Privacy policy

This Privacy Policy explains how DropYourStartup ("DropYourStartup", "we") collects, uses, shares and protects information when you use the service (the "Service"). If anything is unclear, write to us through the contact form.

1. Data controller

The controller of the personal data collected through the Service is [OWNER NAME / COMPANY NAME], tax ID [TAX ID], with registered address at [REGISTERED ADDRESS]. For any question about your data you can contact us through our contact form.

2. What data we collect

• Account data: name, email address and password (stored as a salted hash, never in plain text).
• Data in the listings you publish: name, description, price, declared metrics, logo, images and links of your startup or SaaS listings, including those you put up for sale.
• Usage and security data: access date and time, IP address, browser and device information, and activity logs, to protect your account and investigate misuse.
• Payment data: if you buy a paid plan (Boost or Pro), the payment is processed by Stripe. We do not store your card number; Stripe only shares with us what is needed to manage your purchase or subscription.
• Public founder profile (optional): if you add your X profile URL and turn on the public profile, we show your name, your X profile and your published startups on a public page. You can turn it off at any time from your profile.
• Internal messages: announcements DropYourStartup sends you within the Service. By email we only let you know you have a new message; the content is read inside your account.
• Contact form data: the name, email and content of the message you send us, which we use only to reply to you.
• Aggregate data: views and clicks on published listings, in aggregate form and without building individual profiles.

3. How we use your data and legal basis

• Providing the Service: managing your account and the listings you publish, and showing them to other visitors (performance of a contract).
• Reviewing published content: checking that what you upload complies with the Terms of use (among other things, that it is in English or Spanish) and, if it doesn't, deleting, blocking or modifying it (performance of a contract and legitimate interest).
• Processing payments: charging for Boost plans or the Pro subscription (performance of a contract).
• Protecting your account and the Service: detecting suspicious access and abuse, and keeping an activity log (legitimate interest).
• Running the business: billing, user support and legal record-keeping obligations (legal obligation).
• Service communications: if you give us your consent, notices about news or changes (consent, which you can withdraw at any time).

4. Who we share your data with

We do not sell your data. We share it, in a limited way, with:

• Stripe, to process payments for paid plans.
• Infrastructure providers (hosting and account verification emails), strictly to operate the Service and bound by a data processing agreement under the GDPR.
• Google reCAPTCHA, only on the contact, sign-up, sign-in and password recovery forms, and only when enabled, to tell people apart from automated submissions.
• Google Analytics, only if you accept it in the cookie notice, to measure traffic in aggregate.
• Authorities and regulators, only when we are legally required to do so.

5. Data retention

We keep your account data for as long as your account is active. After you ask to close it, we keep it only for a short grace period and then delete it permanently, including your listings and their images. Security logs are kept separately, for a limited period, solely to investigate abuse and meet legal obligations.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability through our contact form, attaching a copy of a document proving your identity. You can edit or delete much of this data from your account settings. You can also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe your rights have not been respected.

7. Security

We hash passwords with a salt, enforce HTTPS across the whole Service, and apply access controls and activity logs. No system is perfectly secure, but protecting the data you trust us with is treated as a top-priority responsibility.

8. Cookies

See our Cookie policy to find out which cookies the Service uses and why.

9. Changes to this policy

If we make material changes to this policy, we will notify active users by email or with a notice within the Service before they take effect.

10. Contact

If you have any questions about this policy or your data, send them to us through our contact form.