Privacy Policy

This is a general template and not legal advice. Have a lawyer review it before relying on it for your business.

1. Information we collect

• Account information. When you sign in with Google we receive your name, email, and profile image. When you register with email and password we store your name and email and a salted hash of your password (never the password itself).
• Listing content. The startup details, descriptions, assets, and figures you enter or import.
• Connected metrics. If you connect a read-only Stripe key, we read charges and subscriptions to compute revenue. If you connect Google Analytics or Ahrefs, we read traffic and SEO data. We never receive the ability to move funds.
• Usage & messages. Offers, messages, watchlist activity, and basic technical logs needed to run and secure the service.

2. How we use your information

• To operate the marketplace — publish listings, verify revenue, and display traffic.
• To enable offers, messaging, and account management.
• To secure the platform, prevent abuse, and comply with legal obligations.
• To send transactional email related to your account and deals.

3. Third-party services

We share data with service providers only as needed to run the service:

• Google — sign-in (Identity Services) and, if you connect it, Analytics.
• Stripe — read-only revenue verification via a restricted key you provide.
• Ahrefs — SEO metrics, if you connect it.
• Email & hosting providers — to deliver notifications and host the application.

4. Information shared with other users

A listing you publish — including the metrics you connect and your public profile — is visible to other users. When you make or receive an offer, relevant details are shared with the counterparty so you can negotiate. Off-market and draft listings are not shown publicly.

5. Cookies, local storage & analytics

We keep your session token in your browser’s local storage so you stay signed in. We keep your theme preference the same way. We use Google Analytics to understand how the site is used (pages visited, approximate location, device type); Google sets its own cookies or identifiers for this. We also use Ahrefs Web Analytics, a cookieless analytics tool. We do not use third-party advertising cookies.

6. Data retention

We retain your data for as long as your account is active or as needed to provide the service and meet legal obligations. You can request deletion of your account and associated personal data (see “Your rights”).

7. Your rights

Depending on where you live (for example, under GDPR or CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to certain processing. To exercise these rights, contact us at the address below.

8. Security

We use industry-standard measures to protect your data — passwords are stored as salted hashes, Stripe keys and OAuth tokens are encrypted at rest, and access is restricted. No method of transmission or storage is perfectly secure, so we cannot guarantee absolute security.

9. Children

The service is intended for users 18 and older and is not directed to children.

10. International transfers

We may process and store data in countries other than where you live. Where required, we use appropriate safeguards for such transfers.

11. Changes to this policy

We may update this policy from time to time; changes are reflected by the “Last updated” date above.

12. Contact

Questions or requests about your data? Email privacy@startupstobuy.com.