email and credentials |
| Stripe | Payments | Your email, payment details and billing history |
| Anthropic | The AI behind the roleplay and the feedback | Your business context and coaching text. No Sell a Pen account or user identifier goes with it, though any names you leave in the message itself travel with the text, which is why where your text goes suggests redacting them |
| Neon | The database | All stored account, context and session data |
| Vemetric | Website analytics | Which pages are opened and the technical details of the request, on servers in the EU. No account identifier, no session text, and no stored IP address |
Transfers, and how long we keep it
Some of these providers sit outside the European Economic Area, mainly in the United States. Those transfers run on the safeguards in the provider’s data processing agreement: standard contractual clauses, or the EU-US Data Privacy Framework where a provider is certified. Ask and we will send you the ones covering a specific provider.
Account data, business context and sessions stay while your account is open. Delete your account and they leave the live database at once, and encrypted backups within 30 days. Billing and tax records last as long as tax law in Romania requires. Logs are kept briefly, then discarded.
Your rights
Under the GDPR you can ask us for a copy of your data (access), for corrections (rectification), for deletion (erasure), for a machine-readable export or transfer (portability), for a pause while a dispute is resolved (restriction), or for an end to processing based on legitimate interests (objection). Email contact@sellapen.com and we answer within a month. Email is the route that always works, whatever the app does or does not yet let you do for yourself. You can also complain to the supervisory authority in Romania or in the EU country where you live or work, without asking us first.
Cookies
No tracking cookies and no advertising cookies. The analytics is Vemetric, which runs without cookies: it recognises a repeat visit through a hash built on a salt that changes every day, and it keeps a country and city rather than your IP address. The only cookies here are what Clerk needs to keep you signed in and protect the sign-in flow. They are strictly necessary for a service you asked for, which is why no consent banner is in your way.
Changes, and how to reach us
When this policy changes we update the date at the top, and we email you before a change that materially affects how we handle your data. To reach Sparkeit SRL about any of it, email contact@sellapen.com. That is the one address we answer on.