Privacy Policy

CoStartups (costartups.app) is operated by Northbrik Systems LTD (Companies House 17184680, ICO ZC135104). We are the data controller for personal data processed through the CoStartups website and application.

Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

Questions about this policy: privacy@costartups.app.

We collect data you provide directly and data generated by your use of the service.

Account and identity

• Name and email address when you register
• Authentication credentials handled by our auth provider (we do not store plain-text passwords)
• OAuth profile data if you sign in with a third-party provider

Profile and professional information

• Job title, company, location, role type, and status (for example hiring or open to cofounder)
• About text, skills, focus areas, and professional history
• Experience, education, and company profiles you add
• Profile photo and cover image you upload

Activity on the platform

• Posts, comments, likes, and poll votes
• Connection requests and notifications
• Timestamps associated with the above

Technical data

• IP address, browser type, and device information in server logs
• Session and authentication cookies (see our Cookie Policy)

We use personal data to:

• Create and manage your account
• Display your profile and content to other members as you configure it
• Operate the feed, directories, messaging features, and notifications
• Review sign-ups and enforce our Terms of Service
• Keep the service secure and prevent abuse
• Respond to support requests and legal obligations

We do not sell your personal data. We do not use your profile content to train third-party AI models.

We rely on the following bases, depending on the activity:

• Contract: processing needed to provide the service you signed up for
• Legitimate interests: security, fraud prevention, product improvement, and network integrity, balanced against your rights
• Consent: where required, for example optional marketing email if you subscribe to our digest
• Legal obligation: where we must retain or disclose data by law

We use subprocessors to run CoStartups. They process data on our instructions and under contractual safeguards:

• Supabase (authentication, database, file storage for avatars and cover images)
• Vercel (website hosting and content delivery)

Data may be processed outside the UK. Where it is transferred internationally, we rely on appropriate safeguards such as UK adequacy regulations or standard contractual clauses.

We may disclose data if required by law, court order, or to protect the rights and safety of users and the public.

We keep your account data while your account is active. If you delete your account or ask us to erase your data, we delete or anonymise it within a reasonable period, except where we must retain records for legal, tax, or security purposes.

Server logs are retained for a limited period for security and troubleshooting.

Under UK data protection law you may have the right to:

• Access a copy of your personal data
• Correct inaccurate data
• Request erasure in certain circumstances
• Restrict or object to processing in certain circumstances
• Data portability for data you provided, where applicable
• Withdraw consent where processing is based on consent

To exercise these rights, email privacy@costartups.app. We respond within one month in most cases.

You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. Our ICO registration number is ZC135104. See also our GDPR page.

CoStartups is not directed at anyone under 18. We do not knowingly collect data from children. Contact us if you believe a minor has registered an account.

We may update this policy when our practices or the law change. We will post the revised version on this page and update the date above. Material changes may be notified by email or in-product notice where appropriate.