Privacy Policy

01Who we are

StartupAid runs the website startupaid.org, the dashboard, the apps and the API.

This policy covers two different situations. For your own account details we decide how the data is used, so we are the “controller”. For data about other people that you put through the service, such as your contacts, the people you email, the people who call your number or the fans on your Top Fans board, you decide and we act on your instructions as your “processor”. The Data Processing Agreement at /dpa covers that second case.

Questions about this policy, and requests about your data, go to privacy@startupaid.org.

02What we collect

About you and your account

• Your name, email address, company and, if you give it, your phone number.
• Your password, stored only in scrambled form, and your two-step sign-in setting.
• If you sign in with Google or GitHub: the name, email address and account ID they send us.
• For each device you are signed in on: its IP address, the browser it uses and when it was last active, so you can see and sign out your devices in Security.
• Your teammates and their roles.
• Your plan, credit purchases, invoices, country and tax details. Card details go straight to Stripe or Paystack; we never see or store full card numbers. For a naira plan paid by card, we keep the reusable authorisation Paystack gives us, with the card type and last four digits, so we can renew the plan and name the card in your reminder.
• If you sign up through a referral link: a one-way scrambled form of your IP address, made with a secret key, which we compare with the referrer’s to spot self-referral.

What you make and upload

• Prompts, scripts, images, video, audio, slide decks, screen recordings and screenplays, and what the AI makes from them.
• Brand profiles: your company name, website, logo, colours and facts about your business, including what we read from your website when you ask us to.
• Email templates, messages, push notifications and social posts.
• Packages you export to edit in another program: a zip of the media in a project.

Faces and voices

If you make an avatar from photos of a real person, we store those photos and the avatar and looks made from them. If you make a voice, we store the recording, what the start of it was heard to say, and a short preview of the voice. The voice itself is held by the supplier that made it.

Before an avatar of a real person is made, you confirm in the dashboard that it is you or that the person has given permission, and we record the date. A voice can only be made from a recording in which the speaker says they agree to it, and we keep what was heard as the record of that.

We use these photos and recordings only to make and show that avatar or voice in your account. We do not use them to recognise or identify anyone. They are still personal data about the person shown or heard, and in some places, such as some US states, a voice or face model can count as biometric data. You must have the person’s permission; see the Terms.

Information about other people that you bring

• Contacts and mailing lists, and the people you send email, push notifications or one-time codes to, including their phone numbers.
• What happened to each email you send: delivered, bounced or complained about, and opened or clicked where you have turned tracking on.
• Members of your loyalty programmes, what they earn and redeem, and the phone number you use to find them in store.
• People who call your AI Receptionist number: their number, a written record of what they said to the AI made as they speak, and any voicemail they leave, which is recorded and written out.
• People who use your website chat: what they write and any name, email address or phone number they give.
• Bookings: the name, contact details, service and time of each appointment.
• People who engage with your social posts and appear on your Top Fans board: their public name, handle and picture, their score, and the email address they give to claim a prize.
• Fans proving a handle for a prize: the one-time code they post, and their network’s account ID, read from their public post.
• People who mention your X account while auto-reply is on: their mention, and a record of our reply so nobody gets more than one an hour.
• Businesses and business contacts you look up with AI Prospecting, which come from public sources such as Companies House and company websites.
• Details and documents you give us to verify your business for a UK phone number.

Accounts you connect

When you connect a social network we store the access it gives us so we can post for you, show how posts did, rank your fans and answer mentions. Posting to YouTube uses YouTube API Services; Google’s Privacy Policy at policies.google.com/privacy applies to that, and you can remove our access at any time in Social or at myaccount.google.com/permissions.

How the service is used

• Your IP address, browser and device type, and which parts of the service you use.
• API calls, and what happened to each message you send.
• Error reports when an AI generation fails, so we can fix it and return your credits.

03How we use it and why the law allows it

• To provide the service you asked for: make your videos and pictures, send your messages, answer your calls, take payment, and send service emails such as receipts, renewal reminders, sign-in codes and the weekly summaries. The law calls this performing our contract with you.
• To keep the service safe and working: prevent fraud, spam and abuse, check referrals for self-referral, protect our sending reputation, fix faults and understand which features are used. We rely on our legitimate interests in running a secure and reliable service, and you can object to this.
• To meet legal duties, such as keeping tax and accounting records and answering lawful requests from authorities.
• To send you product news. We do this only where you have agreed, or where you are a customer and the law allows us to tell you about similar services. Every such email has an unsubscribe link.
• For your own face and voice, we rely on our contract with you. For anyone else’s, you are responsible for the lawful basis, and we rely on the permission you confirm or the consent spoken in the recording.
• For data about other people that you put through the service, we act on your instructions and you choose the lawful basis.

We do not sell personal data or share it for targeted advertising, and we do not use your content, faces or voices to train AI models.

04Decisions made by software

Some things happen automatically. None of them is used by us to make a decision about a person that has legal or similarly significant effects.

• Sign-up uses a bot check. If it fails, you can try again or contact us.
• Referrals are checked for self-referral, repeated devices and limits. A referral that fails a check is held for one of our team to review; the software does not refuse it on its own.
• If bounces or complaints from an account rise too high, its marketing sends pause and the account is told why. Our team can review and release a hold.
• On behalf of our customers, the AI Receptionist decides when to hand a conversation to a person, X auto-reply decides whether to answer a mention, and a Top Fans board can pay a prize automatically once a fan has proved their handle and reached the score. The business that set these up is responsible for them.

05Who we share it with

We use other companies to run parts of the service. They receive only what they need for their part, and they may not use it for their own purposes beyond providing it. The country shown is where each company is based.

• Servers, database and our own mail relay: DigitalOcean (United States), which runs our API, holds our database and sends email through our own mail servers, so it holds most of the data described in this policy.
• Website and dashboard: Vercel (United States), which serves the website, the dashboard, public Top Fans boards and widgets, and so receives visitors’ IP addresses and requests.
• File storage and bot checks: Cloudflare (United States), which stores uploaded and generated files in R2 and runs the Turnstile check on sign-up.
• Email set-up and delivery: Amazon Web Services (United States), through Amazon SES, where we use it to set up customers’ sending domains or deliver email: sender and recipient addresses and the message.
• Payments: Stripe (United States and Ireland) for cards in US dollars and pounds, and Paystack (Nigeria) for naira by card, bank transfer or USSD: your name, email address, billing details and payment details, which they collect directly.
• AI writing, conversation and research: Anthropic (United States), which runs Claude: prompts, scripts, brand details, emails being written, AI Receptionist chats and call transcripts, X mentions being answered, and AI Prospecting research.
• AI video, images, voices and music: Google (United States) for Veo video, Gemini voices, Lyria music and Nano Banana images, and BytePlus (Singapore), ByteDance’s cloud service, for Seedance video, Seedream images and OmniHuman presenter clips: prompts, scripts, recorded lines and any pictures you attach, including photos of a real person used as a presenter.
• StartVid presenter videos: Modal (United States), which runs StartVid, our presenter model, on graphics processors we rent from it: the presenter photo and the recorded line for each clip. Finished clips are copied to our own storage.
• Other AI models: fal.ai (United States), which runs Kling video, Flux and Seedream images, MiniMax voice cloning, speech and Recast (putting the person you choose into a clip you upload), ElevenLabs speech when Google’s is unavailable, Sync lip-sync, VEED Fabric presenter clips and Whisper transcription. fal may pass a request to the company that makes the model. They receive prompts, pictures, voice recordings, presenter photos and the sound from recordings you upload.
• Phone numbers, calls and voicemail: Telnyx (United States), which carries calls and records voicemail. Through Telnyx, callers’ speech is written out by Deepgram (United States) and the receptionist’s replies are spoken by Amazon Polly (United States). Telnyx also receives the details and documents for UK number checks.
• WhatsApp one-time codes: Meta (United States and Ireland): the recipient’s phone number and the code.
• Push notifications: Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service), both United States, using the keys you give us: device tokens and the message.
• Signing in with another account: Google (including Firebase Authentication) and GitHub, both United States: your name, email address and account ID.
• UK company look-ups: Companies House (United Kingdom): the company names and numbers we look up. It returns public records, which can include the names of directors.
• Social networks you connect: X, LinkedIn, Facebook, Instagram, Threads, YouTube and TikTok: what you choose to post, and our requests to read the comments, replies and mentions of your posts.

When you generate something with AI, your prompt and any pictures, audio or video you attach are sent to the supplier that runs that model so it can produce the result.

Some things are public because you choose to publish them, such as posts, a Top Fans board and its listing in our Top Fans market.

We also share information when the law requires it, to protect people or the service from harm, or if the business is sold or merged, in which case this policy continues to apply to your data.

06Links to your files

Files you upload or make, such as videos, pictures, audio and slide images, are stored with Cloudflare and served from media.startupaid.shop. Anyone who has a file’s link can open it without signing in.

Each link contains long random identifiers, so it cannot be guessed, and we do not publish lists of links. We use open links because social networks fetch your media from them at the moment a scheduled post goes out, and a link that expired could make the post fail.

Treat a link like the file itself: anyone you share it with can open it, and so can anyone they pass it to.

Voicemail recordings and editor packages are kept privately and are only opened through links that expire. A link in the dashboard works for a few hours, and the link in a voicemail email works for 7 days; after that, the recording is still in your call log. The recordings used to make cloned voices stay in our database, where only our systems can read them.

07Where it is processed

Our suppliers are based in, or process data in, the United States, the United Kingdom, countries in Europe, Nigeria, Singapore and other countries. Some companies that make AI models offered through fal are based elsewhere, including China. Your data may therefore be processed outside your own country.

For data from the UK or the EU, where the destination does not have an adequacy decision, we rely on the safeguards the law provides. These include the standard contractual clauses and the UK’s international data transfer agreement or addendum in our suppliers’ data processing terms, and the EU-US Data Privacy Framework and its UK extension where a supplier is certified.

For data from Nigeria, we rely on the grounds the Nigeria Data Protection Act 2023 allows for transfers abroad, such as contracts with suitable protections, or where the transfer is needed to provide the service you asked for.

08How long we keep it

Fixed periods

• Records of one-time codes sent: 10 days.
• Error reports for failed AI generations: 60 days.
• Signed-in device records: until you sign out or the session ends after seven days. Ended sessions are removed the next time you sign in.
• Unclaimed gift credits: 90 days, after which they go back to the sender.
• A fan’s proof of a handle counts for 30 days. The record of it stays while your account is open.
• Invoices and tax records: as long as the law requires, which is usually six years.

While your account is open

We have not set a shorter period for everything else. That includes your content, contacts, message history, call and chat transcripts, voicemail recordings, bookings, Top Fans data, the email suppression list and referral records. We keep these while your account is open, unless you delete them first.

• You can delete most things yourself, such as contacts, lists, campaigns, videos, pictures, audio, films, boards and a whole receptionist with its conversations. For anything the dashboard cannot delete, such as a single voicemail, write to us.
• An editor package stays until you export the same project again, when the new package replaces it.
• When you delete an avatar, it leaves your account at once, and the photos you uploaded for it are deleted from our file storage. For an avatar of a real person, the looks made from those photos are deleted too, including from your image library. Videos already made with the avatar are not changed.
• When you delete a voice, it leaves your account at once and can no longer be used, and its recording and preview are deleted. Our supplier gives us no way to delete the voice it made; it deletes voices that go unused for 7 days, and we never use a deleted voice again.

When your account closes

When you ask us to close your account we delete your content and personal data within 30 days, apart from what the law requires us to keep.

09Your rights

You can ask us for a copy of your data, to correct it, to delete it, to stop or limit how we use it, or to send it to you in a form you can take elsewhere. You can object to how we use it for our legitimate interests, and to direct marketing at any time. Where we rely on your consent you can withdraw it at any time.

Email privacy@startupaid.org and we will reply within one month. If a request is complex, the law allows up to two more months, and we will tell you if we need them. We may ask you to confirm who you are before we act.

If you live in Nigeria, you have these rights under the Nigeria Data Protection Act 2023. If you live in a US state with a privacy law that applies to us, you can ask to know, correct or delete your personal information, and we will not treat you differently for asking. We do not sell or share personal information for targeted advertising, so there is nothing to opt out of.

If you are unhappy with our answer you can complain to your data protection authority: in the UK the Information Commissioner’s Office, in Nigeria the Nigeria Data Protection Commission, and in the EU the authority in your country.

10If one of our customers contacted you

You may be in our systems because a business uses StartupAid: it emailed you, sent you a code or a notification, answered your call or chat, booked you in, runs a loyalty programme you joined, or shows you on its Top Fans board. That business decides how your details are used, and its own privacy notice should explain it.

For email, use the unsubscribe link in the message. For anything else, contact the business directly. You can also write to us and we will pass your request on and make sure it is acted on.

11Cookies and browser storage

We use only what the service needs, so we do not ask for cookie consent:

• A cookie that keeps you signed in, and one that tells our pages you are signed in. Both last seven days.
• Two short-lived cookies while you sign in with Google, which last ten minutes.
• Settings kept in your browser, such as your theme and language, whether you have seen the tour, layout choices and unsent drafts.
• A referral or gift code from a link you followed, kept in your browser until you sign up.
• In a loyalty widget on a business’s website, your sign-in to that programme, kept in your browser.

Sign-up uses Cloudflare Turnstile to tell people from bots. We do not use advertising cookies or analytics services.

Emails that our customers send through us may record when a message is opened or a link is clicked, if the customer has turned tracking on.

12Children

The service is for businesses and adults. It is not intended for anyone under 18, and we do not knowingly collect their data. If you think a child has given us their data, tell us.

13Security

We protect data with encryption in transit, access limited to the people and systems that need it, separation between customers’ data, sign-in protection and logging. Push keys and social sign-ins are stored encrypted. How we protect accounts and data, and how to report a weakness, is set out at /security.

14Changes and contact

If we change this policy in a way that matters we will tell you by email or in the dashboard before it takes effect. The date at the top shows the latest version.

Questions and requests: privacy@startupaid.org.