Privacy policy

Startup GPS is a navigation system for founders: company formation, entity and equity management, legal and IP, contract management, and compliance monitoring. It is operated by Startupedia Inc, a United States corporation. This policy explains how Startupedia Inc (“Startup GPS”, “we”, “us”) handles personal information.

It applies to startupgps.ai, the Startup GPS application, our newsletter and community spaces, our assessment tools, and any email or support conversation you have with us. It applies whether you are a paying customer, a prospective one, or simply reading.

We are a U.S. company and our customers are worldwide. Our services are operated from the United States and your information is processed there, wherever you happen to be. Section 9 explains what that means for you.

Under data protection law we are the controller of this information — we decide what is collected and why. Where we handle information on behalf of a company you work for, we act as a processor, and the agreement with that company governs instead of this policy.

Registered details

We are not a law firm and we do not provide legal advice.We provide software, document automation, and filing services. No attorney–client relationship is created by using Startup GPS.

This has a direct privacy consequence, and we would rather you hear it here than learn it later: information you share with us is generally not protected by attorney–client privilege. If a court or regulator compels disclosure, we may be required to produce it. If you need privileged advice, work with a licensed attorney — we are happy to point you toward one.

Where a matter needs legal judgment, we connect you with a licensed attorney. Your communications with that attorney may be privileged under the rules of their jurisdiction — but that privilege runs between you and them. It does not extend backwards to cover information you have separately stored in Startup GPS, and we are not a party to it.

We are also not a bank, a registered investment adviser, or a tax preparer. Where those services appear in your route, they are delivered by named partners under their own terms and their own privacy policies.

Information you give us

• Account details — name, email address, password, phone number, country, and your role at the company.
• Founder and owner identity information— legal name, date of birth, residential address, nationality, and government-issued identification such as a passport, national identity number, or driver’s licence. For U.S. persons this may include a Social Security number or ITIN.
• Company information — proposed and registered company names, entity type, state of formation, business purpose, registered and mailing addresses, officer and director details, ownership percentages, share allocations, and vesting terms.
• Documents you upload or generate — formation filings, operating agreements, board consents, cap tables, contracts, intellectual property records, and anything else you place in the product.
• Payment information — billing name, billing address, and the last four digits and expiry of your card. Full card numbers go directly to our payment processor. We never receive or store them.
• Assessment responses — answers you give to our founder assessment tools, including the Founder Archetype Quiz and the Idea Valuation Report.
• Community and correspondence — newsletter subscriptions, community profiles and posts, event registrations, survey responses, and the contents of support conversations.

Information we collect automatically

• Device and connection data — IP address, browser type and version, operating system, device type, screen size, language, and referring page.
• Usage data — pages viewed, features used, questionnaire steps completed, documents generated, time stamps, and error events.
• Email engagement — whether our emails are opened and which links are clicked.

Information from other sources

• Public registries — state corporate registries, the IRS, and similar public sources, used to confirm entity status and filing deadlines.
• Service partners — filing status, agent-of-record confirmations, and payment outcomes from the partners named in section 7.
• Referrals and shared workspaces — where a co-founder, adviser, or investor adds you to a company workspace, we receive the details they provide about you.

We use personal information only for the purposes below. Where the law requires us to identify a lawful basis, this table states it.

Where we rely on consent, you can withdraw it at any time without affecting anything we did beforehand. Where we rely on legitimate interests, you can object — see section 11.

Company formation cannot happen without identity verification. We ask for passports, national identity numbers, and proof of address because state registries, registered agents, and banking partners require them — not because we want them on file.

How we handle them:

• Identity documents are encrypted at rest and access is restricted to the personnel and partners who need them for a specific filing or verification.
• We do not use identity documents for marketing, profiling, or automated decision-making.
• Where a partner can complete a verification without receiving the underlying document, we send the verification result rather than the document.
• Identity documents are retained under section 10 and deleted on that schedule.

Some laws treat identifiers of this kind, and the facial images inside them, as sensitive or specially protected data. We handle them on that basis regardless of which law applies to you.

Parts of Startup GPS use AI models to draft documents, summarise contracts, and answer questions about your route. When a feature does this, content you have submitted is sent to a model provider to generate the response.

• Your content is not used to train models. Our provider agreements prohibit training on data submitted through our account, and we do not train models on it ourselves.
• AI output is a draft, not advice. Every document a model produces is reviewed before it is filed, and none of it is legal advice.
• Our routing engine does not make legal decisions. It determines what happens next on your route — which step comes now, which document is needed, which queue a matter belongs in. It does not resolve legal questions. Every action that requires legal judgment is flagged and sent to a licensed attorney for human review, and where you need advice we connect you with one.
• No decision about you is made by automation alone. We do not subject you to decisions with legal or similarly significant effects that are based solely on automated processing. You can ask for human involvement, express your view, and contest an outcome at any point.
• The provider is identified. Our current model provider is named on our subprocessor list, which we update before any change takes effect.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We do share it with the categories of service provider below. Each is bound by contract to protect it, to use it only for the work we have given them, and to delete or return it when that work ends.

The named list

We keep a current, named list of the individual service providers in each category, together with where each one processes data. It lives at startupgps.ai/subprocessors and is updated whenever a provider is added or replaced. We publish it separately so that it stays accurate between revisions of this policy, rather than going stale inside it.

• If you are a customer, you can subscribe to change notifications on that page and object to a new provider before it takes effect.
• If you are an enterprise or regulated customer, the same list is attached to our data processing agreement. Write to privacy@startupgps.ai.
• If you need the names to exercise a right under your local law, ask us and we will give them to you. That right does not depend on a commercial agreement.

We also share information in these situations:

• Government authorities. State registries, the IRS, and equivalent bodies receive the information required by the filings you instruct us to make. Some of it, including officer names and registered addresses, becomes part of the public record.
• Your own team. Co-founders, employees, advisers, and investors you invite to a workspace see the information you grant them access to.
• Professional advisers. Our lawyers, accountants, auditors, and insurers, where they need it and under confidentiality obligations.
• Legal requirements.Where we are compelled by valid legal process, or where disclosure is necessary to investigate fraud or protect someone’s safety. Where we are permitted to notify you first, we will.
• Business transfers. If Startup GPS is acquired, merged, or reorganised, information may transfer as part of that transaction. It would remain subject to this policy until you are told otherwise, and you would be told before any material change.

We use cookies and similar technologies for three things: keeping you signed in, remembering your preferences, and measuring how the product is used.

Where the law requires consent for non-essential cookies, we ask before setting them and you can change your answer at any time. We do not use advertising cookies and we run no third-party ad trackers. We honour Global Privacy Control signals as an opt-out request where applicable law recognises them.

Startupedia Inc is a United States company, and Startup GPS is available to founders anywhere. Whoever you are and wherever you are, your information is transferred to and processed in the United States, and in other countries where our service providers operate. There is no local or regional instance of the product.

This is not incidental to the service — it is the service. Startup GPS exists to give founders outside the United States access to U.S. company infrastructure, and a U.S. entity cannot be formed without transmitting founder information to U.S. authorities and agents.

If you are in Nigeria, Kenya, the European Economic Area, the United Kingdom, or another country with transfer restrictions, we rely on the following to make that transfer lawful:

• Necessity for your contract. The transfer is required to perform the service you have asked us to perform.
• Standard contractual clauses or equivalent approved safeguards with partners where required.
• Your explicit consent where no other basis is available, given after we have explained the risk.

The United States does not have a general data protection law equivalent to Nigeria’s, Kenya’s, or the EU’s, and U.S. authorities may have access rights that your home country’s law would not permit. We think you should know that before you start, not after.

You can request details of the safeguards we apply by writing to privacy@startupgps.ai.

Some of what we hold we would delete tomorrow if you asked. Some of it we are legally required to keep, and a deletion request will not override that. This is the schedule.

When a period ends we delete the information or irreversibly anonymise it. Anonymised data is no longer personal information and may be kept indefinitely.

Wherever you are, you can ask us to do the following. Some rights carry conditions or exceptions under your local law, and we will explain if one applies to your request.

• Access — get a copy of the personal information we hold about you.
• Correction — fix information that is wrong or incomplete.
• Deletion — have information erased, subject to the retention obligations in section 10.
• Portability — receive your information in a machine-readable format, or have it sent to another provider.
• Restriction and objection — ask us to pause a use, or object to processing based on legitimate interests.
• Withdraw consent — at any time, without affecting processing already carried out.
• Opt out of marketing — through the unsubscribe link in any email, or by writing to us.
• Complain — to your data protection authority, listed below.

Where your rights come from

For California residents

In the twelve months before this policy’s effective date we collected the categories described in section 3 and disclosed them for business purposes to the partners in section 7. We have not sold personal information and have not shared it for cross-context behavioural advertising. We do not knowingly do so for anyone under 16. We use sensitive personal information only for the purposes permitted without a right to limit — verifying identity and delivering the service you requested. We will not discriminate against you for exercising any right.

How to make a request

Write to privacy@startupgps.ai with the email address on your account and what you want us to do. We will verify your identity before acting — usually through your account email, and for higher-risk requests through additional confirmation.

We respond within 30 days, and will tell you if we need longer. There is no charge unless a request is repetitive or excessive, in which case we will tell you the cost before doing the work. You may use an authorised agent where your law permits, with written proof of authority.

We protect information with encryption in transit and at rest, role-based access control, multi-factor authentication on administrative accounts, logging of access to identity documents, and vendor review before any partner is given access to founder data.

No system is perfectly secure, and we will not claim otherwise. If a breach affects your information and the law requires notification, we will notify you and the relevant regulator within the required timeframe.

If you believe your account has been compromised, or you have found a vulnerability, write to security@startupgps.ai. We do not pursue good-faith security researchers who report responsibly.

Our current security posture, including certification status, is published at startupgps.ai/trust.

Startup GPS is for adults. You must be at least 18 to create an account, and we do not knowingly collect information from anyone under 18. If we learn we have, we delete it. If you believe a minor has given us information, write to privacy@startupgps.ai.

Our site links to other services, and partners in your route operate under their own privacy policies. We are not responsible for how they handle your information. Read their policies before you hand anything over — including on our social channels, where anything you post publicly is public.

We update this policy when our practices change. The effective date at the top always reflects the current version.

For minor changes we update the page. For material changes — a new category of information, a new purpose, or a new class of recipient — we will notify account holders by email at least 14 days before the change takes effect, so you have time to object or close your account. We keep previous versions available on request.

Questions, requests, and complaints all go to the same place, and a person reads them.

If you are not satisfied with our response, you can complain to your data protection authority using the table in section 11. We would rather you came to us first, but you are not required to.

Startup GPS privacy policy · Version 1.0 · Effective [DATE]