StartupModel

Privacy policy

Last updated: 18 October 2026

This policy explains what personal data StartupModel (startup-model.com) collects when you use the site and buy a model, why, who else processes it, how long we keep it and what your rights are.

Who is responsible

The data controller is StartupModels LLC, a limited liability company organised in Wyoming, United States ("StartupModel", "we"). Contact for anything about your data: [email protected].

What we collect

  • Email address. You give it in the wizard or when you sign in. We use it to send your receipt, your model, sign-in links and messages about your order.
  • Your wizard answers. Business type, goal, stage, planning horizon, plan, the key numbers you enter (for example prices, volumes or costs) and any notes you add about your plans. They are used to build your model. Enter business figures only; the wizard does not ask for personal data about other people.
  • Order and payment records. What you bought, the price, the dates, and the payment and refund references Stripe returns to us. We never see or store your card details: you pay on a page run by Stripe.
  • Your model files. The Excel workbook built for your order, so you can download it again from "My models".
  • Sign-in data. When you sign in we store a hashed one-time link token with the IP address it was requested from (to stop abuse), and, once you are signed in, a hashed session token with your browser type (so you can recognise your sessions).
  • Technical logs. Our servers record requests (address requested, time, response, IP address and browser type) to keep the service secure and to fix errors. One-time link and download tokens are removed from these logs.

We do not use advertising or analytics cookies and we do not sell or rent personal data.

Why we use it and the legal basis

  • To take and deliver your order, including sign-in, downloads, re-builds and support — performance of a contract (Art. 6(1)(b) GDPR).
  • To keep accounting and tax records of payments and refunds — legal obligation (Art. 6(1)(c) GDPR).
  • To protect the service against fraud and abuse (rate limits, security logs) and to improve our templates using order data — our legitimate interests (Art. 6(1)(f) GDPR). We review template quality from the numbers in briefs, not to profile you.

We only email you about orders you placed and sign-ins you requested. If we ever add newsletters or follow-up emails, we will ask first and every such email will have an unsubscribe link.

Who processes it for us

We use these service providers. Each processes data only on our instructions under a data processing agreement:

  • Stripe — payments and refunds. For payment data Stripe also acts as an independent controller under its own privacy policy.
  • Railway — hosting of the application, its database and the model files.
  • Cloudflare — domain, DNS, network security and delivery of the site.
  • Resend — sending our emails.
  • OpenAI — its AI model may be used to turn your wizard answers and any notes you type into the starting assumptions of your model. It receives those answers and notes, not your email address or payment details.

We are based in the United States, so your data is processed in the United States and in the other countries where these providers operate. Where a provider receives personal data of people in the European Economic Area or the United Kingdom, it is protected by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.

We may disclose data when the law requires it, for example to a tax authority or a court.

How long we keep it

  • Paid orders and payment and refund records: as long as tax and accounting law requires (generally up to 7 years), then deleted.
  • Model files and wizard answers: while your order exists, so you can download or re-build the model; you can ask us to delete them earlier.
  • Orders that were never paid: deleted after 12 months.
  • Sign-in links expire after 15 minutes and sessions after 30 days or when you sign out; their records are deleted after 12 months.
  • Server logs: kept by our hosting provider for a limited period, at most 90 days.

Your rights

You may ask us for access to your data, a copy of it in a portable format, correction, deletion, restriction of processing, and you may object to processing based on legitimate interests. Write to [email protected] from the email address you used; we answer within one month. Some data we must keep for legal reasons (for example payment records) even if you ask us to delete it; we will tell you if that applies.

If you live in the European Economic Area or the United Kingdom, you also have the right to complain to the data protection authority of the country where you live or work.

Cookies

We use only cookies that are strictly necessary for the site to work, so no consent banner is needed:

  • sm_session — keeps you signed in to "My models" (30 days, or until you sign out).
  • sm_admin — keeps our own staff signed in to the admin area; it is never set for customers.

Stripe may set its own cookies on its payment page to prevent fraud; see Stripe's privacy policy.

Security

Connections are encrypted (HTTPS). Sign-in uses one-time links instead of passwords; tokens are stored only as hashes; download links expire. Access to the admin area is restricted.

Children

The service is for businesses and adults. We do not knowingly collect data from anyone under 16.

Changes

If we change this policy, we will publish the new version here with a new date. If a change materially affects how we use data you already gave us, we will tell you by email.