Privacy Policy

1. Introduction & Data Controller

Startup Preflight (“we”, “our”, or “us”), founded in 2026 and headquartered in Dublin, Ireland, operates the Startup Preflight web application and AI Co-Founder & Grant Readiness platform. We are committed to protecting the privacy, intellectual property, and personal data of our founders, co-founders, institutional cohort partners, and survey respondents in compliance with the EU General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018, and the UK GDPR / Data Protection Act 2018.

For all data privacy inquiries, you can contact our Data Protection team at hello@startuppreflight.com.

2. Information We Collect

• Account & Profile Information: Name, business email address, authentication credentials, role, and jurisdiction preferences when you register for an account or join our early-access waitlist.
• Startup Plan & Workspace Data: Concept canvases, market sizing assumptions, product roadmaps, unit economics, financial projections, co-founder alignment inputs, and grant readiness materials entered across Modules A through L.
• Validation Survey & Waitlist Data: When you publish a customer discovery survey, we process the responses and optional waitlist contact details submitted by your prospective customers on your behalf as a Data Processor.
• Technical & Usage Telemetry: IP address (used strictly for security rate-limiting and regional grant localization), browser type, session cookies, and AI token consumption logs.

3. How We Use Your Data & AI Confidentiality

We process your information strictly to:

• Provide, maintain, and secure your multi-plan startup workspaces and generate structured business plans and grant application drafts.
• Deliver AI-assisted synthesis, blind-spot reviews, and grant readiness audits via enterprise cloud infrastructure (Google Cloud Platform and the Google Gemini API).
• Zero Public AI Model Training: Your proprietary startup ideas, financial projections, and business plans are processed strictly via authenticated enterprise APIs and are never sold to third parties or used to train public foundation models.
• Enforce platform security, rate limits, and entitlement quotas.

4. Legal Basis for Processing (GDPR Article 6)

• Contractual Necessity (Art. 6(1)(b)): To provide the Startup Preflight workspace, AI synthesis, and document compilation services you request.
• Legitimate Interests (Art. 6(1)(f)): To maintain platform security, prevent abuse or automated spam, and improve product reliability.
• Consent (Art. 6(1)(a)): When you opt in to our early-access waitlist, product updates, or grant radar notifications (which you may withdraw at any time).

5. Data Security & Encryption

We implement defense-in-depth technical and organizational safeguards, including TLS encryption in transit, encrypted cloud PostgreSQL storage at rest, `HttpOnly` signed session tokens, strict tenant/plan ownership verification (IDOR protection), and AES-256-GCM encryption for any user-supplied Bring-Your-Own-Key (BYOK) API credentials.

6. Infrastructure & Sub-Processors

To deliver a fast, reliable service, we rely on trusted cloud infrastructure providers bound by GDPR Data Processing Agreements (DPAs), including Google Cloud Platform (Cloud SQL, Cloud Run, and Google GenAI / Vertex AI services). Public validation survey routes isolate respondent personally identifiable information (PII) so it is accessible only to the authenticated plan owner.

7. Data Retention & Your GDPR Rights

You retain full ownership of your startup plans and may export or permanently delete your workspace data at any time. Under EU and UK GDPR, you have the right to access, rectify, erase, restrict, or export your personal data, and to lodge a complaint with the Irish Data Protection Commission (DPC) or the UK Information Commissioner's Office (ICO).