Privacy Policy

1. Who is responsible for your data

The data controller is MB Startai, a Lithuanian small partnership, company code 306433627, registered address Plytų g. 12-19, LT-00132 Palanga, Lithuania.

Contact for privacy questions: hello@starta.so

2. What personal data we collect

2.1 If you're a founder (create an account)

• Your email address (via account sign-up).
• Everything you enter about your project: name, one-line description, category, stage, website, description, target market, country, user count, revenue, growth trend, team size, founder background (free text — please do not include sensitive personal data about yourself or others here unless necessary), fundraising status, and valuation.
• We do not currently collect a separate founder name field, or accept file uploads (e.g. pitch decks) — only text you type.

2.2 If you're an investor

• If you contact us via the "Contact us" form: your name, email, fund name, and message.
• If you purchase a disclosure (€99): only the email address Stripe collects at checkout. Purchasing a disclosure does not require, or create, an account.
• If you join the angels digest (email list): see Section 8 for exactly what we collect.

2.3 Payment data

STARTA does not store your card details. Payments are processed entirely by Stripe on Stripe's own hosted checkout page. We store only the payment amount, currency, status, and Stripe's own reference IDs for the transaction.

3. How we use your data

• To generate your STARTA Score assessment.
• To generate and issue your certificate.
• To operate the Marketplace (anonymized listing) and, if you request it, the investor disclosure flow.
• To process payments and refunds.
• To respond to inquiries.
• To email anonymized startups that match their criteria to people who joined and confirmed, and to honor unsubscribes (Section 8).

4. What we send to third parties

The STARTA website uses no advertising trackers. Apart from the analytics you can choose to accept (Section 4.1), the only tracking we do is of the digest emails themselves, described in Section 8. STARTA sets no cookies of its own beyond a standard, first-party authentication session cookie (via Supabase) needed to keep you logged in. Joining the angels digest sets no cookie. Stripe's own checkout page sets its own cookies on Stripe's domain during payment, governed by Stripe's privacy policy.

We use Google Analytics 4 to understand which pages are useful. It is off by default: before you choose, nothing is requested from Google and no analytics cookie is set. It starts only if you click Accept analytics in the cookie banner. Reject keeps it off. Your choice is saved in your browser (local storage, not a cookie) so we do not ask on every page.

• What it collects, if you accept: the page address (path only; we remove query strings), the page title, the referring page (path only), your approximate location derived from your IP address (IP addresses are anonymized and not logged by Google Analytics 4), device, browser and language, and a random identifier kept in two first-party cookies (_ga and _ga_ followed by our container ID).
• Events we record: starting and submitting the investor sign-up form (never what you typed), opening a public listing (its category only), clicking "Get your Score", starting a checkout, and a completed purchase of the certificate. For checkout and purchase we send only the amount and currency, and report them at a fixed page name ("/checkout") instead of the real address. No email address, name, project or account identifier, or payment detail is ever sent.
• What we never measure: private or token pages (unsubscribe and confirmation links, digest redirect links, admin, dashboard, log in, sign up and checkout pages): no page views or other events are recorded there. The only exception is the checkout and purchase amount described above. Google Signals, ad personalization and advertising storage are switched off, and advertising consent is always denied.
• Legal basis: your consent (GDPR Art. 6(1)(a) and the ePrivacy rules on cookies).
• Retention: Google Analytics 4 event data is kept for 2 months and then deleted automatically; only aggregated reports without personal identifiers may be kept longer.
• Processor and transfers: Google acts as our processor (Google Ireland Limited for visitors in the EEA, with Google LLC in the United States) under Google's Data Processing Terms. Transfers outside the EEA are covered by Standard Contractual Clauses and Google's EU-U.S. Data Privacy Framework certification.
• Withdrawing consent: use Cookie settings in the footer of any page and choose Reject. We then stop collection and delete the analytics cookies we set. Withdrawing does not affect anything collected before. You can also clear this site's data in your browser.

5. Where your data is stored

Our database is hosted by Supabase in Frankfurt, Germany (EU). Your data does not leave the European Union as part of our standard hosting. The one exception is the email delivery provider named in Section 4, which processes your email address to send the angels digest; its location and any transfer safeguards are stated in that table row.

6. Marketplace anonymization

If you submit your project to the Marketplace, we generate an anonymized public listing that structurally excludes identifying details (your project's real name, website, and other identifying fields are not shown), with an additional automated check for details that might still identify you. The only geographic detail on a listing is a broad region(for example "Baltics") derived from the country you chose; your country and city are never shown. You cannot edit this anonymized content yourself.

7. Investor disclosure

If an investor pays to request full disclosure of your listing, you must explicitly approve the request before any of your real, non-anonymized information (name, website, description, target market, founder background, and contact email) is shown to that investor. You may decline any request.

8. Angels digest (investor email list)

Investors can join an email digest of anonymized startups at /angels/join. We send it only when at least one listing matches your preferences, and at most once a week. This section covers that list only.

What we collect

• Your email address.
• Your preferences: stage (pre-seed, seed), typical cheque size range, sectors and geographies. They are used to choose which anonymized startups appear in your digest.
• The channel you came from (for example a link in a directory or community) — a short label such as "openvc", not information about your browsing.
• The time you confirmed your email, the version of the consent text you agreed to, the time we last sent you a digest (so we keep to once a week), and, if you unsubscribe, the time you did so.
• Email events for the digest emails we send you: that an email was sent and delivered, bounces (the email could not be delivered), complaints (you marked it as spam) and link clicks. Links to listings in the digest go through a redirect on starta.so that records which listing you opened and when, linked to your digest profile. We use these events to deliver the digest reliably, keep the list clean and measure whether the digest is useful (for example, how many emails lead to a click) — not for advertising, and we do not sell or share them. We do not track whether you open an email.
• When you submit the sign-up form, a keyed hash of your IP address (not the address itself), kept for up to 24 hours and used only to limit abuse of the form (our legitimate interest, GDPR Art. 6(1)(f)).

Consent (double opt-in)

We process this data on the basis of your consent (GDPR Art. 6(1)(a)). After you submit the form we send a confirmation link to your email; we only start sending the digest once you press the confirm button on that page. The link is valid for 7 days and creates no account or login: it only records your consent against your digest profile.

Unsubscribe and the suppression list

Every digest email contains a one-click unsubscribe link. When you unsubscribe — or if an email to you bounces or is reported as spam — we add your address to a suppression list so that we never email you again. Keeping this list is based on our legitimate interest in honoring your choice and not repeatedly emailing undeliverable addresses (GDPR Art. 6(1)(f)). If you ask us to delete your data, we will delete your profile but may keep your address on the suppression list unless you also ask us to remove it, because removing it means we could no longer guarantee you are not emailed again.

Email provider

The digest is sent through an email delivery provider acting as our processor. It receives your email address and the content of the email, and reports delivery events (sent, clicks, bounces, complaints) back to us. See the table in Section 4.

9. How long we keep your data

Website analytics data (only if you accepted analytics, Section 4.1) is kept for 2 months in Google Analytics 4 and then deleted automatically.

Angels digest profiles are kept until you unsubscribe or ask us to delete them; suppression-list entries are kept for as long as needed to guarantee we do not email you again. Email event records are kept with the profile and we do not yet have an automated deletion schedule for them.

We currently retain account and project data indefinitely; we do not have automated deletion or retention limits in place. If you would like your data deleted, contact hello@starta.so — please note that, at present, we are unable to delete an account with an active, unrevoked certificate (see our Terms of Service). We are working on a complete deletion process and will update this policy when it is available.

10. Your rights (GDPR)

As we process personal data of individuals in the EU, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data;
• request deletion, subject to the limitation in Section 9;
• object to or restrict certain processing;
• withdraw your consent at any time — for the angels digest, with the unsubscribe link in any email (withdrawing does not affect processing carried out before you withdrew);
• receive your data in a portable format;
• lodge a complaint with the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija).

To exercise any of these rights, contact hello@starta.so.

11. Children

STARTA is not directed at, and we do not knowingly collect data from, anyone under 18.

12. Changes to this policy

We may update this policy from time to time; material changes will be reflected by an updated "Last updated" date.

13. Contact

MB Startai
Plytų g. 12-19, LT-00132 Palanga, Lithuania
Company code: 306433627
hello@starta.so