Privacy notice
Version 1.1 · Last updated 25 October 2026
This notice explains what personal data startup.career handles, why, on what legal basis, who receives it and what you can do about it. It describes how the site works today. If that changes in a way that matters to you, we update this page and its version.
1. Who we are
startup.career is operated by Startup Career B.V. (trading as STARTUP.CAREER), KvK 42173244, registered office Amsterdam, Roerstraat 22-3, 1078 LP Amsterdam, the Netherlands. We are the controller (verwerkingsverantwoordelijke) for the personal data described here.
Privacy contact: privacy@startup.career. We have not appointed a data protection officer.
Startups that receive your profile from us (section 5) are controllers in their own right for what they do with it.
2. What this notice covers
The startup.career website, the emails we send, and what we share with startups. It does not cover the websites or application systems of the startups themselves; read their notices there.
3. Data we collect
What you give us
- Your email address, when you create an account or join a waitlist or the newsletter.
- Your profile, if you fill it in: full name; LinkedIn, website, GitHub and X links; city and country; work rights; experience level; languages; whether you would relocate; what you are looking for (status, interests, functions, sectors, countries, company stages, workplaces); and optionally a phone number plus whether we may contact you on it.
- The sector talent pools you join.
- Companies and roles you save, and the status you give them (interested, applied, interviewing, offer).
- Intro requests: the role, the company and your email address. An intro request made without an account keeps your email address.
- Your email preferences (community, product and role-alert emails).
- For company contacts: a name and your availability answers on a shoot-planning link.
What we get from using the site
- Anonymous page counts in our own database, on every page: per page and day, how many views, from which referring website (domain only), which country (derived by our host from the IP address, which is not stored) and which device type (mobile, tablet, desktop). No identifier, no cookie, nothing stored on your device. Bots and AI agents are not counted.
- Anonymous, aggregate counters on company profile pages: views, how far down the article people read, how far into the film they watch (in 10% steps), link clicks, and the country and device type (mobile, tablet, desktop) of the visit. These are counts per company per day. They are not linked to a person, a device or an IP address, and they set no cookie.
- Security data: your IP address is held briefly in the memory of our servers to limit abuse (rate limiting) and is not stored in our database. We also use the country that our host derives from your IP address.
- Requests from known AI agents and crawlers (the agent, the page, a daily scrambled hash of IP address and browser, and any text the agent sends us through our search and feedback endpoints). This targets software, but free text could contain personal data.
We do not run advertising, and we do not currently use analytics cookies or any identifier stored on your device for analytics. Section 10 and the cookie notice list what the site does store on your device.
4. Why we use it and on what basis
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Your account: sign-in, profile, saved companies and roles, account emails (sign-in links, status of your intro requests) | Email, profile, saved items | Contract (6(1)(b)) |
| Pools: when a startup in a sector pool you joined is hiring for a role that fits you, we send it your profile | Your profile | Consent (6(1)(a)), given when you join the pool. The joining time is recorded; recording the version of the text is planned, not live yet. Leaving the pool withdraws it. |
| Intro requests: putting you forward to one company for one role you asked about | Your profile and the role | Contract (6(1)(b)): it is exactly what you asked for |
| Contacting you by phone | Phone number | Consent (6(1)(a)): only if you ticked that we may |
| Newsletter and product emails | Email address | Existing accounts: existing-customer exception (art. 11.7 Telecommunicatiewet), with an unsubscribe link in every email. New accounts: consent through an unticked opt-in checkbox; this is not live yet. |
| Knowing whether our emails arrive and are read: opens and link clicks | Your email address, whether and when you opened an email, which links in it you clicked, and the device and approximate location your mail app reports | Legitimate interest (6(1)(f)): checking that emails arrive and which content is useful. Recorded by our email provider through a small image and tracked links in each email. You can stop it by turning off images in your mail app, or by unsubscribing. |
| Weekly role alerts | Email address and your preferences | Contract (6(1)(b)): part of the talent pool you join, which switches them on. Switch them off any time in your account or with the link in every alert; once off, joining another pool does not switch them back on |
| Anonymous page counts and aggregate profile counters | No account data and no identifier. See section 3. | Legitimate interest (6(1)(f)): knowing which pages and profiles are read, without identifying anyone |
| Security and abuse prevention | IP address (briefly, in memory) | Legitimate interest (6(1)(f)) |
| Logging requests of AI agents | Agent, page, daily hash, text the agent sent | Legitimate interest (6(1)(f)): the targets are bots and the hash is not reversible |
| Our founders reviewing profiles | Profile data | Contract and legitimate interest; disclosed here |
| Invoicing startups | Business contact details | Legal obligation (6(1)(c)); kept 7 years |
Newsletter: today, community and product emails are switched on for existing accounts and you can switch them off in your account settings or with the unsubscribe link in every email. [Planned, not live yet: new accounts get an unticked opt-in checkbox for the newsletter instead.]
5. Sharing with startups
- Pools. Joining a sector pool is your consent for us to share your profile with startups in that sector that are hiring for a role that fits you. We choose which startups. Leaving the pool in your account withdraws the consent for future sharing; a profile already sent cannot be taken back by us, but you can ask the startup to delete it.
- Intro requests. A second route: when you request an intro to a role, we send that company your profile for that role.
- Startups have no accounts on the site and nothing is sent to them automatically outside these two routes.
- A startup that receives your profile decides for itself what to do with it and is responsible for that.
- We do not sell your data and we do not show your profile to other members.
- Viewing and engagement data (what you looked at or watched) stays internal to STARTUP.CAREER and is never shared with startups. Startups see only aggregate counts per company.
6. Who else handles your data (processors and recipients)
| Who | What for | Data | Where |
|---|---|---|---|
| Supabase | Database, sign-in and our anonymous page counts | Everything in section 3 that you give us, plus the anonymous counts | EU (Frankfurt, eu-central-1) |
| Netlify | Hosting and delivery of the site | All requests (IP address, user agent); visitor country; our server functions | United States, global network; transfers under the EU-US Data Privacy Framework |
| Brevo | Sending our emails, and recording opens and link clicks | Recipient email address, name, the email content, and open and click events | France (EU) |
| Bunny.net | Images and company films | IP address, user agent, requested files | Slovenia (EU) |
| MapTiler | Map tiles on the map pages | IP address, user agent, requested tiles | Switzerland (adequacy decision) |
| Attio | Our CRM for startup contacts | Business contacts at startups. Talent profiles are not kept there. | Business contacts only |
Logos of companies are fetched from logo.dev by our server, which then serves them to you; logo.dev does not receive your IP address through that route. We use an AI model (Anthropic) only outside the website to read public company career pages. No profile or account data is sent to it.
7. Transfers outside the EU
Netlify is a US company; transfers to it rely on the EU-US Data Privacy Framework. MapTiler is in Switzerland, which has an EU adequacy decision. Everything else is in the EU.
8. How long we keep it
- Account and profile: while your account exists, including your cookie choice (yes or no, the version of the notice and the date), which is saved to your profile when you are signed in. Deleting the account in your settings deletes the profile, pool memberships, saved items and intro requests linked to it. Viewing data linked to the account is deleted too; we keep only aggregate statistics that identify no one.
- What stays after deletion: your waitlist entry (if you were on the waitlist), the record that you unsubscribed from emails (so we do not email you again), email delivery logs, and intro requests made with only an email address and no account. Our email provider and Supabase keep their own technical logs for a limited time.
- Waitlist and newsletter: until you unsubscribe.
- Email open and click statistics: kept by our email provider in our account there; we do not copy them into our own database.
- Aggregate counters: kept; they contain no personal data.
- AI-agent request logs: as long as we need them to run and protect our search and feedback endpoints.
- Business records for invoices: 7 years.
9. Your rights
You can ask us for access to your data, a copy of it, correction, erasure, restriction, and you can object to processing based on legitimate interest. Where we rely on consent you can withdraw it at any time, without affecting what happened before.
- Correct your profile: in your account.
- Delete your account: in your account settings.
- Leave a pool, switch emails off or unsubscribe: in your account and with the link in each email.
- Everything else, including a copy of your data: email privacy@startup.career. There is no self-service download yet. We may need to check that you are who you say you are. We answer within one month.
10. Cookies and similar storage
Today the site stores only what it needs to work: a sign-in cookie when you sign in, a short account-creation cookie, a record of your cookie choice (also saved to your profile when you are signed in, so it follows your account), and a few small settings in your browser. It sets no analytics or advertising cookies. The exact list is in the cookie notice.
11. Security
Data is sent over encrypted connections. Profile data is stored in a database with row-level access rules, so an account can read only its own rows, and the server-side key that can read everything is never sent to your browser. Access to profiles is limited to the founders.
Admin access to profiles and CSV exports is not logged yet; an audit log is planned.
12. Age
startup.career is for people aged 18 or older. Sign-up does not yet ask you to confirm your age.
13. Changes to this notice
This is version 1.1, last updated 25 October 2026. When we change it in a way that matters to you, we change the version and date above and, where we hold your email address, tell you.
14. Complaints
If you think we handle your data wrongly, please tell us first. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
15. Contact
privacy@startup.career · Startup Career B.V., Roerstraat 22-3, 1078 LP Amsterdam, the Netherlands. We carried out a data protection impact assessment for the talent features; a summary is published.