Privacy Policy

1. Introduction

This Privacy Policy explains how BuyStartup ("we", "us", or "our") collects, uses, discloses, and safeguards your personal information when you visit our website, use our platform, or interact with our services.

We are committed to protecting your privacy and handling your data transparently, in accordance with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy laws.

By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

We collect information in three main ways: information you provide directly, information collected automatically, and information obtained from third parties.

2.1 Information You Provide

Account information — your name, email address, password (stored securely and hashed), and avatar.
Listing information — information you voluntarily submit when listing a startup on the platform, such as the startup's name, website URL, description, category, asking price, revenue metrics, and logo. This content is intended to be displayed publicly on the marketplace.
Billing information — payment card details are processed and stored by our payment provider Polar.sh. We never store full card numbers on our servers.
Communications — messages you send to our support team, survey responses, and feedback you voluntarily share.

2.2 Information Collected Automatically

When you visit our website, we collect privacy-respecting analytics through Umami:

Usage data — pages visited and non-identifying interaction metrics. Umami does not use invasive tracking cookies and does not identify individual visitors.
Device data — anonymized technical information such as browser type, operating system, and approximate region. Your IP address is not stored.
Cookies and similar technologies — see our Cookie Policy for details.

2.3 Information from Third Parties

Authentication providers — if you sign up via Google or another provider, we receive your profile information (name, email, and avatar) as permitted by those providers.
Payment providers — Polar.sh shares subscription status and payment history with us to manage your featured spots and billing.

3. How We Use Your Information

We use your personal information for the following purposes:

To create and manage your account and authenticate you securely.
To process subscriptions for Featured Spots / Global Banners, billing, and payment transactions.
To provide, maintain, and improve the platform and its features.
To send transactional emails such as account verification, password resets, and receipts.
To communicate product updates, announcements, and, where permitted, marketing content.
To detect, prevent, and address fraud, abuse, and security incidents.
To comply with legal obligations and enforce our Terms & Conditions.

4. Legal Bases for Processing

Under the GDPR, we process personal data on the following legal bases:

Contract — processing necessary to provide our services to you.
Legitimate interests — improving our product, ensuring security, and preventing fraud.
Consent — where you have explicitly agreed.
Legal obligation — where we must comply with applicable law.

We do not sell your personal information. We only share it with service providers who help us operate the platform, under strict data processing agreements:

Supabase — database and authentication infrastructure.
Polar.sh — payment processing and subscription management for Featured Spots and Global Banners.
Umami — privacy-respecting website analytics (no personally identifiable information is shared).

We may also disclose information when required by law, legal process, or governmental request, or when necessary to protect our rights, safety, or property.

6. Data Retention

We retain your personal information only as long as necessary to fulfill the purposes described in this policy, or as required by law:

Account data — retained for the duration of your account and up to 30 days after deletion.
Billing records — retained for 7 years to comply with tax and accounting obligations.
Analytics data — aggregated and non-identifying; retained only as long as necessary to understand and improve our service.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you.
Rectify inaccurate or incomplete information.
Delete your personal data ("right to be forgotten").
Restrict or object to certain processing activities.
Data portability — receive your data in a structured, machine-readable format.
Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at the details below. You also have the right to lodge a complaint with your local data protection authority.

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

10. International Data Transfers

Your information may be processed in countries outside your country of residence. Where we transfer data across borders, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent mechanisms to protect your information.

Email: info@uxally.com.ar

BuyStartup