Data Processing Agreement

01What this covers

This agreement is part of the Terms of Service. It applies when you use StartupAid to handle personal data about other people, such as your contacts, the people you message, your loyalty members, the fans on your Top Fans boards and the people who call or chat with your AI Receptionist. For that data you are the controller and we are your processor.

It lasts for as long as we hold that data for you.

02What we do with the data

• We process it only to provide the service and on your instructions, which are these terms and what you do in the dashboard, through the API or through a connected assistant.
• We tell you if we think an instruction breaks data protection law.
• Everyone here who can see the data is bound to keep it confidential.

The data concerned is whatever you choose to put in: typically names, email addresses, phone numbers, device identifiers, message content, call and chat transcripts, voicemail recordings, bookings, public social media names, handles and posts, prize claims, and loyalty activity. You must not use the service for special categories of data, such as health records, unless we have agreed it in writing.

03Security

We protect the data with measures suited to the risk, including encryption in transit, access limited to the people and systems that need it, separation between customers’ data, sign-in protection and logging. The current measures are described at /security.

04Other processors we use

You agree that we use the following companies to help provide the service. Each is bound by terms that protect the data to at least the standard in this agreement, and we remain responsible for what they do with it.

• Servers, database and our own mail relay: DigitalOcean (United States), which runs our API, holds our database and sends email through our own mail servers, so it holds most of the data described in this policy.
• Website and dashboard: Vercel (United States), which serves the website, the dashboard, public Top Fans boards and widgets, and so receives visitors’ IP addresses and requests.
• File storage and bot checks: Cloudflare (United States), which stores uploaded and generated files in R2 and runs the Turnstile check on sign-up.
• Email set-up and delivery: Amazon Web Services (United States), through Amazon SES, where we use it to set up customers’ sending domains or deliver email: sender and recipient addresses and the message.
• Payments: Stripe (United States and Ireland) for cards in US dollars and pounds, and Paystack (Nigeria) for naira by card, bank transfer or USSD: your name, email address, billing details and payment details, which they collect directly.
• AI writing, conversation and research: Anthropic (United States), which runs Claude: prompts, scripts, brand details, emails being written, AI Receptionist chats and call transcripts, X mentions being answered, and AI Prospecting research.
• AI video, images, voices and music: Google (United States) for Veo video, Gemini voices, Lyria music and Nano Banana images, and BytePlus (Singapore), ByteDance’s cloud service, for Seedance video, Seedream images and OmniHuman presenter clips: prompts, scripts, recorded lines and any pictures you attach, including photos of a real person used as a presenter.
• StartVid presenter videos: Modal (United States), which runs StartVid, our presenter model, on graphics processors we rent from it: the presenter photo and the recorded line for each clip. Finished clips are copied to our own storage.
• Other AI models: fal.ai (United States), which runs Kling video, Flux and Seedream images, MiniMax voice cloning, speech and Recast (putting the person you choose into a clip you upload), ElevenLabs speech when Google’s is unavailable, Sync lip-sync, VEED Fabric presenter clips and Whisper transcription. fal may pass a request to the company that makes the model. They receive prompts, pictures, voice recordings, presenter photos and the sound from recordings you upload.
• Phone numbers, calls and voicemail: Telnyx (United States), which carries calls and records voicemail. Through Telnyx, callers’ speech is written out by Deepgram (United States) and the receptionist’s replies are spoken by Amazon Polly (United States). Telnyx also receives the details and documents for UK number checks.
• WhatsApp one-time codes: Meta (United States and Ireland): the recipient’s phone number and the code.
• Push notifications: Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service), both United States, using the keys you give us: device tokens and the message.
• Signing in with another account: Google (including Firebase Authentication) and GitHub, both United States: your name, email address and account ID.
• UK company look-ups: Companies House (United Kingdom): the company names and numbers we look up. It returns public records, which can include the names of directors.
• Social networks you connect: X, LinkedIn, Facebook, Instagram, Threads, YouTube and TikTok: what you choose to post, and our requests to read the comments, replies and mentions of your posts.

We will update this list before a new company starts handling your data. If you object on reasonable data protection grounds, tell us within 30 days and we will work on a solution; if there is none, you may close your account.

05Helping you meet your duties

• If someone asks us to see, correct or delete their data and it belongs to your account, we pass the request to you and help you answer it.
• If we learn of a breach affecting your data, we tell you without undue delay, with what we know about what happened and what we are doing about it.
• We give you the information you reasonably need to show you comply with the law, and help with impact assessments where our part is relevant.

06Transfers and the end of the agreement

Data may be processed outside your country by us or the companies listed above. Where the law requires a safeguard for that, we rely on those it provides, such as standard contractual clauses.

While your account is open you can delete most of the data yourself, ask us to delete anything the dashboard cannot, and ask us for a copy of it. When the account is closed we delete it within 30 days, apart from what the law requires us to keep.

07Contact

Data protection questions: privacy@startupaid.org.