Privacy Policy
Pageloa is built so that the websites you capture stay on your computer. This policy explains the limited data we do collect to run your account, plan and credits, why we collect it, and how we handle it.
01 Who is responsible
Pageloa is a software product developed and operated by Ibdaion, an independent digital design and software development business based in Egypt. Ibdaion is responsible for the personal data described in this policy. For any privacy question or request, contact hello@ibdaion.com.
For payments, Paddle is an independent controller of the payment data it collects as Merchant of Record; see Paddle's privacy notice.
02 What stays on your computer
Capturing a website happens in your browser. The page content, styles, images, screenshots and motion the Chrome extension captures go to the Figma plugin through your computer's clipboard. They are not sent to Pageloa's servers. The Figma plugin connects only to pageloa.com, to sign in and read your plan and credits; it does not send your Figma files anywhere.
To capture, the extension reads the tab you choose and loads that website's images and, for Full Website capture, its other pages and sitemap, directly from the website in your browser, as visiting it would. It asks with Chrome's own prompt before it can load content from other websites (for example images hosted elsewhere, motion or Full Website capture).
What does leave your device: to count credits, the extension sends our server a fingerprint for each page and width (see "What we collect"), an operation id and which Pro features the capture uses. It does not send the page address, the page content or screenshots.
03 What we collect
- Account: your email address; your name if you sign in with Google; your Google account identifier if you connect Google; your password only as a one-way scrypt hash, never the password itself.
- Email links: for each verification, sign-in or password-reset link we send, the address it was sent to, a hash of the link, and when it was created, expires and was used. For a new account waiting for verification, the password hash is kept with it.
- Sign-in and devices: for each signed-in browser or app, a short description from the browser (such as "Chrome on macOS"), how you signed in, and when it was created and last used. Session and app tokens are stored only as hashes.
- Security activity: sign-ins, password and sign-in method changes, devices signed out, and billing events, with their date.
- Usage: for each monthly period, how many credits you used; for each capture, a SHA-256 fingerprint of the page address and width, an operation id, and which Pro features the capture asked for. We never receive the address itself; a fingerprint can only be matched to an address by someone who already knows that exact address.
- Billing: your plan, subscription status and dates, and Paddle's identifiers for your customer record, subscription and payments.
- Free trial without an account (Chrome extension): a trial record without email, with its token (stored as a hash) and credit count. When you sign in, the trial moves into your account.
- Abuse protection: a one-way hash of your network address, used for rate limits and deleted after about a day.
- Support: the messages you send us and our replies.
We do not use advertising or analytics trackers, and we do not sell personal data.
04 Payments
Paddle is the Merchant of Record for Pageloa purchases. When you buy Pro, you enter your payment details in Paddle's checkout. Paddle collects and processes them, with your billing country and any tax details, as an independent controller under Paddle's privacy notice. We do not receive or store your card number or bank details.
From Paddle we receive what we need to give you access: your Paddle customer and subscription identifiers, your plan and billing interval, subscription status and renewal dates, and payment, refund and chargeback events. The Billing page shows your payments and invoices by requesting them from Paddle for your account.
05 Why we use it
- To provide Pageloa: your account, sign-in, connected apps, plan, features and credits (to perform our agreement with you).
- To count usage credits fairly and apply plan limits.
- To manage subscriptions with Paddle and keep billing records (our agreement with you and legal obligations).
- To keep accounts safe and prevent fraud and abuse: security notices, detecting misuse, rate limits (our legitimate interest in a secure service).
- To send service emails, such as verification, sign-in and password-reset links and security notices, and to answer support requests. We do not send marketing email without your consent.
06 Service providers
- Vercel: hosts the website and the account service.
- Neon: hosts the database (on Amazon Web Services in the United States).
- Resend: sends our emails.
- Google: only if you choose to sign in with Google.
- Paddle: checkout, payments, tax, invoices and the customer portal, as Merchant of Record.
We share with each provider only what it needs to do its job. We may also disclose information when the law requires it, or where it is necessary to protect our users, the service or our rights.
07 International processing
We are based in Egypt, and our providers process data in other countries, including the United States. This means your data may be processed outside the country where you live. Where the law requires it, we rely on our providers' contractual and technical safeguards for these transfers.
09 How long we keep it
- Account data is kept while your account exists.
- Website sessions end after 30 days at most, or 7 days without use. App sign-ins end after 90 days without use and after one year at most. Email links expire 15 minutes after they are sent.
- When you delete your account, we delete it together with its sessions, connected sign-ins, usage records and subscription records.
- Some records are not deleted automatically: security log entries (kept with the link to your account removed, but they can include Paddle subscription and payment identifiers), records of the email links we sent, including the address, and records of the payment notifications Paddle sent us. To have these removed, write to hello@ibdaion.com; we will delete what we are not required to keep.
- Paddle keeps the payment records it must keep by law as Merchant of Record.
10 Your choices and rights
In your account you can see your devices and security activity, sign out devices, change your sign-in methods and delete your account yourself. Depending on where you live, you may also have the right to ask us to access, correct, export or delete your data, or to object to or restrict how we use it. Write to hello@ibdaion.com; we may need to confirm it is you before acting on a request. You can also complain to your data protection authority.
11 Security
Pageloa uses HTTPS, stores passwords and tokens only as hashes, limits sign-in attempts, asks you to confirm it is you before sensitive changes, and emails you when your sign-in methods change. No system is perfectly secure; if you find a problem, tell us at hello@ibdaion.com.
12 Children
Pageloa is not intended for children. You must be old enough to agree to our Terms of Service where you live.
13 Changes and contact
If we change this policy in an important way, we will tell you by email or in your account. The "Last updated" date at the top shows the current version. For any question about privacy at Pageloa, write to hello@ibdaion.com.