Privacy Policy

1. Introduction

StartBlox, Inc. ("Company," "we," "us," or "StartBlox") respects your privacy and is committed to protecting it through our compliance with this policy.

This policy is a privacy notice. It describes the types of information we may collect from you, or that you may provide, when you use startblox.com and the StartBlox Platform (together, the "Website," as defined in our Terms of Use), and our practices for collecting, using, maintaining, protecting, and disclosing that information. It is not a contract, and it does not create contractual obligations that displace or limit your rights under applicable privacy law. Read it alongside our Terms of Use and our Subscription Agreement, which are the agreements that govern your use of the Website and any Subscription.

This policy applies to information we collect on the Website, in email and other electronic messages between you and StartBlox, and when you interact with our advertising or content on third-party sites, if that content links to this policy. It does not apply to information collected by any third party, including a Recommended Vendor you visit after clicking a link from the Website — that is governed by that third party's own privacy policy.

Who this policy covers. This policy describes how we handle information about everyone who interacts with us, including:

• Website visitors who browse startblox.com without creating an Account.
• Quiz takers who complete the founder-readiness quiz or a similar public tool.
• Leads who give us an email address to receive updates before creating an Account.
• Account holders — the Subscriber who creates an Account and, where a Subscription is paid for, the person or entity responsible for it.
• Workspace Members — people invited to a Business as an owner, advisor, or member.
• Advisors who use the Platform to work with client Businesses.
• Invitees who have been sent an invitation to a Business but have not yet accepted or declined it.

Acknowledgment, not agreement. We ask you to read this policy so you understand our practices; we do not ask you to agree to it as a contract. When you create an Account, you confirm at signup that you have reviewed this policy. Where the law requires your consent for a specific use of your information, we will ask for that consent separately, at the time it applies. If you do not want us to handle information as described here, your choice is not to use the Website. We may change this policy from time to time (see Section 15).

2. Children's Privacy and Age Requirements

No use under 13. The Platform and Website may not be used by anyone under 13 years of age, in any capacity, including under an adult's supervision. We do not knowingly collect personal information from anyone under 13. If we learn that a person under 13 has used the Platform, we will delete the associated personal information and remove the associated Workspace Member access.

Accounts are 18+. You must be at least 18 years old and legally capable of entering into a binding contract to create an Account, hold a Subscription, or act as the Subscriber under the Subscription Agreement. You confirm this at signup. A minor may not create or hold an Account of their own.

Supervised use by teens (13–17). A parent or legal guardian who holds an Account may allow a minor who is at least 13 years old to use the Platform with them, under their supervision, as a Workspace Member on a Business the parent or guardian owns. In that case, any information about the minor that reaches us is submitted through and under the supervising adult's Account, and the parent or guardian remains solely responsible for the minor's use of the Platform. We do not knowingly collect personal information directly from a minor independent of that supervising adult's Account.

If you believe we might have information about a child under 13, or about a minor outside a supervising adult's Account, contact us at hello@startblox.com and we will delete it.

3. Information We Collect

(a) Information You Provide to Us

• Account information: your name, email address, profile photo (if you upload one), and — if you use email/password sign-in rather than a magic link — a password, which our authentication system stores only in hashed form (we cannot read the password itself).
• Business and diagnostic profile information: your business name and logo; your industry (primary and any secondary industries); your business's stage and milestones; and profile fields you answer during intake, including your business's location — country, state/province, and city (city is entered as free text) — founder count, funding status, customer type, business presence, and other industry-specific fields.
• Diagnostic answers and content: your answers to diagnostic questions, and any related notes or selections you make while working through the Platform's action plan (for example, marking an action as started, complete, or dismissed).
• AI Advisor interactions: questions you submit to the AI Advisor, and any thumbs-up/thumbs-down feedback or optional written comment you leave on AI Advisor or Platform content. We do not currently retain a transcript or history of your AI Advisor conversations after a response is generated (see Section 5(c)).
• Team and portfolio information: if you invite another person to a Business (as an advisor or team member) or accept an invitation yourself, we collect the relevant email address, invited role, and invitation status.
• Billing information: your selected Subscription Plan and billing cycle, and your billing address, which you enter in the Platform under Settings → Billing. We pass your billing address to our payment processor so it can process your payment and calculate the taxes that apply to it. Your payment card or bank details are collected and stored by our payment processor, not by StartBlox directly — we retain only a reference ID and status information (for example, trial end date, renewal date, and payment status).
• Communications: records and copies of correspondence if you contact us, and your responses to any survey we ask you to complete.
• Pre-signup marketing information: if you provide your email address to receive updates before creating an Account (for example, through a marketing page), we collect that email address and how you found us.

(b) Information We Collect Automatically

As you use the Website, we and our analytics provider automatically collect certain information about your equipment, browsing actions, and usage patterns, including:

• Pages and features you visit or use, and actions you take within the Platform (for example, completing an intake step, viewing a Focus, or clicking a Recommended Vendor link).
• Automatic interaction data — clicks, taps, form interactions, and frustration signals such as rapidly repeated clicks — captured by our analytics provider to help us understand how features are used. We do not capture the contents you type into form fields as part of this automatic collection.
• Error and crash diagnostics, including limited technical context such as the page where an error occurred, used to detect and fix problems. Authentication tokens are removed from the page addresses recorded with this information.
• Your general industry and location (as provided in your profile), associated with this usage information.
• Device and connection information, including IP address, browser type, and operating system.
• Standard web log data (timestamps, referring/exit pages, and similar technical data).

General location only. The location information we collect is general: the country, state or province, and city you enter in your profile, and the same general level of location that we or our providers derive from your IP address. We do not collect GPS-level or similarly precise location, and we do not attempt to determine where you are beyond that general level.

Session replay. We use session replay, provided by our analytics provider (PostHog), to record how you interact with our pages — mouse movement, clicks, scrolling, and navigation — so we can diagnose problems and improve usability. These recordings are configured to mask all form inputs and all on-screen text by default; passwords are always masked. What the recordings capture is the pattern of your interaction — where you clicked, how you scrolled, how you moved through the Platform — not the words on your screen or the information you type. If your browser sends a Global Privacy Control (GPC) signal, we honor it before any recording or analytics capture begins, so no recording is made. Recordings are retained by our analytics provider for 30 days, after which they are deleted. Our analytics provider processes this automatically-collected usage information, including these recordings, in the United States.

This usage information is tied to your Account internally (it is pseudonymous, not anonymous, in our systems) so we can operate and improve the Platform, including compiling it — together with your diagnostic answers and profile information — into the Aggregated Statistics described in our Subscription Agreement. When we disclose or use Aggregated Statistics outside of operating your own Account (for example, for benchmarking or product-improvement purposes), it is in de-identified, aggregate form that does not identify you or your Business. See Section 4.

(c) Information We Collect from Third Parties

If you sign in using a third-party identity provider, we receive the information that provider shares with us as part of that sign-in (typically your name and email address). Our payment processor shares subscription and payment status information with us (not full card or bank account numbers). If you're invited to a Business by another Subscriber, we receive the email address and role information that Subscriber provides about you.

4. Aggregated Statistics

"Aggregated Statistics" has the meaning given in our Subscription Agreement: data about your use of the Platform — including diagnostic answers, industry, general location, and in-app actions — that we compile in an aggregate and de-identified manner to produce statistical and performance information about the Platform, and to improve it for you and others. StartBlox owns Aggregated Statistics outright once compiled. We do not disclose Aggregated Statistics in a form that identifies you or your Business, and we do not attempt to re-identify individuals from Aggregated Statistics we've compiled or received.

5. How We Use Your Information

We use the information described in Section 3, including personal information, to:

• Provide, operate, and personalize the Platform, including generating your diagnostic scores, action plan, and AI Advisor responses.
• Process transactions, calculate and collect applicable taxes, send billing notices, and enforce our agreements with you.
• Send you service communications (for example, account, subscription, or security notices) and, if you've opted in, marketing communications.
• Compile Aggregated Statistics as described in Section 4.
• Maintain the security and integrity of the Platform, including detecting and preventing fraud or misuse.
• Comply with legal obligations and enforce our Terms of Use and Subscription Agreement.
• With your consent, or for any other purpose we disclose to you at the time you provide information.

(a) AI Advisor Processing

When you submit a question to the AI Advisor, relevant profile and diagnostic information is sent to our AI model provider, Google (Gemini). Google processes this information to provide and operate the AI service, including generating the requested response and maintaining applicable security, abuse-prevention, and safety controls. We do not permit Google to use this data to train its general-purpose foundation models. See Section 2(g) of our Subscription Agreement for the related contractual terms.

(b) Marketing Communications

If you provide your email for updates, or opt in during signup, we may send you marketing communications. You can opt out at any time using the unsubscribe link in those emails, or by emailing hello@startblox.com. This does not affect service communications necessary to operate your Account or Subscription — for example, security, billing, and account notices, which you receive for as long as your Account is open.

(c) AI Advisor Retention

We do not currently store a transcript of your AI Advisor conversations. We do retain the fact that you interacted with the AI Advisor (as part of general usage information under Section 3(b)) and any explicit feedback you leave. Our AI model provider may temporarily process and retain what you submit under its own enterprise terms, separate from what we keep. If our practice changes — for example, if we begin retaining conversation history to improve the feature — we will update this policy.

6. How We Share Your Information

We do not sell personal information as defined by applicable law. We may share it as follows:

• Service providers who process it on our behalf, under contractual confidentiality and use restrictions (including data processing agreements where applicable), including: our database and hosting providers (Neon, Vercel), our payment processor (Zoho), our AI model provider (Google), our transactional email provider (Resend), and our product analytics provider (PostHog). These providers process your information on our behalf under contracts that restrict how they may use it. Each provider's handling of personal information is further described in its own privacy documentation, which governs its practices. Our payment processor may also process limited payment-related information for its own legal obligations (such as fraud prevention and financial compliance), as described in its privacy policy.
• Recommended Vendors, when you click a vendor link from your action plan. When you intentionally click a Recommended Vendor link, you direct us to transmit the link parameters described here to that vendor; StartBlox may receive compensation if you later engage that vendor. The link includes a UTM tracking code so StartBlox can be credited for the referral, and in some cases your general location (country, state/province, or city) and/or your industry as additional link parameters, which the vendor's site can read and may record in its own logs. We do not include your name, email, or other directly identifying Subscriber Data in that link. If you would rather we not include the location and industry parameters, email hello@startblox.com with the subject line "Referral Link Opt-Out" and we will stop including them in your referral links; the UTM code itself, which does not directly identify you, is not affected. The same opt-out is available under Section 13. Any information you then choose to provide directly to that vendor's own site is governed by their privacy policy, not this one.
• Workspace Members on your Business, as described in Section 8.
• In a business transfer, such as a merger, acquisition, or sale of assets, subject to standard confidentiality expectations.
• To comply with law, such as a court order, subpoena, or governmental request, or to protect the rights, property, or safety of StartBlox, our Subscribers, or others.
• With your consent, or to fulfill a purpose you've directed (for example, if you use a feature that shares specific content with a third party).

7. Our Role: Information About Other People

For most of what we handle, we decide why and how information is used: your Account details, your Subscription and billing, security, analytics, and our own marketing. This policy describes those uses, and you can exercise the rights in Sections 12 and 13 with us directly.

Some information is different. When a Subscriber enters information about other people — a co-founder, an employee, a contractor, a client, or an investor — we handle that information on the Subscriber's behalf, following that Subscriber's instructions and our agreements with them, rather than deciding on our own how it is used. If you are one of those people and you want to know what is held about you, or want it corrected or deleted, the Subscriber who entered it is usually the right place to start, because they control the Business and its content. You can still contact us at hello@startblox.com. We will help — by passing the request to the right Subscriber, by assisting them in responding, or by acting directly where the law requires us to — and we will tell you which route we're taking.

Subscribers are responsible for having the right to submit information about other people, and for giving those people any notice their own obligations require. That responsibility is set out in the Subscriber Responsibilities section of the Subscription Agreement.

8. Workspace Access and Visibility

A Business can have more than one Workspace Member, in an owner, advisor, or member role, as described in Section 3(b) of our Subscription Agreement. Workspace Members can see the Business they belong to — including its profile information, diagnostic answers, action plan, scores, and Platform-generated outputs — and their actions in that Business are visible to the other Workspace Members on it. An advisor you invite can see the Subscriber Data on that Business; the Business's Subscription Plan, tier, and usage entitlements follow its owner.

AI Advisor conversations are the exception. Your conversations with the AI Advisor are individual to you: they are visible only within your own session, and no other Workspace Member — including a Business's owner or an advisor — can see them. As described in Section 5(c), we do not store AI Advisor chat history on our servers at all, so there is no stored conversation for anyone else to access, and your chat history is not part of the Business's record. The only related information we keep is feedback you deliberately choose to submit about the AI Advisor's responses.

Membership is per Business, not per Account. Belonging to one Business does not give a person access to any other Business in your portfolio, or to your Account settings or billing information.

When a Workspace Member is removed, leaves, or has an invitation revoked, their access to that Business ends going forward. What they contributed while they had access — answers, notes, action states — generally remains part of the Business, because it is part of that Business's record, not theirs. If a Business is handed off to a new owner, the new owner has the access the owner role carries.

9. Cookies and Similar Technologies

We and our service providers use cookies, browser local storage, and similar technologies for the following purposes:

• Strictly necessary — to keep you signed in and maintain the security of your session. The Website will not function properly without these.
• Preferences — to remember your interface choices, such as your theme and sidebar state.
• Analytics — to understand how the Platform is used, via our analytics provider (PostHog). PostHog sets cookies and stores identifiers in your browser's local storage to measure usage as described in Section 3(b). These identifiers are pseudonymous and are not used for advertising.

You can set your browser to refuse some or all cookies, or to alert you when cookies are being sent; if you disable cookies, some parts of the Website may not function properly. We honor the Global Privacy Control (GPC) browser signal: if your browser sends a GPC signal, we treat it as a request to opt out of analytics and session replay, and we apply it before any capture begins. GPC does not currently change the referral-link parameters described in Section 6; to turn those off, use the email opt-out described there. We also respect the Do Not Track (DNT) browser setting. We do not currently use third-party advertising cookies on the Website, and our use of analytics cookies is not a "sale" of your personal information.

10. Data Retention, Account Closure, and Deletion

We keep information for as long as we need it for the purpose we collected it for, and then delete it or keep it only in de-identified form. Because different information serves different purposes, the periods differ:

• Account and profile information, Business information, and diagnostic content — kept for as long as your Account is open, and deleted 90 days after the Account is closed, except where a category below requires longer retention. Subscriber Data associated with a Business is not deleted on that schedule if the Business continues under another eligible Workspace Member or is transferred through a handoff; it then remains subject to this policy and the applicable Subscription Agreement until that Business is deleted or the continuing Account is closed.
• Billing and tax records — kept for as long as required for tax, accounting, and legal compliance, which is longer than the life of your Account. This includes invoices, payment status, and the billing address used to calculate tax.
• Usage and analytics information (Section 3(b)) — retained by our analytics provider for the period configured in our analytics account, after which it is deleted or kept only in de-identified, aggregated form. Session replay recordings follow the replay retention setting described in Section 3(b).
• Backups — routine backups are overwritten in the ordinary course within 30 days. Information deleted from our live systems may persist in a backup until it is overwritten.
• Security and fraud records — kept as long as needed to investigate and prevent abuse, and to establish or defend legal claims.
• AI Advisor content — we do not save your AI Advisor conversations as chat history in your Account (see Section 5(c)). Our AI model provider may temporarily process and retain what you submit under its own enterprise terms.
• Correspondence and support records — kept for as long as needed to handle your request and to keep a record of what we told you.
• Aggregated Statistics — once compiled, retained in de-identified form and not deleted along with your Account, since they no longer identify you.

What the different endings mean. These are distinct, and they have different effects on your information:

• Cancelling a paid Subscription stops future renewal. Your access continues through the term you've paid for, and nothing is deleted.
• Downgrading to the Free Tier — which is also what happens when a Trial Period ends without a paid plan — keeps your Account and your information in place with reduced functionality. It is not a closure or a deletion.
• Resetting a Business clears that Business's diagnostic answers, action states, and related outputs, using the reset feature in Settings, which requires typed confirmation before proceeding. Your Account remains open.
• Closing your Account ends your access. We then delete or de-identify your information on the schedule above (generally within 90 days), keeping only what the categories above require us to keep. Before closing your Account, you can download any Platform-generated outputs you wish to keep. Requests concerning your personal information — including after your Account is closed — are handled as described in Section 13.

These lifecycle steps are set out in the Term and Termination section of our Subscription Agreement, which governs the contractual side of cancellation and closure.

11. Data Security

We maintain administrative, technical, and organizational safeguards designed to protect your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. These include access controls that limit who on our team can reach personal information and what they can do with it, encryption of data in transit, monitoring of our systems for unusual or unauthorized activity, and a process for responding to a suspected security incident, including notifying affected people where the law requires it.

No method of transmission over the internet, or method of electronic storage, is completely secure, and we cannot guarantee absolute security. You're responsible for keeping your account password confidential and for using a strong, unique password.

12. Your Choices and Rights

You can review and update most of your account and profile information directly in the Platform's Settings. You can also email hello@startblox.com to request access to, correction of, or deletion of personal information you've provided to us; we may not be able to accommodate a request that would violate a legal obligation or make information incorrect. Deleting your personal information generally requires closing your Account, as described in Section 10.

If you are a resident of a US state with a comprehensive privacy law, Section 13 describes additional rights and the process for exercising them.

13. US State Privacy Rights

Several US states have comprehensive privacy laws, including California (the California Consumer Privacy Act as amended by the California Privacy Rights Act, together the "CCPA"), Virginia, Colorado, Connecticut, Utah, and others. Whether a particular state privacy law applies to StartBlox depends on that law's applicability thresholds and exemptions. Regardless of whether a law currently requires us to do so, we extend the following to residents of all US states as a matter of policy, so these rights are in place either way.

Your rights

• Know and access. You can ask what personal information we've collected, used, disclosed, and (if applicable) sold or shared about you, including the categories of sources, the purposes, and the categories of third-party recipients.
• Correct. You can ask us to correct inaccurate personal information we maintain about you.
• Delete. You can ask us to delete personal information we've collected from you, subject to exceptions — for example, information we need to complete a transaction, comply with a legal obligation, or maintain security and fraud records, as described in Section 10.
• Portability. You can ask for a copy of the personal information you provided to us in a portable, readily usable format, where we can reasonably provide it.
• Opt out of sale, sharing, targeted advertising, and certain profiling. We do not sell personal information as defined by applicable law, we do not use it for targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects about you. As described in Section 6, when you intentionally click a Recommended Vendor link, you direct us to transmit a UTM tracking code and, in some cases, your general location and/or industry as link parameters, so we can be credited for the referral. To the extent a state law would treat that as a "sale" or "sharing," you may opt out by emailing hello@startblox.com with the subject line "Referral Link Opt-Out" (California residents may also use the subject line "California Opt-Out") — we will stop including location and industry parameters in your referral links; the UTM code itself, which does not directly identify you, is not affected. We also honor the Global Privacy Control (GPC) browser signal as an opt-out of analytics and session replay, as described in Section 9; GPC does not currently change referral-link parameters, so use the email opt-out for those.
• Limit the use of sensitive personal information. We collect limited information that some of these laws classify as sensitive personal information: an account sign-in credential (your password, stored only in hashed form) if you use email/password sign-in. We use it solely to authenticate and secure your Account — a use these laws permit without an additional limit, so there is no further restriction for you to request. We do not collect other categories of sensitive personal information. In particular, the general location we collect — country, state or province, and city, whether entered by you or derived from your IP address — is not precise geolocation, and we do not collect GPS-level or similarly precise location (see Section 3(b)).
• Non-discrimination. We will not deny you services, charge different prices, or provide a different level of service because you exercised a choice described in this section.
• Authorized agents. You may designate an authorized agent to make a request on your behalf. We may require written proof of that authorization, and we may still ask you to verify your own identity directly.

How to make a request. Email hello@startblox.com and tell us which right you want to exercise. We will verify your identity before responding, typically using information already associated with your Account; if we can't verify you to a reasonable degree of certainty, we will tell you why and what else we need. For information we hold on behalf of a Subscriber rather than for our own purposes, Section 7 explains how we route the request.

Our response time. We respond within 45 days of receiving a verifiable request. If we need more time, we may extend once by an additional 45 days, and we will tell you within the original 45 days why we need the extension.

Appeals. If we decline your request, our response will tell you why. You may appeal by replying to that response or emailing hello@startblox.com with the subject line "Privacy Appeal" within 60 days. A person who was not involved in the original decision will review the appeal, and we will respond in writing within 45 days with our decision and the reasons for it. If we deny your appeal, we will provide a way to contact your state Attorney General to submit a complaint.

14. International Users

StartBlox is based in the United States, and the Platform is designed primarily for United States users. Personal information collected through the Platform is processed in the United States and may be processed by service providers located in the United States or other countries identified in this policy.

The Platform is not offered to individuals located in the European Economic Area, the United Kingdom, or Switzerland. Individuals located in other countries may be able to access the Platform where permitted by applicable law, but the Platform has not necessarily been localized to satisfy every privacy or consumer-protection requirement of those countries. Access from certain countries is blocked for sanctions and legal-compliance reasons.

The Platform's legal, regulatory, tax, compliance, and business guidance is based on United States frameworks. This geographic limitation concerns the Platform's content and functionality; it does not limit privacy rights or other rights that cannot lawfully be waived or restricted. Users outside the United States should understand that their personal information may be transferred to and processed in the United States, where privacy laws may differ from those in their country of residence. If we make the Website available in additional jurisdictions with localized terms, we will update this policy to describe the additional rights, transfer safeguards, and disclosures that apply.

15. Changes to This Privacy Policy

We may revise this Privacy Policy from time to time, and we will update the "Last updated" date above when we do. Where a change is material — for example, a change in what we collect, who we share it with, or how long we keep it — we will give notice before it takes effect wherever that is practicable, by email or in the Platform, and the change will apply going forward, not to information practices that already occurred. Where applicable law requires your consent for a change, we will ask for that consent separately rather than treating your continued use as consent. Changes that are not material take effect when posted. We encourage you to review this policy periodically.

16. Relationship to Our Other Documents

This Privacy Policy is a notice describing how we handle personal information, not a ranked contract term, and it is not part of the order of precedence used by our Terms of Use and Subscription Agreement. If another agreement between you and StartBlox contains additional data-protection commitments, those apply in addition to this policy, and nothing in our Terms of Use or Subscription Agreement limits the rights provided to you by applicable privacy law.

17. Contact Information

To ask questions or raise concerns about this Privacy Policy or our privacy practices, including to exercise any of the rights described above, contact us at:

StartBlox, Inc., 470 W Broad St #17, Columbus, OH 43215 hello@startblox.com