Privacy policy

StartupDocs ("we", "us") operates the StartupDocs website and product. We are the data controller for the personal data described in this policy. For anything privacy related, contact [email protected].

We collect a deliberately small amount of data:

• Account details. When you create an account we store your email address, the name you give us, your company name and phone number if you provide them, whether your account was created in the founding member window, and the sign-in codes and sessions needed to run passwordless login (codes and session tokens are stored hashed).
• Your documents. The documents you create, import, or generate from templates, plus their folders and version history, are stored so you can work on them. Your documents are yours: we do not sell them, and we do not use them to train AI models. See "AI processing" below for how they are used to power edits and checks.
• Billing details. When you start a trial or subscribe, our payment processor collects and holds your card details; we do not see or store your full card number. We store your plan, billing period, trial dates, and the processor's customer and subscription identifiers.
• Waitlist details. If you joined the waitlist we store your email address, the page you signed up from, and the time you signed up.
• Usage analytics. We use PostHog to understand how the product is used: pages viewed, interactions such as creating an account or exporting a document, browser and device type, and approximate location derived from your IP address.
• Server logs. Our hosting provider keeps standard request logs, which include IP addresses, for security and reliability.

Editing and compliance-checking use AI models. When you ask the assistant to draft or change a document, or run a rulepack check, the document being worked on and your instruction are sent to third-party AI model providers (reached through our AI gateway) solely to produce the response you asked for. We do not use your documents or prompts to train AI models.

We are confirming the data-retention terms of each model provider we route to and will name them and their retention periods here once confirmed. If you handle especially sensitive material and want to understand exactly how it is processed before you upload it, email [email protected] first.

• To create and operate your account: sending sign-in codes to your email, keeping you signed in, and recording your founding member status. Legal basis: performance of a contract with you.
• To provide the product itself: storing your documents, generating and checking them with AI, and exporting them. Legal basis: performance of a contract with you.
• To take payment and manage your subscription, including trials. Legal basis: performance of a contract with you.
• To email you about your account, your trial, and important service notices. Legal basis: performance of a contract with you. Marketing emails are sent only with your consent, which you can withdraw at any time.
• To understand how the product is used so we can improve it. Legal basis: our legitimate interest in operating and improving the product.
• To keep the product secure and running. Legal basis: our legitimate interest in protecting our infrastructure.

We do not sell your data, and we do not use it for third party advertising.

We use a small number of service providers to run StartupDocs. Each acts as a processor on our behalf under data processing terms:

• Oracle hosts the servers where the database and document storage run, holding your account and documents.
• Stripe processes payments and holds your card details.
• OpenRouter and the AI model providers it routes to process the documents and instructions you send for AI editing and checking.
• Maileroo sends our transactional and account emails.
• PostHog processes analytics events. Our PostHog instance is hosted in the EU.
• Vercel hosts the application and keeps server logs.

Where a provider processes data outside the UK or EEA, transfers are protected by recognised safeguards such as the UK Addendum and EU Standard Contractual Clauses.

PostHog sets a first party cookie and uses browser storage to recognise returning visitors and tie analytics events together. We also use essential browser storage to keep you signed in. We do not use advertising cookies. You can block or clear cookies in your browser settings; sign-in requires the essential storage.

• Account and document data is kept for as long as your account exists. You can export your documents at any time, and delete them from the app. Expired sign-in codes and sessions are routinely deleted.
• Billing records are kept as long as required for accounting and tax purposes.
• Waitlist emails are kept until the launch communications they were collected for have finished, or until you ask us to remove you, whichever comes first.
• Analytics data is kept according to PostHog's standard retention.
• Server logs are kept for a short period by our hosting provider for security purposes.

Under UK GDPR and EU GDPR you have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to our processing of it, and to withdraw consent at any time. To exercise any of these rights, email [email protected]. We will respond within one month.

You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk).

If we change this policy we will update this page and the date at the top. If a change materially affects how we use your email or account data, we will tell you by email first.