Privacy policy

Startupappsinc, trading as Startupapps, is the controller of the personal data described here.

When you send an inquiry. Your name, email address, and — if you choose to give them — your phone number and company. Whatever you write in the message. We also record which opportunity the inquiry came from, so we can reply about the right thing.

Technical data with an inquiry. Your IP address and browser user-agent string, recorded at the moment you submit. This exists to rate-limit the form and detect automated abuse. It is not used to profile you, build an advertising audience, or track you across other sites.

If you become a client. An account with your name and email address, and a password you set yourself through an invitation link. We store passwords only as a cryptographic hash, so we cannot read yours. We also keep the billing email address for your company.

While your project runs. The project record, its status history, your invoices and their payment references, the messages exchanged on the project thread, a log of the emails we sent you, and a log of administrative actions taken on your account — including the IP address of whoever took them.

• To take steps at your request before entering a contract, and then to perform that contract — this covers inquiries, your account, your project and your invoices.
• For our legitimate interests in running the business securely — this covers rate-limiting data, the email log and the administrative audit log, all of which exist so we can show what happened if it is ever disputed.
• To comply with legal obligations, such as keeping financial records for the period the law requires.

We do not sell personal data, and we do not share it for anyone else's marketing. We use a small number of service providers to run the site, and they process data only on our instructions:

• Google Cloud Platform — hosting and the database in which all of the above is stored.
• Resend — delivery of transactional email such as inquiry acknowledgements, invitations, invoice notices and project updates.
• Google — only if you choose to sign in with a Google account, in which case Google tells us your name and email address.

These providers may store data outside your country. Where that happens we rely on the transfer safeguards those providers have in place. We may also disclose data where the law requires it, or to establish or defend a legal claim.

• Inquiries that do not become engagements: kept while there is a realistic prospect of a conversation, and reviewed periodically thereafter.
• Client accounts, projects, project messages and the status history: kept for the life of the engagement and afterwards as the record of what was delivered.
• Invoices and payment references: kept for as long as financial-record and tax law requires.
• The email log and the administrative audit log: kept alongside the project they relate to, because they are the evidence of what was sent and what was changed.
• Rate-limiting records: pruned automatically after seven days.
• Expired login, invitation and password-reset tokens: deleted automatically, because nothing can redeem them and keeping them serves no purpose.

We set a session cookie when you sign in, which is what keeps you signed in. It is strictly necessary for the dashboard to function. We do not use advertising cookies, analytics cookies, or third-party trackers on this site.

Depending on where you live, you may have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. You can also complain to your local data-protection authority.

Some of it we may have to keep — invoices and the records that show what was delivered have their own retention obligations, and deleting them would remove the evidence that protects both of us in a dispute. We will tell you if that applies and explain why.

To make a request, use the contact form or write to hello@startupapps.shop. We will respond within one month.

Passwords are stored hashed, never in readable form. Access to client data is role-based, and every project is scoped so one client's data cannot be reached from another's account. Administrative actions are logged. No system is perfectly secure, but if a breach affects your data and the law requires us to tell you, we will.

This site sells commercial software builds and is not directed at children. We do not knowingly collect data from anyone under 18.

If this policy changes materially we will update the date at the top and, where the change affects you, tell you directly.