Privacy Policy

Who is responsible for the data

StarUp is a service provider to businesses. When a business connects StarUp to its invoicing system, that business decides what customer data is processed and for what purpose — so it is the data controller, and StarUp acts only as a processor on its behalf.

In practice: if you received a message from us after a job was done for you, questions about your data should go to the business that did the work. We will help them answer.

For the business owners' own data — sign-in details, settings and billing — StarUp is the controller.

What we collect about end customers

A phone number in international format, first and last name where the business supplied them, preferred language, and the recorded source of consent.

Details of the job the request relates to: the job's identifier in the business's own system, the service type, when it was completed, and which location it belongs to.

The status of messages sent — sent, delivered, failed — and the time of any opt-out.

StarUp does not collect the content of the review written on Google and does not link it back to the customer. The review is written on the business's own profile and published subject to Google's terms.

What we collect about business owners

An email address and sign-in credentials, the business name, its locations, time zone and country.

Authorisation to your Google Business Profile, if connected. We store an account identifier and an encrypted refresh token, used only to read your review link and sync location details.

Keys and webhook secrets used to connect your invoicing system. These are stored encrypted and cannot be read back after they are created.

What the data is used for

To send at most one review request and one reminder following a job completed by the business.

To honour opt-outs, and to make sure anyone who asked not to be contacted is not contacted again.

To show the business an aggregate report: how many requests went out, how many were delivered, how many resulted in a review.

To secure the service, detect abuse and meet legal obligations.

Data is never sold, never rented, and never used for third-party advertising.

Consent and opting out

Every message includes a way to stop receiving them. An opt-out is recorded against the business and takes effect immediately for all of its future messages.

The business is responsible for having a lawful basis to contact its customer. StarUp provides the tools to record the source of consent and to honour opt-outs, but does not decide for the business who may be contacted.

Who the data is shared with

Messaging providers: 019 Mobile for SMS in Israel, and in some cases Twilio. If the business has connected its own WhatsApp Business account, messages go through that account.

Infrastructure: Supabase, for database hosting and user authentication.

Google, to read business profile details and the review link, where the business has connected its account.

Competent authorities, where required by law or court order.

Each provider receives only the minimum needed to do its job.

Transfers outside Israel

Some providers operate servers outside Israel. Where that happens, the transfer is made subject to the Protection of Privacy Regulations (Transfer of Data Abroad).

How long data is kept

End-customer records and message history are kept while the business's account is active, and deleted within a reasonable period after it closes.

Opt-out records are kept beyond that point — it is the only way to guarantee that someone who asked to be removed is not messaged again.

A business can ask us to delete its customer data sooner.

Security

Access is scoped to the owning business and enforced at the database layer. Secrets and third-party connections are stored encrypted.

No system is perfectly secure. If a security incident occurs that requires notification, we will follow the reporting duties that apply and inform the affected businesses.

Your rights

Under the Protection of Privacy Law, 5741-1981, you may inspect the data held about you, ask for inaccurate data to be corrected, and ask for it to be deleted.

If the data was collected by a business you were a customer of, contact that business. For anything else — or if you do not know which business to ask — write to the address at the bottom of this page and we will help.

Children

The service is intended for businesses and is not directed at children. We do not knowingly collect data about them.

Changes to this policy

We will update this page when the policy changes and change the date at the top. Material changes will be communicated to businesses in advance.