Privacy policy

Who we are

StartupList is run by Referr Ltd, a company registered in England and Wales (company no. 14651607), at 2nd Floor College House, 17 King Edwards Road, Ruislip, London HA4 7AE, United Kingdom. We decide how your information is used, which makes us its controller under UK data protection law. Write to us at hello@startuplist.tech about anything in this policy.

Your account

When you sign up we keep your name and email address. If you sign in with Google, Google tells us your name, email address and profile photo, and gives us sign-in tokens, which we use only to sign you in. If you sign in with a link we email you, your name starts as the part of your address before the @, until you change it.

Each time you sign in we keep a session: the IP address and browser it started from, to keep your account safe. A session lasts 30 days from when you last used it, and is deleted when it ends. A sign-in link works for 15 minutes.

With your account we also keep your role, your daily check-in streak, whether emails to you bounce, and a ban and its reason if we ever ban you. We need all of this to run your account.

What other people see

Your profile is public: your name, photo, headline, bio, country, links, the website domain you proved you run, your level and badges, how many people follow you, the products you use, and, if you're a founder and choose to show them, your team size, funding and revenue. Search engines index a profile once its member has a launch.

Your reviews, questions and answers are public, with your name and photo. The makers of a listing are named on it, and in the summary of StartupList we publish for AI assistants.

What you do on StartupList

We keep your votes (and the reason, when you vote a launch down), your bookmarks, who you follow, your reviews, questions and answers, the reports you make, your notifications, and the coins you earn and spend with the codes they bought. We use them to run the site and to keep it fair: to stop vote rings and fake reviews, for example.

Messages are kept as they were written, and only the members in a conversation can read them. When one of them reports a message, our team reads it, with both members' names and email addresses, to decide what to do.

Our admins can find a member by email address, see who paid for an order, and keep a log of what they changed, which can include a ban's reason or the text of a reply they removed.

Listings, payments and claims

We keep the listings you submit and every change to them. When you paste your website's address, we read the site and send its public text to Anthropic's Claude to write a draft. We send nothing about you.

Stripe takes payments on its own page, so we never see your card. We keep each order (what you bought, what you paid, its state and Stripe's references) and your Stripe customer number. Stripe gets your email address, and your billing address and tax number if you ask for a tax invoice. We keep orders for as long as UK tax and company law requires: at least six years.

When you claim a listing we keep how you proved you run its website, and our decision. When you buy an article, we send Bloggable, which writes it with us, your listing's details, your name and headline, and your notes on its drafts.

If you verify your listing's revenue, you give us a key to your Stripe account that can only read. We keep it encrypted and use it every hour to read your balance transactions, subscriptions and coupons. From them we keep a total for each day, your monthly recurring revenue and how many subscriptions are active, which your listing shows unless you hide them. We never keep your customers, their payments or their cards. Disconnecting deletes the key and every figure, and so does deleting your account.

Advertising

When you ask us about advertising, we keep your name, email address, company, website and message, and email them to our team so we can reply.

When you book ads yourself, we keep your brand's details: its name, website, logo, the line its ads show and any offer you give founders, to show in your ads and to fill in next time. We keep each ad's days, whether we approved it (and why not, if we didn't) and the visits it sent you, which you see on your dashboard. Payments work as for listings, above.

When you buy a sponsored article, we keep your brief and your notes on its drafts, and send them with your brand's details to Bloggable, which writes it with us.

Emails and the newsletter

We email you about your account and your listings: sign-in links, a launch's review, claims, payments and your launch's first week. Emails about activity, such as a reply to your review or a new message, include what was written, and you can turn them off in your settings. For the emails we send to many people at once, such as each newsletter issue and the one announcing the new site, we keep a record of each one: the address, whether it arrived, bounced or was marked as spam, and for the announcement your name.

The newsletter goes only to those who asked for it. When you join, we email you a link to confirm, and delete the request if you don't within 30 days. If you had an account on our old site and hadn't turned off its marketing emails, we kept you on the list. Every issue has your own link to leave. An address that bounces, or that marks an email as spam, leaves the list too. Once you leave, we keep your address as unsubscribed, so it's never added again by mistake.

Resend sends all our emails, so it handles your address and what each email says.

Visits, clicks and where you came from

We count how many times each page is seen and each listing's site is visited, by day and by where the visit came from. These are counts, with nobody in them. To count a view once, and to stop people abusing the site, we keep your IP address (for IPv6, the first half of it) for between 10 minutes and 2 days, beside what it did; it's then deleted automatically.

When you sign up, we note where you arrived from: the website that sent you (its address only), the campaign tags in the link you followed and the first page you saw. It stays with your account, and tells us which places bring members.

We also count page views and how fast pages load with Vercel's Web Analytics and Speed Insights, which set no cookies and keep nothing in your browser. Vercel gets the page's address (without its query, campaign tags apart), the site that sent you, and your browser, device and country. We use no advertising services, and nothing on our pages follows you to other sites.

What we keep in your browser

These are all the cookies and other things our pages keep in your browser. None of them is for advertising, and none follows you to other sites.

Some pictures come from other companies' servers, which see your IP address as any website does: YouTube's thumbnails for a listing's demo video, Google profile photos, and site icons from Google. A video itself loads from YouTube (without its cookies) or Vimeo only when you press play. An affiliate link takes you through its network's site, which may set cookies of its own.

Startups we find elsewhere

To find startups to invite, we read public launch posts on Hacker News and public projects on GitHub. From each, we keep the startup's name and website, the post's address (on GitHub, which includes its owner's username), its score and its date, but no usernames from Hacker News and no contact details. If one is about you and you'd rather we didn't keep it, email us and we'll delete it.

Who else handles your information

These companies handle information for us, each only for what it does for us:

• Vercel runs the site, counts its page views and loading times, and stores the photos and logos you upload.
• MongoDB Atlas holds our database.
• Stripe takes payments, and keeps its own records of them under its own privacy policy.
• Resend sends our emails, the newsletter's included.
• Google signs you in, if you choose Google.
• Anthropic's Claude drafts listings from websites' public text.
• Bloggable writes the articles companies buy.

Several of them are based in the United States. Where your information goes there, it's protected by the UK's data bridge with the United States for the companies certified under it, or by the contracts the Information Commissioner approves. We don't sell your information to anyone.

How long we keep it

• Your account, profile and what you post: until you delete your account. Your questions, answers and messages then stay, shown as from “A member”, since they're part of other people's conversations.
• Sign-in sessions: until they end, 30 days after you last used them.
• IP addresses kept to count views and stop abuse: 10 minutes to 2 days.
• A draft made from a website before signing in: 24 hours.
• A visitor's coins: 30 days, unless they sign up.
• A newsletter request nobody confirmed: 30 days. Your newsletter address, once you leave: kept as unsubscribed.
• A review we removed, with why, and reports: kept, in case anyone asks us to look again.
• Orders: at least six years, as UK law requires.
• An advertising enquiry: until you ask us to delete it. Your brand's details: until you delete your account. The ads that ran keep the name, link and line they ran with, with their orders.
• A Stripe key for verified revenue, and the figures read with it: until you disconnect it or delete your account.

Your rights

You can ask to see the information we hold about you, to have it corrected or deleted, to have us stop or limit using it, and to have a copy to take elsewhere. You can object to anything we do because it's in our interest, such as counting where members come from, and you can leave the newsletter at any time.

In your settings you can download a copy of your data, delete your account, and change your profile, your photo and your emails. For anything else, email hello@startuplist.tech from the address you sign in with, and we'll answer within a month.

If you're unhappy with how we've used your information, tell us first, so we can put it right. You can also complain to the Information Commissioner's Office, at ico.org.uk or on 0303 123 1113.

Children

StartupList is for people aged 16 and over, and we don't knowingly keep information about anyone younger.

Changes to this policy

When what we do with your information changes, this page changes with it, and its date at the top. We'll email members about a change that matters to them before it applies.