Privacy Policy

This Privacy Policy explains how StartupKit.pro ("StartupKit", "we", "us", or "our") collects, uses, stores, protects, and shares information when you use our website and software-as-a-service platform (the "Service"). It also describes your rights and how to exercise them. By using the Service you agree to the practices described here. If you do not agree, please do not use the Service.

1. Who We Are

StartupKit.pro is a bilingual startup operating system for founders. For the purposes of applicable data protection laws (including the EU/UK GDPR and the Saudi Personal Data Protection Law), StartupKit.pro acts as the data controller for account information and as a processor for the business content you store in the Service. You can reach us about any privacy matter at hi@startupkit.pro.

2. Information We Collect

• Account data: your name, email address, password (stored only as a secure hash), and account preferences.
• Your business content: the startup information, financials, plans, documents, and other content you create or upload while using the tools.
• Payment data: when you subscribe, payments are processed by our payment provider (Stripe). We do not store your full card number — we receive only limited billing details and subscription status.
• Usage & device data: pages visited, features used, interaction patterns, approximate location, browser and device information, collected to operate and improve the Service.
• Communications: messages you send us (e.g., support or contact requests).

3. How We Use Your Information & Legal Bases

We use your information to: provide, operate, and secure the Service; personalize your experience; process payments and manage subscriptions; communicate with you about your account, support, and updates; and improve and develop new features. We rely on the following legal bases: performance of a contract (to deliver the Service you signed up for), your consent (e.g., optional analytics and marketing emails, which you can withdraw at any time), legitimate interests (to keep the Service secure and improve it), and legal obligation. We do not sell your personal data.

4. Data Storage, Encryption & Security

StartupKit.pro is an encrypted SaaS platform. Your data is encrypted both in transit (TLS/HTTPS) and at rest on secure, access-controlled cloud infrastructure, and is protected with industry-standard encryption. We apply row-level access controls so that each account can only access its own data. Access to customer data by our team is strictly limited to a small number of authorized personnel, and only when necessary to operate, secure, or support the Service. We never sell your data, and we do not share or disclose it to any third party except as described in this policy.

5. Confidentiality & Non-Disclosure

We treat everything you store in StartupKit.pro — your startup data, financials, plans, documents, and any other content you create — as strictly confidential, with the same care given to information protected under a non-disclosure agreement (NDA). We do not view, use, reproduce, publish, or reveal your confidential business data to anyone outside StartupKit.pro, and our team is bound by internal confidentiality obligations. This commitment continues for as long as we hold your data.

This confidentiality commitment does not apply where disclosure or access is: (a) necessary to provide, operate, secure, or support the Service (including via the trusted sub-processors listed below); (b) authorized by your explicit consent; (c) required by law, court order, or a valid governmental or regulatory request; or (d) caused by events beyond our reasonable control (force majeure) — including, without limitation, cyberattacks or security incidents occurring despite reasonable safeguards, infrastructure or third-party provider failures, natural disasters, war, civil unrest, or other circumstances we could not reasonably foresee or prevent.

6. Third-Party Sub-Processors

To run the Service we rely on a small set of trusted providers that process data on our behalf under their own security and data-protection commitments. We do not authorize them to use your data for their own purposes.

• Supabase — database, authentication, file storage, and hosting infrastructure.
• Stripe — payment processing and subscription billing.
• Brevo — email delivery and contact/CRM management.
• Resend — transactional email delivery.
• Vercel — application hosting and delivery.
• Mixpanel & PostHog — product analytics (usage insights).

We review our sub-processors for appropriate safeguards and update this list as our providers change.

7. International Data Transfers

StartupKit.pro serves founders across the MENA region and beyond, and our providers may process data in countries other than your own. Where data is transferred internationally, we rely on appropriate safeguards such as Standard Contractual Clauses, adequacy decisions, or equivalent mechanisms required by the EU/UK GDPR and the Saudi PDPL, and we take reasonable steps to ensure your data remains protected to the standard described in this policy.

8. Data Retention

We retain your account data and business content for as long as your account is active. If you delete your account or request deletion, we will delete or irreversibly anonymize your personal data within 30 days, except where we are required to retain certain records (for example, billing and tax records) for a longer period under applicable law. Residual copies may remain in encrypted backups for a limited time (up to 90 days) before being overwritten. Aggregated, anonymized analytics that can no longer identify you may be retained to improve the Service.

9. Your Privacy Rights

Depending on where you live (including under the GDPR and the Saudi PDPL), you have the right to: access your personal data; correct inaccurate data; delete your data; restrict or object to certain processing; receive a portable copy of your data; and withdraw consent at any time. You may exercise any of these rights — including exporting your data or deleting your account — by contacting us at hi@startupkit.pro. We will respond within the timeframe required by applicable law (generally within 30 days). You also have the right to lodge a complaint with your local data protection authority.

10. Cookies

We use essential cookies for authentication and session management. With your consent, we may use analytics cookies to understand how you use the platform. You can control cookie preferences through your browser settings; disabling essential cookies may affect core functionality.

11. Children's Privacy

The Service is intended for users aged 18 and over and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us and we will delete it.

12. Data Breach Notification

We maintain reasonable safeguards to protect your data. In the event of a personal data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority and affected users without undue delay, in accordance with applicable law.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

14. Contact Us

For any questions, requests, or complaints about this Privacy Policy or your data, contact us at hi@startupkit.pro.