Startups Compass ← Back to home

Privacy Policy

Last updated: October 11, 2026

The short version: this marketing website sets no cookies and runs no analytics or tracking scripts. The application at app.startupscompass.com uses only the browser storage it needs to keep you signed in and remember your settings (see the section on cookies and browser storage below). We see aggregated traffic statistics from our hosting provider (visits, countries, device type, time of day), never tied to an individual. The only personal data we collect is what you provide when creating an account (or, historically, joining our waitlist), plus which access code you registered with. We never see your card details — payments are handled by Paddle, our merchant of record, and card data never reaches us. If you registered with an access code, there is no payment method on file for your account at all. The application stores your business data in your own browser. Cloud backup is optional and off unless you turn it on; with it off we never receive that data at all, and with it on we hold a copy purely so it can be restored to you.

1. Who controls your data

Startups Compass is the data controller for the information described in this policy. Startups Compass is operated by QUANOMALY LTD (קואנומלי בע"מ), a limited liability company incorporated in Israel. Its company number and registered address are provided on request. Contact: startup@startupscompass.com.

2. What we collect, and why

WhereWhat we collectWhy
Creating an account (app.startupscompass.com) Work email address and password (handled directly by our authentication provider, Supabase — we never see your password), plus company name and phone number To create and secure your account, verify you're using a real work email, and let you sign back in on future visits
Your access code (if you registered with one) The access code your account was created with, the date it was redeemed, and the date your free year ends — stored against your email address. No payment details are collected at registration or at any point during your free year: no card number, no billing address, nothing. There is no payment method on file for your account. To enforce how many accounts a code can create, to make sure a code is only used once per account, and to know when your free year ends so we can tell you in advance
Historical: waitlist signup form Email address, name (optional), browser language, the page you signed up from, and your IP address at the moment of signup Kept from an earlier stage of the product, before direct registration existed. Kept as a record of consent (timestamp and IP address)
Sign-up and login forms A verification token from Cloudflare Turnstile, our bot-protection provider, based on technical signals about your browser/device — we don't receive or read the underlying signals ourselves, only a pass/fail result To block automated/bot sign-ups and protect the Service from abuse
This website generally The marketing site sets no cookies and runs no analytics or tracking scripts. Our hosting provider (Cloudflare) gives us aggregated traffic statistics — number of visits, countries, device types and time of day — that are not tied to any individual. —
The Startups Compass application — when cloud backup is switched off Nothing you enter is sent to us. Your investor pipeline, cap table, and all other app data stay in your browser's local storage on your own device. (The one request the application makes to our servers in this mode is the public exchange-rate lookup described further down, which carries no app data.) —
The Startups Compass application — Cloud backup (on by default, and can be turned off) A copy of that same app data — investors, contacts, notes, cap table — is stored on our servers in the European Union, together with dated restore points (the current copy is refreshed within seconds of a change; a restore point is kept at most once a day, and the most recent 10 are retained). It is encrypted in transit and at rest, but it is not end-to-end encrypted: we are technically able to read it. We do not read it except as needed to provide, secure, restore or support the service, or where legally required. We never combine it with other customers' data, and we never build any product or dataset out of it. You can erase the cloud copy and every restore point yourself, from inside the app, at any time — immediately and permanently. So that your data can be restored if this browser is lost or cleared, or an edit goes wrong. That is the whole reason the mode exists, and it is why we keep the ability to read the copy: end-to-end encryption would mean we could not restore anything for you. If that trade is not one you want, switch cloud backup off in the app. The cloud copy is a convenience for moving between computers and for not having to back up by hand each time, not a guarantee: keeping your own copies of your data and files is your responsibility.
The Startups Compass application — Files you attach Files you attach to your records — for example contracts, NDAs, term sheets, financial models and presentations — which may contain personal data of other people, such as investors' names, contact details or signatures. They are stored with Cloudflare R2 in the European Union, encrypted in transit and at rest, and are not end-to-end encrypted: we are technically able to read them. We do not read them except as needed to provide, secure or support the service, or where legally required, and never use them for any other purpose. We do not send, share or publish them. If you switch cloud backup off, a file you attach stays on your own computer and only a link or note is kept in your browser. To store them for you and let you find, download, replace, move and delete them.
The Startups Compass application — Activity record and notices When you last opened the app, your language, whether your cloud copy has been failing since a date, whether you switched the reminder email off, and when we last sent each notice; stored against your email address. When we check whether to send the reminder email we read your cloud copy for investors at Negotiation or Term sheet with no activity for more than a week, and use only their count and up to three names, in the email to you; nothing from that reading is stored. To send you the two notices described in the Terms (a deal that has gone quiet while you were away, and a failing backup), never more than once for the same reason; the first can be switched off in Settings or from the email itself.
The Startups Compass desktop app — Email connection (optional) If you switch it on, the desktop app reads, on your computer and through your email program, the date, direction (sent or received), the addresses (sender, recipients and copies) and the subject of your recent emails in the accounts you choose, and compares the addresses with the investor and partnership addresses you saved and with their organisations' own email domains. For an email to or from an investor it adds an entry to that investor's history: the date, the subject and a short fingerprint of the email's identifier, so the same email is never added twice. The content of your emails is not read for this, nothing else from your mailbox is kept, and nothing from it is sent to us: the history entry becomes part of your app data like anything you type yourself, including in the cloud copy described above. We do not receive the content of your emails, your mailbox, or your email program's sign-in details. On your computer the desktop app also keeps which emails it has already added and when it last checked. Notifications are shown by your computer. When you ask for an email with your deck, the file is attached in your email program on your computer, and you send it yourself. If you switch on the built-in AI option in Settings (offered where your computer supports it in the language you use the app in), the desktop app also reads the text of emails from investors (only those), on your computer and with your computer's own built-in AI, and keeps only what it understood: a short summary in the investor's history, a task, a follow-up date, a stage change, or a proposed meeting time it asks you about. The text of your emails is not sent to us or to any AI provider and is not stored by the app. To keep your investor history up to date and to move an investor's stage forward, at your request. Switching it on is your choice and your responsibility; you can switch it off in Settings at any time and delete any history entry.
The Startups Compass desktop app — Sign in with Touch ID (optional) If you tick "Use Touch ID to sign in next time" when you sign in, the desktop app keeps your sign-in email and password in your computer's own Keychain. They are handed to the sign-in page only after Touch ID or your computer's password, and are never sent to us or anyone else apart from the normal sign-in itself. Untick the box at your next sign-in, or delete the item "Startups Compass sign-in" in Keychain Access, to remove it. To let you sign in with Touch ID instead of typing your password, at your request.
The Startups Compass desktop app — Calendar connection (optional) If you switch it on, the desktop app reads, on your computer, the title, start and end time and the invitees' email addresses of upcoming events in the calendars you choose, and compares them with the investor and partnership addresses, domains and names you saved. A matching meeting adds an entry to that record's history. Nothing else from your calendar is kept and nothing is sent to us. The app never changes or deletes anything in your calendar; it adds an event only when you answer Yes to a question about a meeting time an investor or partnership proposed (the title, the time, and the contact's email address as a note). On your computer it also keeps which meetings it has already noted. To note meetings with investors and partnerships, move their stage forward and remind you what to review, at your request. You can switch it off in Settings at any time.
The Startups Compass application — Summaries of your notes (on request) When you ask for it, the desktop app (with your computer's own built-in AI) or your browser (with its own built-in AI, where it has one) reads the notes and history of one investor or partnership on your computer and writes a short summary. The notes are not sent to us or to any AI provider; your browser may download its built-in AI from its maker the first time. The summary is kept with that record as part of your app data, including in the cloud copy described above, so it is also shown on the website; you can ask for a new one at any time. To give you a quick view of where things stand with that investor or partnership, at your request.
The Startups Compass application — Viewers The email address of a person you invite to see your account in read-only mode, who invited them and when. A viewer sees everything in the account (Terms, Section 6.4). To give the people you choose read-only sight of your account and to end it when you remove them or your account ends. Showing your data to a viewer is your decision and your responsibility.
The "Find Investors" feature Nothing is sent to us, but your browser sends search terms directly to a third-party search service — Wikipedia, and Google Programmable Search only if you supply your own API key. Those search terms are built from your startup profile's sectors, funding stages, and niche description. Your investor records, contacts, notes, and cap table are never included. To find investors matching your profile. This runs automatically in the background when the app loads (so the "Find Investors" tab can show how many new matches exist) — not only when you open that tab. It does not run at all if you haven't set any sectors on your startup profile.
Exchange rates in the Costs tab When a cost or the display currency is not US dollars, the app asks our own server (api.startupscompass.com/fx) for the current exchange rates, at most once a day. The request carries no app data — only the ordinary information any web request carries, such as your IP address and browser type, which our hosting provider processes to answer it. The server in turn fetches the European Central Bank's public daily reference rates, republished by frankfurter.dev; that request comes from our server, so those services never see you. The rates are stored in your browser and, if you use Cloud backup, in your backup copy, together with the date they were published. So that costs in different currencies can be added into one total with a real rate rather than one you type in. It does not run at all if every cost and your display currency are in US dollars.
Investor and company logos Nothing is sent to us. When an investor record (or your own startup profile) has a website saved, the app displays that company's logo by loading its website icon from Google's favicon service at www.google.com/s2/favicons. The website's domain name is therefore visible to that service, along with your IP address, as part of a normal image request — so over time it can see the domains of the investors you have saved. Nothing else is included: never the investor's name, your contacts, notes, amounts, pipeline status, or any other field. This happens wherever a logo is shown, including the investor list, so it is not limited to records you open. To show a recognizable logo instead of a blank placeholder. Two things switch it off: an investor record with no website saved never triggers a request, and setting your own logo image URL on a record (Investor details — "Set logo") always takes precedence, so that record's logo is loaded from wherever you chose instead.

On Cloud backup and files: for the personal data of other people inside your app data or your files — an investor's name, email or phone — you remain the data controller and we act as a processor on your instructions. Turning the mode on does not move that responsibility to us, and it does not change those people's rights. When cloud backup is off we are neither, because we never receive the data at all.

On the "Find Investors" and logo rows above: those requests go from your browser straight to those third parties, so they see your IP address and the search terms or domain requested, and their own privacy policies apply to what they do with them — we are not an intermediary and never receive the query, the result, or the image. Apart from those two, and the exchange-rate lookup above (which goes to our own server and carries no app data), the rest of the application works without sending anything anywhere.

We process this account and waitlist data based on your consent and our legitimate interest in developing our service. Providing this information is not legally required and is done at your own free will. The only exception to "nothing is sent to us" from the application is if you voluntarily contact us for support or to report a bug — in that case, we only receive what you choose to share with us in that message (such as your email and a description of the issue), never your App Data itself.

3. Where account and waitlist data are stored

Account data (your login credentials, company name, email, and phone number) is stored using Supabase, a cloud database and authentication provider that hosts this data in Frankfurt, Germany (EU), and acts as our data processor. Files you attach are stored using Cloudflare R2 in its European Union jurisdiction, with Cloudflare, Inc. acting as our data processor. So that a refund ends your access at the end of your own day, the app also stores your browser's time zone setting (for example "Asia/Jerusalem") with your account. When you create an account we also record how you reached us: the campaign tags in the link you followed (utm_source, utm_medium, utm_campaign), if there were any, and the domain of the website that sent you — never the full address of that page. Your browser keeps them only for the length of that visit (in session storage, not a cookie), and we use them only to learn which channels bring founders to the service. Historical waitlist signups are stored using Cloudflare Workers KV, a cloud data store operated by Cloudflare, Inc., also acting as our data processor. Cloudflare Turnstile (part of Cloudflare, already named above) processes the technical signals described in Section 2 to verify you're not a bot; see Cloudflare's privacy policy for details. We don't sell this data or share it with advertisers. We may share it with service providers who help us operate the service — for example, Resend, our email delivery provider, which sends account-verification and related emails on our behalf — only as needed to provide the service to you.

We never see or store your payment details. Accounts created with an access code collect no payment details at all. For paid subscriptions, payment is collected by Paddle.com Market Limited ("Paddle"), our authorised reseller and merchant of record: card details are entered on Paddle's own checkout, processed by Paddle as an independent data controller under its own privacy policy, and never reach us. We receive back only what is needed to run the subscription — its status, the plan, and the renewal date — never a card number. If you have no subscription, no payment data exists for you anywhere.

4. How long we keep it

We keep your account data for as long as your account is active, or until you ask us to delete it — whichever comes first. Inactive accounts are deleted automatically: an account whose email address was never confirmed is deleted 30 days after it was created; an account that has not been signed in to for 24 months receives a warning email, and is deleted 30 days after that warning unless it is signed in to in the meantime — a single sign-in resets the clock. An account with an active subscription, a paid period still running, or a free access period still in force is never deleted for inactivity. Deleting an account deletes the account itself, its registration details, its subscription and access-code records held by us, and its cloud copy with every restore point. Data stored in your own browser is not affected — we have no access to it. Payment records are kept by Paddle, our merchant of record, under its own retention obligations. We keep historical waitlist entries until you ask us to delete your entry, or until they're no longer needed for the purpose described above. If you turn on Cloud backup, your data's current copy is kept for as long as Cloud backup stays on, with restore points kept for at most 10 days each before being deleted automatically; deleting your account deletes the cloud copy and every restore point immediately, and you can also erase them yourself at any time from inside the app. If paid plans are ever introduced, any change to these retention rules will be described in an updated version of this policy first.

When a subscription ends, or Cloud is removed from it: your cloud copy, its restore points and the files you stored are kept for 60 days so you can download them, then permanently deleted. We email you when it happens and 30 and 7 days before the deletion. Data in your own browser is never touched by us. Deleting your account deletes them immediately. The cloud copy is a convenience and not an archive: keeping your own copies of your data and files is your responsibility. A viewer's access ends the moment you remove them or your account is deleted, and the activity record is deleted with the account.

4a. Cookies and browser storage

The marketing website (startupscompass.com) sets no cookies. The application (app.startupscompass.com) uses only what is strictly necessary to work:

We use no advertising, analytics or tracking cookies. Because everything above is strictly necessary to provide the service you ask for, no cookie banner is shown.

5. Your rights

You can ask us at any time to:

To do any of this, email startup@startupscompass.com. We may ask for reasonable proof of identity before acting on a request, to make sure we only disclose or delete data for its rightful owner. We'll respond within 30 days. If you're in the EU/EEA or UK, you also have rights under GDPR, including the right to lodge a complaint with your local data protection authority.

6. International transfers

Your account data is hosted by Supabase in Frankfurt, Germany (EU). Files you store are kept in Cloudflare R2's European Union jurisdiction. Cloudflare operates a global network, so your historical waitlist data, and files as they are delivered to you, may be processed in countries other than your own. Both providers maintain their own safeguards for cross-border data transfers; see their respective privacy policies for details. Where required, such transfers rely on Standard Contractual Clauses or another legally recognized transfer mechanism.

7. Business transfers

If Startups Compass is involved in a merger, acquisition, or sale of all or substantially all of its assets, your account and waitlist data may be transferred to the acquiring party as part of that transaction. Where required by law, we'll notify affected users by email before their data is transferred and becomes subject to a different privacy policy.

8. Children's privacy

Startups Compass is a business tool intended for founders and professionals. It is not directed at children, and we don't knowingly collect data from anyone under 16.

9. Changes to this policy

We may update this policy as the product evolves — for example, when we change plans, prices, providers or features. We'll update the "Last updated" date above whenever we do. We retain prior versions of this Policy and will provide a copy on request.

10. Contact

Questions about this policy or your data: startup@startupscompass.com