Privacy Policy

For personal information we collect directly (for example your account details, billing info, support interactions), StarterApp acts as a data controller (GDPR) / business (CCPA/CPRA).

If you use StarterApp to build your own products that process your end users’ personal data, you act as the controller/business for that data.

We collect personal information only when necessary, by lawful and transparent means.

We do not knowingly collect sensitive personal information (for example health data, precise geolocation).

We use personal information to:

• Provide, operate, and secure the Service (auth, session management, fraud prevention, debugging)
• Process purchases and manage subscriptions or licenses
• Provide support and respond to inquiries
• Improve and develop the Service (usage analytics, quality, performance)
• Send transactional messages (for example account notices, critical updates)
• Comply with law, enforce our Terms and policies, and protect rights and safety

We do not sell personal information.

Where GDPR applies, we rely on:

• Contractual necessity (to provide the Service you request)
• Legitimate interests (security, product improvement, preventing abuse, limited analytics)
• Consent (where required by law, for example certain cookies or marketing)
• Legal obligation (tax, accounting, compliance)

We disclose personal information only as necessary:

• Service providers / subprocessors. Hosting, authentication, payments, analytics, logging, and optional AI integrations. These providers act under contract and process data on our behalf.
• Legal & safety. To comply with applicable law, lawful requests, or to protect rights, safety, and security.
• Business transfers. In a merger, acquisition, financing, or asset sale, information may be transferred under confidentiality.

We do not rent or sell your personal information. We do not share Google OAuth profile data for advertising.

Your information may be transferred to and processed in countries other than your own. Where required, we use appropriate safeguards (for example Standard Contractual Clauses, UK Addendum) to protect personal information transferred internationally.

We keep personal information only as long as necessary for the purposes in this Policy, including to meet legal, accounting, or reporting requirements. Typical retention periods:

• Account & profile data: While your account is active and up to 24 months after closure (to allow you to re-activate and for fraud or security auditing), unless you request earlier deletion and law permits.
• Billing/transaction records: Up to 7 years (tax or accounting laws).
• Logs & security data: Typically 30–180 days, unless needed to investigate issues or comply with law.

We may anonymize or aggregate data for analytics; anonymized data is not subject to deletion requests.

We use commercially reasonable safeguards to protect personal information, including encryption in transit, access controls, environment isolation, and vulnerability management. No method of transmission or storage is 100% secure; you are responsible for safeguarding your account credentials and securing your deployments.

We use minimal cookies and similar technologies for:

• Authentication/session (required for login and maintaining your session)
• Security (for example CSRF or rate-limit tokens)
• Basic analytics to understand feature usage and improve reliability

Where required by law, we will request consent for non-essential cookies and provide controls to manage preferences. Disabling required cookies will prevent login or certain features from working.

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete personal information (subject to legal or contractual exceptions)
• Restrict or object to certain processing
• Data portability
• Opt out of certain disclosures defined as “sharing” or “selling” under CPRA (we do neither)
• Withdraw consent where processing is based on consent

To exercise rights, see §12.

You can manage much of your data in-product. For formal requests:

• Email: legal@starter.app
• Please include: your name, email, the request type, and any relevant context. We may verify your identity before fulfilling requests. We will respond within the timeframes required by applicable law.

To delete your account, submit a deletion request via email or any provided in-app deletion flow. Deleting your account will remove or de-identify personal information not subject to legal retention.

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided personal information, contact us to remove it.

Our website and docs may link to external sites we do not control. We are not responsible for their content or privacy practices. Review their policies before providing information.

We may update this Policy from time to time. Material changes will apply prospectively and be indicated by the “Last updated” date above. Your continued use after changes become effective constitutes acceptance.

StarterApp
All inquiries: legal@starter.app