Privacy Statement
What Starting Up records about you, why it needs to, and what it deliberately does not record.
The Dutch text is the binding version. This translation is here so it can be read; where the two differ, the Dutch text prevails.
1. Who processes your data
- Controller
- —
- Trading as
- Starting Up
- Chamber of Commerce (KvK)
- —
- VAT number
- —
- Address
- —
- —
There is no Data Protection Officer. That is not an oversight: the obligation to appoint one does not apply here, and a named officer who does not exist is worse than an honest address. Privacy questions arrive at the address above and are answered by a person.
2. Two roles, and the difference matters
Starting Up does two things with personal data, and the law names them differently. Which role applies decides who you need to talk to.
Controller — for your account
For data that is yours as a customer — your email address, your identities and brands, your invoices, your security log — we decide the purpose and the means ourselves. For that we are the controller, and this statement is the whole story.
Processor — for what you record about other people
Starting Up contains a shared CRM: people, companies, contact moments and activities. That data is about your clients, suppliers and relationships. You decide what you record and why; we store and display it on your behalf. For that we are the processor and you are the controller, with the duties that come with it — including informing the people you record things about.
The terms for that second role are in the Data Processing Agreement. It forms part of your contract and applies automatically as soon as you use Starting Up; there is nothing to sign or request.
3. What data, for what, and on what basis
| What | Why | Legal basis | How long |
|---|---|---|---|
| Email address, and the name derived from it | Your account, signing in, and email about the service | Performance of the contract | As long as your account exists |
| Password hash (optional) | Signing in with a password, if you set one | Performance of the contract | As long as your account exists |
| Sessions and sign-in links | Staying signed in, and signing in without a password | Performance of the contract | Session 7 days; sign-in link 15 minutes |
| Identities and brands — name, legal form, KvK, VAT, RSIN, description, branding | The identity you trade under, and how it looks in the products you use | Performance of the contract | As long as your account exists |
| CRM — people, companies, contact moments, activities | Your relationship management | You decide this; we are the processor here | Until you delete it, or your account ends |
| Team members and invitations | Access within a workspace | Performance of the contract | Invitations expire automatically; grants until revoked |
| Security log — which action, by which account or product, when | Being able to establish what happened after misuse or a fault | Legitimate interest (security and accountability) | As long as your account exists |
| Payments and subscriptions | Taking payment and invoicing | Performance of the contract, and a statutory retention duty | 7 years (Dutch tax law) |
| AI usage — token counts, model, cost, outcome | Billing your usage and enforcing your budget | Performance of the contract | 7 years, as part of the accounts |
| Connections — access tokens for services you connect yourself | Reading data from that service on your behalf | Performance of the contract | Until you revoke the connection |
4. What is deliberately not recorded
This is not a promise about the future but a description of the code as it runs today, and it can be checked:
- No IP addresses. No table in Starting Up has a column for one. Not even the security log.
- No user agents. Which browser or device you use is not recorded.
- No content of AI requests. For an AI request we record the token count, the model, the cost and the outcome — not your question and not the answer.
- No trackers, no analytics, no advertising pixels. This site's content security policy permits no external source at all: no script, stylesheet, font or image from another domain. A tracker could not sit here quietly — it simply would not load.
- No profiling and no automated decision-making with legal or similarly significant effects for you.
- No selling or renting of data. To nobody, at no price.
5. Cookies
One cookie, and it is strictly necessary:
| Name | Purpose | Lifetime | Properties |
|---|---|---|---|
| __Host-sid | Remembering that you are signed in | 7 days | HttpOnly, Secure, SameSite=Lax, signed |
A strictly necessary cookie needs no consent, which is why there is no cookie banner here. That is a design choice rather than a lapse: nothing on this site would require consent, so there is nothing to ask.
6. Who else sees your data
To run Starting Up we engage a small number of service providers. They may use the data only for what we instruct. Who they are, for what, and where they are, is kept on one page: sub-processors. That page forms part of this statement.
We also share data where the law obliges us to.
Products in the suite
Starting Up is the core that other products sign into — TheJay is the first. When you admit a product to a workspace, it receives the data it needs, and the consent screen at sign-in says beforehand which data that is and which it never gets. A product you have not admitted reaches nothing.
Connections you make yourself
If you connect Google or Microsoft, that happens through a registration in your own environment, with your own client id. We hold no shared key for those two. So you connect your own account through your own registration, not through an intermediary of ours.
7. Transfers outside the EEA
The Starting Up application and database run inside the European Union. Two things can leave it:
- AI requests. If you use an AI feature, the content of that request goes to the language model provider. Today that is Anthropic (United States). This happens only when you use such a feature; without one, nothing leaves the EU by this route.
- Services you connect yourself. Where that data ends up is governed by that service's terms, not ours.
For transfers to countries without an adequacy decision we rely on the European Commission's Standard Contractual Clauses, together with the relevant party's own processing terms. The current position per party is on the sub-processors page.
8. How long we keep things
The periods per category are in the table under section 3. In addition:
- Expired sessions are cleaned up; a signed-out session is unusable immediately.
- If you delete your account, we delete your data within 30 days, except what we are legally required to keep — in practice the payment records, which we keep for 7 years.
- The financial ledger of AI usage and the subscription history are deliberately not editable. Accounts that can be rewritten afterwards are not accounts.
9. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection. For data where we are the processor — the CRM data about other people — your request goes to the customer who entered it; we pass it on and help that customer.
Much of this you can do yourself, immediately, in your account: edit your identities and brands, change team members and their access, revoke connections, and read your security log.
One thing you cannot do yourself yet. There is no button today that deletes your account with everything in it, and no button that exports all your data. That is a shortcoming, not a choice. Until those buttons exist we do it by hand: email — and we will carry it out within 30 days, with a confirmation when it is done.
If we do not respond, or you disagree with how we handled it, you can complain to the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl). We would rather hear it first, but that right stands independently of us.
10. Security
What has actually been done, instead of the usual sentence about appropriate measures:
- Separation at the database level. The application runs on a database role without superuser rights, with row-level security on every table. That one workspace cannot see another's data is enforced by the database itself — not by a filter in the application that a developer can forget.
- Connection tokens are stored encrypted, with a key that exists only in the runtime environment and never in the source code.
- Signing in is a link in an email by default. There is then no password to leak or reuse. A password is optional and is hashed with bcrypt.
- Sign-in attempts are rate-limited and an account is temporarily locked after too many failures.
- The session cookie is HttpOnly, Secure and signed, with a __Host- prefix so another subdomain cannot set it.
- Everything runs over HTTPS, under a strict content security policy that permits no external source.
No measure makes a system infallible. In the event of a data breach posing a risk to those affected, we report it to the Dutch Data Protection Authority within 72 hours and inform you without undue delay.
11. Changes
If this statement changes substantively, we raise the version number at the top and email you at your account address before it takes effect. Minor textual corrections go without notice, but the version and date at the top always say what is in force.