Privacy Policy

1. Who We Are

StartupAI LLC ("we," "us," or "our") is a Florida limited liability company that operates the website at startupai.site and the product application at app.startupai.site. This policy describes how we collect, use, and protect your personal data. As a US-based company, we do not currently have an EU representative appointed under GDPR Article 27. If you are an EU resident with data protection questions, please contact us directly using the details below.

For questions about this policy or to exercise your data rights, contact us.

2. Data We Collect

Account data

When you sign up, we collect your name, email address, and authentication credentials. If you sign up with a third-party provider (e.g., Google), we receive your name and email from that provider.

Project data

When you use StartupAI, you provide information about your startup idea, market hypotheses, customer profiles, and validation evidence. This data is stored in our database and processed by our automated validation systems to generate structured analysis.

Usage data

We collect analytics data including page views, feature usage, and session information through PostHog. This helps us understand how the product is used and improve it.

Contact and waitlist data

If you submit the contact form or join our waitlist, we collect your name, email, and any message you provide. Contact form submissions are processed through Formspree.

3. How We Use Your Data and Legal Basis

Under GDPR Article 6, each processing activity requires a lawful basis. We process your data as follows:

• Provide and operate the platform— legal basis: contract performance (necessary to deliver the service you signed up for)
• Process startup data through our automated validation systems — legal basis: contract performance
• Send account-related communications— legal basis: contract performance and legitimate interests (keeping you informed about your account)
• Respond to support requests — legal basis: contract performance
• Product analytics via PostHog — legal basis: consent for non-essential analytics cookies where required and legitimate interests where permitted (understanding product usage to improve the service). You may change your choice in Cookie settings in the footer.
• Prevent fraud and abuse — legal basis: legitimate interests

We do not sell your personal data. We do not use your project data to train AI models. Your startup ideas and validation data remain yours.

4. Data Sharing

We share data only with the following service providers, each operating under a data processing agreement:

• Supabase— database hosting
• Netlify— website hosting and serverless functions
• Modal— AI processing infrastructure
• OpenAI and OpenRouter— AI model processing and routing. We use provider retention controls where supported; provider-controlled payloads and metadata remain subject to each provider's documented retention obligations.
• PostHog— product analytics
• Langfuse— AI runtime telemetry
• Formspree— contact form processing
• Resend— transactional email delivery
• Stripe— payment processing (we do not store credit card numbers)

We may also disclose data if required by law or to protect our legal rights.

5. Data Retention

We retain your account and project data for as long as your account is active, subject to the provider and legal obligations described below.

Analytics retention depends on consent, the deletion controls below, and the configured provider retention period. We do not describe identified provider events as aggregated or anonymized while they still contain an account-linked identifier.

Account closure and active-system deletion

Eligible non-admin users may initiate strongly confirmed account deletion from the Profile settings page. When a request is accepted, account authority ends immediately and the accepted deletion cannot be reversed. StartupAI-controlled active-system data is deleted or anonymized within 24 hours: private records are deleted and shared records are de-identified without removing another person's data.

Processor-controlled copies follow their documented retention or expiry periods when immediate deletion through a supported interface is unavailable. Analytics deletion may take up to 7 days; isolated backups and certain email, hosting, AI, telemetry, and runtime records generally expire within 30 days. Stripe may retain regulated payment and transaction records longer where financial, fraud-prevention, or other legal obligations require it. We do not describe those provider-controlled records as deleted by StartupAI.

PostHog's deletion interface covers analytics events received before the deletion request; a later event from another already-open browser follows the configured provider retention period, which may be up to seven years. The browser that confirms deletion is reset and opted out before redirect so it cannot continue identified capture.

A legal hold retains only the records specifically approved for that hold and only for as long as the applicable obligation requires. A scoped legal hold does not restore account access or restart billing, and it does not preserve unrelated profile or project data.

Isolated backups expire under their configured retention period. We retain only a keyed, non-reversible deletion fingerprint for the backup-retention period plus 30 days. A restored environment stays inaccessible until matching deletions are replayed and verified; a restoration cannot reactivate the deleted account or its billing.

6. Your Rights

Depending on your location, you may have the following rights under applicable data protection laws (including GDPR and CCPA):

• Access— request a copy of the data we hold about you
• Correction— request correction of inaccurate data
• Deletion— request deletion of your data
• Portability— request your data in a machine-readable format
• Objection— object to processing based on legitimate interests
• Restriction— request restriction of processing

Export, manual requests, and automated deletion

Before accepting irreversible self-deletion, use Export your data or submit a manual privacy request. The export and manually reviewed erasure-request routes remain available under Support → Privacy and are separate from automated self-deletion. If you cannot access the product application, you may also contact us. We will respond to rights requests within 30 days.

7. Cookies

We use essential cookies for authentication and session management, which are necessary for the service to function. PostHog uses first-party cookies for analytics; these are non-essential and load only after you click Accept in the cookie banner. If you click Decline, PostHog stays off on later visits unless stored site data is cleared. You can change your choice at any time from Cookie settings in the footer. We do not use third-party advertising cookies.

8. Security

We use industry-standard security measures including encrypted data transmission (TLS), encrypted data at rest, and role-based access controls. However, no system is perfectly secure, and we cannot guarantee absolute security.

9. Children

StartupAI is not directed at children under 16. We do not knowingly collect data from children under 16 (the digital consent age under GDPR) or under 13 (the age threshold under the US Children's Online Privacy Protection Act, COPPA). If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes

We may update this policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "last updated" date. For changes that materially affect how we process your personal data, we will seek your active consent where required by GDPR, rather than relying on continued use of the service.

11. Contact

For questions about this privacy policy or your data, contact us.