Privacy Policy

Data Controller Information

StartupSeeker
Website: https://startup-seeker.com
Contact: hendrik@startup-seeker.com

StartupSeeker operates as a data controller for the personal information collected through our website and services.

What Personal Information We Collect

Information You Provide Directly

• Contact Forms: Name, email address, message content, and subject when you contact us
• Account Registration: Email address and any profile information you provide when creating an account
• API Usage: API keys and usage patterns when you access our API services
• Uploaded Content: Documents and files you upload for analysis (pitch decks, company documents)

Information Collected Automatically

• Analytics after acceptance: Google Analytics processes page URLs, referrers, device/browser information, and usage events after you accept analytics
• When analytics is declined: The browser sends only a broad page_group value to our first-party /api/analytics/aggregate-page-views endpoint. It sends no URL/query, referrer, cookie, client/session ID, account/auth ID, or fingerprint. The application does not read, retain, or use the request IP address or user agent for analytics.
• Cookies and Tracking: Cookie preferences and consent choices stored on your device
• Search Queries: Search terms and filters; when you are logged in we associate searches with your account to improve relevance, prevent abuse, and debug issues
• API Requests: Rate limiting data and API usage patterns

Information from Third Parties

We may receive information from third-party services we integrate with, such as Supabase for user accounts and Vercel for website hosting.

We also collect publicly available company and professional information from websites and data providers. This may include names, public profile URLs, job titles, employment and education history, company affiliations, and source material used to verify startup founders and company facts.

How We Use Your Information

Legal Basis for Processing (GDPR)

We process your personal information based on the following legal grounds:

• Consent: When you provide explicit consent for specific processing activities
• Contract: To provide our services and fulfill our contractual obligations
• Legitimate Interest: To improve our services, ensure security, and communicate with you
• Legal Obligation: To comply with applicable laws and regulations

Purpose of Processing

• Provide and improve our startup search and analysis services
• Create, verify, and update company and founder profiles from public sources
• Respond to your inquiries and provide customer support
• Analyze usage patterns to improve user experience
• Provide account-linked search history and diagnostics for logged-in users
• Ensure security and prevent fraud
• Comply with legal obligations
• Send service-related communications

Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following circumstances:

• Service Providers: With trusted third-party service providers who assist us in operating our website and services (Supabase, Vercel, OpenAI, etc.)
• Legal Requirements: When required by law, court order, or government request
• Business Protection: To protect our rights, property, or safety, or that of our users
• Business Transfers: In connection with a merger, acquisition, or sale of assets

International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for international transfers, including:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions by relevant data protection authorities
• Certification schemes and codes of conduct

Data Retention

We retain your personal information for the following periods:

• Contact Information: 2 years after last contact or until you request deletion
• Account Data: For the duration of your account plus 30 days after deletion
• Analytics Data: Up to 26 months for Google Analytics data
• Declined Aggregate Counts: Broad daily page-group counts are retained in Supabase for at most 90 days
• API Usage Logs: 90 days for security and rate limiting purposes
• Raw Professional Profile Responses: Successful raw responses obtained from professional-data providers are stored privately for up to 90 days for verification, audit, replay, and service quality, then deleted through automated retention controls
• Search Logs: Unified search queries linked to your account are retained for up to 12 months for quality, abuse prevention, and auditability
• Uploaded Content: Indefinitely until you delete it, and accessible only by you during your account's active period

We regularly review and delete data that is no longer needed for the purposes for which it was collected.

Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights:

• Access: Request a copy of your personal information
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your personal information
• Restriction: Request limitation of processing
• Portability: Request transfer of your data in a structured format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at hendrik@startup-seeker.com. If your request concerns a public professional profile, please include the relevant profile URL so we can locate, correct, or delete the associated records.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following additional rights:

• Know: Request information about what personal information we collect, use, and disclose
• Delete: Request deletion of your personal information
• Correct: Request correction of inaccurate personal information
• Opt-Out: Opt-out of the sale or sharing of personal information
• Non-Discrimination: Protection from discrimination for exercising these rights

We do not sell personal information as defined by CCPA. To exercise these rights, contact us at hendrik@startup-seeker.com.

Cookies and Tracking Technologies

Essential Cookies

• Session Cookies: Required for website functionality and security
• Consent Cookies: Remember your cookie preferences

Analytics Choice

• Accept: Enables Google Analytics measurement. Google processes the analytics fields described above, and StartupSeeker retains Google Analytics data for up to 26 months.
• Decline: StartupSeeker, hosted on Vercel, processes one page_group field through /api/analytics/aggregate-page-views to understand which broad product areas are used. Supabase stores only UTC bucket date, page group, aggregate view count, and last-updated time for at most 90 days. No analytics cookie or local-storage client ID, account/auth ID, full URL/query, referrer, fingerprint, session/cross-session identifier, raw IP address, or user agent is stored or used by application telemetry.

Managing Cookies

You can reset your analytics choice by clearing StartupSeeker's site data in your browser. Declining analytics does not disable core website functionality.

AI and Automated Processing

We use artificial intelligence and automated processing for:

• Semantic search and relevance ranking
• Company analysis and competitor identification
• Content processing and summarization
• Document analysis and insights generation

AI-generated content may contain inaccuracies. We recommend verifying important information through multiple sources. We do not use automated decision-making that significantly affects your rights.

Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security assessments and updates
• Secure data hosting with trusted providers

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Third-Party Services

We use the following third-party services that may collect information:

• Supabase: Database and user authentication services
• Google Analytics: Website analytics and performance monitoring
• Vercel: Website hosting
• OpenAI/Anthropic: AI processing services
• HarvestAPI: Public professional and company data used for founder discovery and verification
• Zilliz: Vector database for search functionality
• Resend: Email delivery service

Each service provider has its own privacy policy governing how they handle data. We recommend reviewing their policies for more information.

Children's Privacy

Our services are not intended for children under 16 (or under 13 in certain jurisdictions like the US). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete such information promptly.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Posting the updated policy on our website
• Sending an email notification (if you have an account)
• Providing a prominent notice on our website

Your continued use of our services after changes take effect constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Email: hendrik@startup-seeker.com
Website: https://startup-seeker.com/contact