Privacy Policy

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

Provimedia GmbH

Weidenweg 12, 74321 Bietigheim-Bissingen, Germany

Email: hello@mystartup24.com

For data protection inquiries, please contact us at the email address above.

We collect the following personal data:

• Registration Data: Username, email address, password (stored as bcrypt hash)
• Profile Data: Name, bio, social media links, profile picture (avatar)
• Usage Data: Upvotes, comments, submitted products, search queries
• Technical Data: IP address, browser type and version, operating system, access time, referrer URL

Your data is processed on the following legal bases:

Contract Performance (Art. 6(1)(b) GDPR)

Provision of the platform, user account management, authentication, product submission and upvoting.

Consent (Art. 6(1)(a) GDPR)

Sending email notifications and digest emails (revocable at any time).

Legitimate Interest (Art. 6(1)(f) GDPR)

Ensuring technical functionality, abuse prevention, anonymous usage statistics.

We only use technically necessary cookies and local storage entries:

We do not use tracking cookies, advertising cookies, or third-party cookies.

When you access our website, the hosting provider automatically records the following information in server log files:

• IP address of the requesting device
• Date and time of access
• Name and URL of the requested page
• Browser and operating system used
• Referrer URL (previously visited page)

This data is processed to ensure operations and detect misuse (Art. 6(1)(f) GDPR). Log files are automatically deleted after 7 days.

If you subscribe to email notifications, we process your email address for the following purposes:

• Notifications about new comments on your products
• Weekly digest emails with the best products
• Status changes of your submitted products

You can disable email notifications at any time in your settings or use the unsubscribe link in every email. Legal basis is your consent (Art. 6(1)(a) GDPR).

When you use our contact form, the following data is processed:

• Name
• Email address
• Subject and message content
• Inquiry category

The data is used exclusively to process your inquiry and is deleted after completion, unless statutory retention obligations apply. Legal basis is Art. 6(1)(b) GDPR.

For paid services (Premium Launch, Spotlight) we use the payment service provider:

Stripe Inc., 354 Oyster Point Blvd, South San Francisco, CA 94080, USA

When making a payment, you are redirected to Stripe's secure payment page. Your credit card or bank details are processed exclusively by Stripe and are never stored on our servers.

We only receive a transaction ID, payment status, and amount from Stripe. Legal basis is Art. 6(1)(b) GDPR (contract performance).

Your personal data is only shared with third parties in the following cases:

• Stripe Inc. – for payment processing of paid bookings
• Hosting provider – for technical provision of the platform (data processing agreement per Art. 28 GDPR)

No further disclosure to third parties takes place unless we are legally obligated to do so (e.g., by court order).

Data transfer to third countries (outside the EU/EEA) only occurs to Stripe Inc. (USA) on the basis of EU Standard Contractual Clauses.

We store your personal data only as long as necessary for the respective purpose:

• Account data (profile, email, password hash) – until deletion of your account
• Usage data (upvotes, comments) – until deletion of your account or upon your request
• Server log files – 7 days
• Contact inquiries – until completion of processing, maximum 6 months
• Payment data – according to statutory retention periods (6 or 10 years)

After the retention period expires, data is automatically deleted or anonymized.

We employ extensive technical and organizational measures to protect your data:

• SSL/TLS encryption for all data transfers
• Password hashing with bcrypt (no plaintext storage)
• HttpOnly and SameSite cookies to prevent XSS and CSRF
• Prepared statements to prevent SQL injection
• CSRF token validation for all form submissions
• Rate limiting to prevent brute-force attacks

We reserve the right to update this Privacy Policy as needed to comply with changed legal requirements or changes to our platform.

The current version is always available on this page. We will notify registered users by email of material changes.

For data protection inquiries, please contact:

hello@mystartup24.com