Privacy policy
Last updated: July 18, 2026
Controller
Controller: Jannis Willi Gramatte, c/o MDC#spotyourstartup, Welserstraße 3, 87463 Dietmannsried, Germany. Email: hello@spotyourstartup.com. This policy explains what personal data SpotYourStartup processes, why, and what rights you have under the GDPR.
What we process, and why
- Account data (name, email, password hash, optional 2FA secret) - to operate your account. Legal basis: Art. 6(1)(b) GDPR (contract).
- Social sign-in (optional): if you choose to sign in with Google or GitHub, we receive your name, email address and provider account id from Google LLC or GitHub, Inc. to create and link your account. Art. 6(1)(b). The provider learns that you use SpotYourStartup; its own processing is governed by its privacy policy.
- Personalization data (founder profile, saved ideas, comparisons, breakdown slots) - to compute fit scores and power your dashboard. Art. 6(1)(b).
- Subscription and billing state (plan, status, Paddle subscription id) - to grant what you paid for. Art. 6(1)(b). Payment details themselves go to Paddle, not to us.
- Scout conversations, deep-analysis briefs and own-idea scorings - to answer your questions and assess ideas you submit; sent to our AI processor (Anthropic) to generate the answer and not used to train models. Chat messages are not stored by us beyond the request; deep-analysis briefs, own-idea scorings and personal-angle reports are saved to your account with their results until you delete them or your account. Art. 6(1)(b). Usage metering (tokens, cost) is kept for quota enforcement, Art. 6(1)(f).
- Email preferences and send log - to deliver only the mails you double-opted into and to prove we did not send more. Art. 6(1)(a) for the lists, Art. 6(1)(f) for the log.
- Newsletter subscription without an account (email address only) - to send the weekly drop to subscribers. Double opt-in before anything is sent, Art. 6(1)(a); the unsubscribe link in every mail deletes the address outright.
- Security and audit logs (sign-ins, admin actions, webhook receipts) - to keep the service safe and billing idempotent. Art. 6(1)(f).
- Cookieless usage analytics (Vercel Web Analytics) - aggregate page statistics without cookies, identifiers or cross-site tracking; visitor hashes are discarded after 24 hours. Vercel Speed Insights additionally collects anonymous performance samples (Core Web Vitals) the same cookieless way. Art. 6(1)(f).
Processors and recipients
We use the following processors under Art. 28 GDPR data-processing agreements. Where a provider processes data outside the EU/EEA, transfers rest on EU Standard Contractual Clauses and, where certified, the EU-US Data Privacy Framework.
| Provider | Purpose | Region |
|---|---|---|
| Vercel Inc. | Hosting, edge network, deployments, cookieless analytics and performance samples, public file storage (videos) | EU (fra1) app region; global edge |
| Neon Inc. | Postgres database | EU (Frankfurt) |
| Upstash Inc. | Redis cache (rate limits, quotas, entitlements) | EU region |
| Resend Inc. | Transactional and subscription email | EU region |
| Anthropic PBC | AI processing for Scout chat, deep analyses and own-idea scorings | US (SCCs); inputs are not used to train models |
| Functional Software Inc. (Sentry) | Error monitoring | EU data residency |
| Inngest Inc. | Background job orchestration (digests, retention) | US (SCCs) |
| Paddle.com Market Ltd | Merchant of record: checkout, payment, invoicing, tax | UK/EU - Paddle acts as an independent controller for payments |
Retention
A nightly job enforces these periods automatically; the numbers below are read from the same configuration the job runs on.
| Data | Kept for |
|---|---|
| Account + personalization data | Until you delete your account |
| Deleted accounts | 14-day grace window, then hard-deleted |
| Unverified accounts | 30 days |
| Unconfirmed newsletter signups | 7 days |
| Expired sessions and verification tokens | Deleted on expiry |
| Billing webhook payloads | 90 days |
| Email send log | 365 days |
| AI usage metering | 365 days |
| Deep analyses, own-idea scorings and personal angles | Until you delete them or your account |
| Rejected content drafts | 180 days |
| Scout chat messages | Not stored server-side beyond the request |
Your rights, self-service first
You have the rights of access, rectification, erasure, restriction, portability and objection (Art. 15-21 GDPR), and the right to lodge a complaint with a supervisory authority, e.g. your local German Landesdatenschutzbehörde. Where processing rests on consent (the email lists), you can withdraw it at any time with effect for the future (Art. 7(3)) - the unsubscribe link in every mail does exactly that. We make no decisions with legal or similarly significant effect based solely on automated processing (Art. 22): fit scores only sort a library for you.
- Export your data: Account settings -> Privacy -> Export (machine-readable JSON).
- Delete your account: Account settings -> Privacy -> Delete account (14-day grace, then hard deletion).
- Email subscriptions: Dashboard -> Updates, or the unsubscribe link in every list mail - no login needed.
- Everything else: hello@spotyourstartup.com.
No tracking cookies
SpotYourStartup sets only strictly necessary session cookies and uses cookieless analytics; there is no consent banner because there is nothing to consent to. Details on the cookies page.