1. Who we are
This Privacy Policy explains how StartupAccelerator ("we", "us") processes personal data when you use startupaccelerator.dev. We are the controller for the processing described here. Contact: info@raptorlabs.dev.
2. What we collect
- Account — when you sign in with Google we receive your Google account identifier, email address, name, and profile photo. There are no passwords. You may replace your display name and photo in your profile; uploaded photos are stored with your account.
- Project submissions — the project details you submit (name, pitch, story, website, category, need, optional Reddit username, logo and thumbnail images) and your founder contact email. For review integrity and abuse prevention we also record the submission's IP address, approximate country, user-agent, and timestamp.
- Community activity — votes (linked to your account, or to a device identifier for signed-out voting), comments and replies, follows, and visit streaks.
- Newsletter — your email address, confirmation status, and the double-opt-in confirmation token.
- Usage data — product analytics events (page views, feature usage) with pseudonymous identifiers, and short-lived operational logs (including IP addresses) for security, rate-limiting, and debugging.
- Session recordings — a sampled minority of browsing sessions (currently about one in ten) is recorded as a replay of page interactions, so we can see where the interface confuses people. Text you type into form fields is masked before it leaves your browser and is never recorded. Recordings carry the same pseudonymous identifier as the analytics above, are processed by our analytics provider, and are not used for advertising.
3. How we use data, and on what legal basis
- Running the Service (accounts, listings, voting, comments, notifications, the Founder ID card) — performance of our contract with you.
- Review and abuse prevention (submission screening incl. automated AI triage such as spam scoring and category suggestions, rate-limiting, vote-integrity checks) — our legitimate interest in a trustworthy directory. AI triage assists our human review; publication decisions are made by a person.
- The newsletter — your consent, given by double opt-in and withdrawable with one click in any issue.
- Analytics and product improvement — our legitimate interest in understanding how the Service is used, with pseudonymous identifiers.
- Transactional email (submission decisions, and activity emails about comments and replies on your projects — on by default, off anytime in your profile settings) — contract and legitimate interest.
4. What is public
StartupAccelerator is a public community. If you participate, the following are visible to everyone and may appear in search engines: approved project profiles (including the story and media you submitted), your maker profile (name, photo, bio, links, badges, launches), your Founder ID card once you have a live project, your name and photo next to votes you cast and comments you post, follower counts, and rankings. Your founder contact email, submission IP data, and Google identifiers are never displayed publicly.
5. Cookies and similar technologies
We use a small set of first-party cookies: a signed session cookie when you sign in (essential), a device identifier that enforces one-vote-per-device (functional), and analytics identifiers (see below). An anti-bot challenge service protects our forms and sets its own operational cookie. We do not run advertising cookies or sell data to ad networks.
6. Processors and sharing
We share personal data only with service providers that process it on our instructions, under data-processing agreements, in these categories:
- Infrastructure providers — hosting, storage, media processing, email delivery, bot protection, and the AI inference behind the features described above.
- Your sign-in provider — Google, which you interact with directly when signing in; Google's own privacy policy applies to your Google account.
- EU-hosted product-analytics services — usage events with pseudonymous identifiers.
- EU-based operational monitoring — short-lived logs for security and reliability.
- A public-data retrieval service — collects publicly available r/startupaccelerator community statistics from Reddit; this processes only public Reddit data.
Where the law entitles you to it, we will identify the specific recipients of your personal data on request. We disclose data beyond the above only if the law requires it, to protect the Service and its users, or in a business transfer (in which case this policy continues to apply). We never sell personal data.
7. International transfers
The Service runs on a globally distributed infrastructure network, and some providers operate worldwide. Where personal data leaves the EEA/UK, transfers rely on adequacy decisions or Standard Contractual Clauses and equivalent safeguards maintained by our providers.
8. Retention
Account and community data are kept while your account is active. Newsletter data is kept until you unsubscribe (unsubscribed addresses are retained only as suppression records). Submission review metadata (IP, user-agent, country) is kept as long as the related submission record exists, for abuse-pattern detection. Operational logs are short-lived. Published newsletter issues are a permanent public archive; if your project is removed, the archive may retain the issue as published.
9. Your rights
Where the GDPR or similar law applies, you have the right to access, rectify, erase, restrict, or object to our processing of your personal data, the right to data portability, and the right to withdraw consent at any time (without affecting prior processing). You can edit your profile directly, unsubscribe from the newsletter with one click, and request anything else — including account deletion — at info@raptorlabs.dev. We respond within one month. You may also complain to your local data-protection authority.
10. Security
All traffic is encrypted in transit (TLS with HSTS). Sessions are cryptographically signed; administrative access is restricted and additionally gated; media uploads are re-encoded before serving; and every administrative action on user data is logged in an audit trail. No internet service can promise perfect security, but security is engineered into the Service, not bolted on.
11. Children
The Service is not directed at children and may not be used by anyone under 16 (or the age of digital consent where you live). We do not knowingly collect children's data; if you believe we have, contact us and we will delete it.
12. Changes to this policy
We may update this policy as the Service evolves. The effective date above always reflects the current version, and material changes will be announced on the Service before they take effect.
13. Contact
Privacy questions and requests: info@raptorlabs.dev.