Privacy Policy

We collect the following categories of information:

• Information you provide: your name, email address, company details, project Requests and briefs, and any assets, content, files, or credentials you share with us so we can complete a build.
• Account and billing information: when you approve a subscription, PayPal collects and processes your payment details. From PayPal we receive limited billing data such as your name, email address, country, subscription id and status, and payment history. We never receive or store full card numbers, CVV codes, or bank credentials.
• Communications: emails, support messages, comments on the project board, and any call bookings you make with us.
• Information collected automatically: device, browser, approximate location, and usage data such as pages visited, referring page, and actions taken, gathered through cookies and similar technologies.

We use the information we collect to:

• Provide, operate, and deliver the subscription service and your Requests
• Set up and manage your account, queue, and project board
• Process payments, renewals, and refunds through PayPal, and handle our own invoicing and tax obligations
• Communicate with you about your account, Requests, delivery, and support
• Send service and billing notices, and — only with your consent where required — occasional product updates you can unsubscribe from at any time
• Improve, troubleshoot, and secure our website and service, and prevent fraud and abuse
• Comply with legal, tax, and accounting obligations and enforce our Terms

Where the GDPR or similar laws apply, we rely on the following legal bases: performance of a contract (to deliver the Service you subscribed to and process your payments); our legitimate interests (to secure and improve the Service, prevent fraud, and communicate with clients), balanced against your rights; compliance with a legal obligation (tax, accounting, and record-keeping); and your consent, where we ask for it — for example for non-essential cookies or marketing email. You may withdraw consent at any time without affecting processing already carried out.

Payments are processed by PayPal (PayPal Pte. Ltd. and its affiliates, "PayPal"), acting as our payment processor. When you subscribe, you are taken to PayPal to approve the subscription and your payment details are submitted directly to PayPal, processed on PayPal's systems under PayPal's own privacy statement available at paypal.com. PayPal is an independent controller for the payment data it collects and is responsible for payment processing, fraud screening, and settlement.

StartupSub receives from PayPal only the limited billing information described above — enough to identify your subscription, provide support, honour refunds, and meet our accounting obligations. We do not have access to your full card number and cannot use your payment method for anything other than the subscription you agreed to.

We use cookies and similar technologies to keep the site working, remember your preferences (such as light or dark mode), and understand how the site is used so we can improve it. Strictly necessary cookies are required for the site and checkout to function. Analytics and preference cookies are optional, and where required by law we ask for your consent before setting them.

You can control cookies through your browser settings; blocking some cookies may affect how the site functions. Checkout takes place on PayPal's own pages, and our booking widget is embedded from Cal.com; those providers may set their own cookies subject to their privacy notices.

We do not sell your personal data. We share it only as needed to run the service, and only with providers bound by confidentiality and data-protection obligations:

• PayPal — payment processing, subscription billing, and refunds.
• Plane — the project management platform where Requests, briefs, and deliverables are managed.
• Hosting and cloud infrastructure providers — to run the website and store project files.
• Communication and scheduling tools — email delivery and the Cal.com booking widget.
• Analytics providers — aggregated and pseudonymised usage insight about the website.
• Professional advisers, and legal or regulatory authorities — where required by law, regulation, or legal process, or to establish, exercise, or defend legal claims.
• A successor entity — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

We retain personal information for as long as your Subscription is active and as needed to provide the service. After your Subscription ends we keep project data for up to twelve (12) months so we can hand over or restore work on request, and we keep billing and tax records for as long as required by applicable law (typically six to ten years). When information is no longer needed, we delete or anonymise it. You may ask us to delete project data sooner — see your rights below.

We use reasonable technical and organisational measures to protect your information, including encryption in transit, access controls limited to team members who need the data, and confidentiality obligations for everyone on the Builder Squad. Credentials you share with us are stored only for as long as needed to complete the relevant build, and we ask that you provide scoped, revocable access wherever possible. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Depending on where you live, you have rights to access a copy of your personal data, correct inaccurate data, delete it, port it to another provider, object to or restrict certain processing, and withdraw consent. Residents of California may additionally request disclosure of the categories of data collected and opt out of "sale" or "sharing" — we do neither — and will not be discriminated against for exercising any right.

To exercise any right, email startupsubpro@gmail.com from the address associated with your account. We will verify your identity and respond within the period required by applicable law — normally within thirty (30) days. There is no charge unless a request is manifestly unfounded or excessive.

We handle personal data in line with Sri Lanka's Personal Data Protection Act No. 9 of 2022 and, where they apply, the GDPR, UK GDPR, and CCPA/CPRA. If you are in the EEA or UK and believe we have not handled your data properly, you may lodge a complaint with your local supervisory authority — though we would appreciate the chance to resolve it with you first.

We operate from Sri Lanka, and our service providers operate in the United States, the European Union, the United Kingdom, and elsewhere. Your information may therefore be transferred to and processed in countries whose data-protection laws differ from those of your own. Where such transfers involve personal data protected by the GDPR or UK GDPR, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum.

Our website may link to third-party sites and services that we do not control. This Policy does not apply to those sites, and we encourage you to review their privacy practices before providing them with personal data.

Our service is intended for businesses and is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it promptly.

We may update this Policy from time to time. When we make material changes, we will update the "last updated" date at the top of this page and, where appropriate, notify you by email. Your continued use of the service after changes take effect constitutes acceptance of the updated Policy.

For any question about this Policy or our data practices, or to exercise your rights, contact StartupSub at startupsubpro@gmail.com. Postal address: StartupSub, Puttalam, Sri Lanka. We reply to privacy enquiries within two (2) business days.