Privacy Policy

What we collect

• Account details: your first and last name, e-mail address, country, password (stored only as a one-way hash, never in readable form), the roles you hold (founder, mentor, investor) and your profile details such as a photo, a short bio and links you add.
• Startup and journey data: everything you and your team enter in the platform, such as the startup description, team members, customer research, business model, plans, clients, unit economics, markets and the comments written on each step.
• Uploaded files: documents and images you upload, such as presentations, executive summaries, memoranda of understanding, letters of intent and pictures.
• Google sign-in: if you choose "Sign in with Google", Google shares your name, e-mail address and profile photo with us. We do not receive your Google password or access to anything else in your Google account.
• Messages to our team: what you write in a help request, with any file you attach.
• Technical data: the date and time you sign in and the records our hosting provider keeps of requests to the site (such as IP address and browser type), used for security and troubleshooting.

Why we use it

• To create and run your account, sign you in and keep you signed in.
• To provide the platform: store your startup and journey data, show it to the people you work with, and move your startup through the levels.
• To connect founders with mentors, investors and regional managers, within the visibility you choose.
• To send you the e-mails the service needs, such as address verification, password reset, invitations and notifications you have switched on.
• To answer your help requests.
• To keep the platform secure, prevent misuse and keep a record of administrative actions.

We use your data because it is necessary to provide the service you signed up for, and for our legitimate interest in keeping the platform safe and working. Where we rely on your consent, such as for optional notifications, you can withdraw it in Settings at any time.

Who can see your startup

Your startup is private by default. Its data is visible to its active team members, to mentors you invite and who accept, to the Startup Mastery team, and to regional managers of the region your program belongs to or who were granted access by an administrator. You can see which regional managers have access in Settings. Investors and the public see your startup only if you change its visibility, and only as much as that setting allows.

Who processes it for us

We use a small number of service providers who process personal data only on our instructions and only to run the platform:

• Hosting: Vercel Inc. runs the website and the application servers.
• Database: Neon (Databricks, Inc.) stores the platform database.
• File storage: a cloud storage provider stores the files you upload, with access limited to the people allowed to see them.
• E-mail delivery: an e-mail delivery provider sends the messages the service needs.
• Sign-in: Google, only if you choose to sign in with Google.
• Maps: the "Where we are" map loads map images from OpenStreetMap servers, which receive your IP address as part of that request.

International transfers

Some of these providers store or process data outside your country, including in the United States and the European Union. Where the law requires it, these transfers are covered by the safeguards the providers offer, such as the European Commission standard contractual clauses.

We do not sell your data

We do not sell, rent or trade your personal data, and we do not use it for advertising. We share it only as described in this policy, or when the law requires us to.

How long we keep it

• Account, startup and journey data and uploaded files: for as long as your account is active.
• When you ask us to delete your account: we delete or anonymise your personal data within 30 days. Records of administrative actions keep the event but no longer name you.
• Sign-in sessions end after 30 days, or earlier when you sign out.
• Backups held by our database provider are overwritten in the normal course, within 30 days.
• Data we must keep by law is kept for the period the law sets, and then deleted.

Your rights

You have the right to access the personal data we hold about you, to correct it, to have it deleted, to receive a copy in a portable form, to object to or restrict how we use it, and to withdraw any consent you gave. You can correct most of your data yourself in your profile and settings. For anything else, write to igor@startup-mastery.com; we answer within 30 days. You also have the right to complain to the data protection authority where you live.

Cookies

We use cookies only to sign you in and keep you signed in. While you are signed in, two more cookies remember which role and which startup you were working in. Signing in with Google sets two short-lived cookies that protect the sign-in and expire after ten minutes. We do not use advertising or analytics cookies, and no cookie is used to track you on other sites. Because these cookies are needed for the service to work, they do not need your consent.

Security

Passwords are stored as one-way hashes, connections to the platform are encrypted, sessions are stored hashed, and private files are served only to signed-in people who are allowed to see them. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Children

The platform is meant for adults building companies. You must be at least 18 years old to create an account, and we do not knowingly collect data from children.

Changes to this policy

If we change this policy, we publish the new version on this page with a new date. If a change is significant, we tell signed-in users in the platform or by e-mail before it takes effect.

Contact

Questions or requests about your data: Startup Mastery, igor@startup-mastery.com.