This policy explains what personal data Startup Mastery collects when you use Startup Mastery 3.0 (the website and the platform at this address), why we use it, who processes it for us, how long we keep it and what rights you have.
The platform is operated by BOBTECH LTD, a company registered in Cyprus (HE 495882), Archbishop Makarios III Ave 240, P. Lordos Center, Block B, Floor 2, Office 206, 3105 Limassol, Cyprus, trading as Startup Mastery, which is the controller of your personal data ("we", "us"). You can reach us at any time at igor@startup-mastery.com.
What we collect
- Account details: your first and last name, e-mail address, country, password (stored only as a one-way hash, never in readable form), the roles you hold (founder, mentor, investor) and your profile details such as a photo, a short bio and links you add.
- Startup and journey data: everything you and your team enter in the platform, such as the startup description, team members, customer research, business model, plans, clients, unit economics, markets and the comments written on each step.
- Uploaded files: documents and images you upload, such as presentations, executive summaries, memoranda of understanding, letters of intent and pictures.
- Google sign-in: if you choose "Sign in with Google", Google shares your name, e-mail address and profile photo with us. We do not receive your Google password or access to anything else in your Google account.
- Messages to our team: what you write in a help request, with any file you attach.
- AI Co-CEO conversations: the questions your team asks the AI Co-CEO and its answers are kept in your startup's thread, and with each question we send the startup's name, level, industry and country, the data saved in the current step, the name, gender and character your team gave the AI Co-CEO and your interface language to our AI agent so it can answer.
- Level review: when your team completes a level, the data saved in that level's steps is sent to the AI Co-CEO, which reviews it and may ask for changes. Contact details of your clients and customers are not sent; only their number and non-personal fields.
- Consent records: which version of the Terms of Use and this policy you accepted and when, and whether you asked for news and invitations from Startup Mastery, with the time of that choice.
- Technical data: the date and time you sign in, your active sessions (device, IP address, last seen), the records our hosting provider keeps of requests to the site (such as IP address and browser type), and the access log described under Security, used for security and troubleshooting.
Why we use it
- To create and run your account, sign you in and keep you signed in.
- To provide the platform: store your startup and journey data, show it to the people you work with, and move your startup through the levels.
- To connect founders with mentors, investors and regional managers, within the visibility you choose.
- To send you the e-mails the service needs, such as address verification, password reset, invitations and notifications you have switched on.
- To answer your help requests.
- To keep the platform secure, prevent misuse and keep a record of administrative actions.
We use your data because it is necessary to provide the service you signed up for, and for our legitimate interest in keeping the platform safe and working. Where we rely on your consent, such as for optional notifications, you can withdraw it in Settings at any time.
Who can see your startup
Your startup is private by default. Its data is visible to its active team members, to mentors you invite and who accept, to the Startup Mastery team, and to regional managers of the region your program belongs to or who were granted access by an administrator. You can see which regional managers have access in Settings. Investors and the public see your startup only if you change its visibility, and only as much as that setting allows.
Data you enter about other people
Founders can enter personal data of their own customers and contacts, such as Gold clients and the waiting-list file of the demand proof. For that data the founder is the controller and we process it on the founder’s behalf, under the section "Data you enter about other people" of our Terms of Use, which is our data processing agreement with founders.
Who processes it for us
We use a small number of service providers who process personal data only on our instructions and only to run the platform:
- Hosting: Vercel Inc. runs the website and the application servers.
- Database: Neon (Databricks, Inc.) stores the platform database.
- File storage: a cloud storage provider stores the files you upload, with access limited to the people allowed to see them.
- E-mail delivery: an e-mail delivery provider sends the messages the service needs.
- Sign-in: Google, only if you choose to sign in with Google.
- Maps: the "Where we are" map loads map images from OpenStreetMap servers, which receive your IP address as part of that request.
- Waiting lists: if you join a startup's waiting list on its public page, we keep your name and e-mail for that startup, which may e-mail you about its launch. Ask the startup or us to remove you at any time.
- Messengers, only if you choose one: if you choose "Continue in Telegram" or "Continue in WhatsApp", we keep your Telegram username or WhatsApp number until you remove it and send it to our AI agent, and your conversation with the AI Co-CEO also goes through Telegram or WhatsApp under their terms.
- AI: the AI Co-CEO service that answers your team's questions and drafts step content; it receives the data described under AI Co-CEO conversations and the step data sent for level review, and uses it only to answer and review.
- Analytics, only after you choose "Accept all": Google Analytics 4 (Google Ireland Limited) and Vercel Web Analytics (Vercel Inc.), as described under Cookies.
- Payments: Stripe processes card payments. Card details go directly to Stripe and never reach our servers; we receive only the payment status, amount and the last digits of the card.
Security
In plain words, this is how we protect your ideas, documents and contacts:
- Encrypted connections: every page and every file travels over an encrypted connection (HTTPS), and browsers are told never to use anything else.
- Encrypted storage: our providers encrypt the database and the file storage at rest. Files are private: they are reached only through the platform, after it checks who is asking, and always download as files.
- Two-factor sign-in for staff: administrators and regional managers sign in with a password and a code from an authenticator app, and their sessions end after 12 hours. Anyone can turn two-factor sign-in on in Settings.
- Strong passwords: at least 10 characters; a password known from a data breach is refused. To check it, only the first 5 characters of a one-way hash of the password go to the Pwned Passwords service, never the password.
- Access log: every time our team or a regional manager opens a startup's private data, every data-room download and every change to two-factor sign-in is recorded: who, what and when.
- Stamped copies: a PDF downloaded by an investor or a mentor carries their name, e-mail and the date on every page, so a leaked copy shows where it came from. The founder is told when someone downloads a data-room document.
- Protection from bots: the forms that create an account, sign you in, send an e-mail or an application are checked by Cloudflare Turnstile (Cloudflare, Inc.), which looks at the browser, not at you, and sets no tracking cookie. Repeated attempts are limited; for that we keep a one-way hash of the IP address, the e-mail or the account for at most one day.
International transfers
Some of these providers store or process data outside your country, including in the United States and the European Union. Where the law requires it, these transfers are covered by the safeguards the providers offer, such as the European Commission standard contractual clauses.
We do not sell your data
We do not sell, rent or trade your personal data, and we do not use it for advertising. We share it only as described in this policy, or when the law requires us to.
How long we keep it
- Account, startup and journey data and uploaded files: for as long as your account is active.
- When you delete your account (Settings > Account, confirmed by typing DELETE): it is deactivated at once, so nobody can sign in to it and it disappears from every list and public page, and after 30 days a scheduled job erases your name, e-mail, phone, links, photo, password and profiles. If you are the CEO of a startup, you first hand the CEO role to a team member or archive the startup. What your team built stays with the startup, and your comments and records of administrative actions keep the event but show "Deleted user" instead of your name.
- Sign-in sessions end after 30 days (12 hours for administrators and regional managers), or earlier when you sign out or choose "Sign out everywhere" in Settings.
- Backups held by our database provider are overwritten in the normal course, within 30 days.
- Data we must keep by law is kept for the period the law sets, and then deleted.
Your rights
You have the right to access the personal data we hold about you, to correct it, to have it deleted, to receive a copy in a portable form, to object to or restrict how we use it, and to withdraw any consent you gave. You can correct most of your data yourself in your profile and settings. For anything else, write to igor@startup-mastery.com; we answer within 30 days.
Our supervisory authority is the Commissioner for Personal Data Protection of Cyprus (dataprotection.gov.cy). You can complain to it, or to the data protection authority of the country where you live.
Calendar
The calendar is off until you turn it on in Settings, and only after you agree in our own consent panel. With Google Calendar, Google asks you to let us create and manage one separate "Startup Mastery" calendar; we cannot read or change any other calendar or event. We store the access Google gives us encrypted, and use it only to add, update and remove the deadlines of your tasks. With the calendar link, we create a private address that any calendar app can subscribe to; anyone who has it can see those deadlines, so you can reset it at any time. Turning the calendar off deletes our Google calendar, revokes and deletes the stored access, or stops the link at once. Each consent, connection and disconnection is logged.
Security
Passwords are stored as one-way hashes, connections to the platform are encrypted, sessions are stored hashed, and private files are served only to signed-in people who are allowed to see them. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.
Children
The platform is meant for adults building companies. You must be at least 18 years old to create an account, and we do not knowingly collect data from children.
Changes to this policy
If we change this policy, we publish the new version on this page with a new date. If a change is significant, we tell signed-in users in the platform or by e-mail before it takes effect.
Contact
Questions or requests about your data: BOBTECH LTD, a company registered in Cyprus (HE 495882), Archbishop Makarios III Ave 240, P. Lordos Center, Block B, Floor 2, Office 206, 3105 Limassol, Cyprus, trading as Startup Mastery, igor@startup-mastery.com.