Privacy notice

Optional usage analytics

With your permission, we use PostHog in a separate Startup Tier project in its US cloud to understand page visits, signup completion, feature use, and conversion from checkout to a paid subscription. Before sign-in we use a random browser identifier stored in your browser. After sign-in we associate consenting activity with a stable, random Startup Tier analytics account ID, including earlier consenting activity in that browser. This lets us recognize the same account across visits and devices that allow analytics. We do not send your name, email address, Clerk identity, company name, or Stripe customer/subscription identifiers to PostHog.

We send only predefined event names and limited labels such as Startup/Company mode, plan, billing interval, and workspace screen. Signup completion is recorded when a newly created account allows analytics; paid conversion is recorded server-side after a qualifying paid Stripe subscription invoice for a consenting checkout. These events may be sent after you close the page. After consent, we also retain approved Google Ads campaign, audience and matched advertising keyword labels in this browser tab for up to 30 days, to connect visits to signup and paid-conversion funnels. Matched keywords are the keywords we advertise on, not your raw search query. With renewed permission for advertising measurement, we also retain a Google Click ID (gclid) in this browser tab and your analytics account for up to 30 days. We attach it only to completed signup and first paid subscription events sent through PostHog to Google Ads, together with the conversion time and a random deduplication ID. This lets Google associate conversions with the ads and keywords that brought you here. We do not send names, emails, phone numbers, or payment details for advertising matching. Other click identifiers, arbitrary URL parameters, form values, profile content, application answers, messages, uploaded files, authentication credentials, and raw URL queries/fragments are excluded. Automatic click/form collection, session replay, error capture, and location enrichment are disabled. PostHog receives technical network information needed to deliver browser requests; our event payloads omit your IP address and raw user-agent or referrer data.

Optional analytics starts only after you choose Allow analytics. Earlier analytics permission does not authorize this Google Ads conversion sharing: we ask again. You can decline or withdraw permission using Analytics preferences in the footer. Withdrawal stops browser collection, clears its analytics identifier, and, when signed in and connected, revokes account-level server analytics and deletes unsent events. Withdrawal cannot recall requests already sent or delete events already received. Account-level permission expires after 180 days without a consenting signed-in visit; unsent events expire after seven days. A later consenting visit on another device can enable account-level analytics again. We respect browser Global Privacy Control and Do Not Track signals and synchronize their refusal to the account when signed in. Authentication and essential workspace preferences work without analytics. Contact contact@inferal.com to exercise applicable privacy rights, request deletion of account-linked analytics, or ask about international transfer safeguards.

Who operates Startup Tier

Startup Tier is operated by Inferal Inc., a Delaware corporation. It helps founders describe their startups, find programs, and share applications with program operators. Contact contact@inferal.com about privacy or your information.

This notice covers Startup Tier’s website, accounts, startup profiles, programs, applications, and related support. Program operators are responsible for how they use information you share with them under their own notices and applicable law.

Information we handle

Account information includes your authentication provider’s identifier, verified email address, name, and profile image when supplied. Clerk handles authentication and sessions. We also process information you enter: startup and company profiles, logos, programs, application questions and answers, invitations, messages, and updates.

Stripe handles payment details. Startup Tier stores billing identifiers, selected plans, and subscription status; card details are entered on Stripe’s hosted pages. Our infrastructure providers also process technical information such as IP addresses, requests, device/browser information, errors, and security events to operate and protect the service.

Please do not put passwords, access keys, government identifiers, health information, or other sensitive personal information in profiles, logos, messages, or applications. Only submit information you are authorized to share.

Google Workspace and LinkedIn sign-in

We request basic identity access: OpenID, profile, and email. We use this information to authenticate you, display your account identity, and secure your account. Google sign-in checks Google’s verified email and hosted-domain claim to require a managed organization account. Sign-in does not establish your authority to represent a startup or company.

We do not request access to Gmail, Google Drive, contacts, calendars, or LinkedIn connections. Google and LinkedIn identity information is not supplied to paying companies as a directory product or used for advertising. Authentication tokens are not inputs to AI application briefs. Our Google verification endpoint does not retain the Google access token it receives from Clerk.

You can revoke provider access in your Google or LinkedIn account settings. Revoking access does not by itself delete information you previously submitted to Startup Tier; contact us to request deletion.

Your sharing choices

Startup discoverability, permission for companies to contact you, and permission for public-source research are separate settings. A discoverable profile and its updates can be viewed by subscribed company accounts. Private account email addresses are not included in that directory. Contact takes place through in-app invitations and responses. Optional email notifications link you back to activity in the app. You can control each email category in Settings or turn notification emails off using the link in any notification.

Applying to a program shares a snapshot of the selected startup profile and your answers with that program’s operator. Later profile edits or withdrawal from discovery do not rewrite an application you already submitted. Its operator may need to retain the application and related review records; contact that operator about its own copies and decisions.

Public-source research with You.com

If you opt into public-source research, Startup Tier sends your startup name, website, location, and founding year to You.com to research public company information, including funding announcements, SEC filings, government incorporation registries, and media coverage. Previously researched public legal names, jurisdictions, and official source links may guide later research. We also query public government registries directly using company names or public record identifiers; Startup Tier staff may record dated evidence from an official registry.

Reports are refreshed monthly. You, Startup Tier staff, and operators of programs you have applied to can view these reports, including when your profile is private. Reports are separate from your submitted profile and application snapshot. You can withdraw research permission in your startup profile; withdrawal stops future research and hides reports in the service. Previously completed reports remain stored under the retention practices described in this notice. You can ask us to correct inaccurate information. Public information and automated findings can be incomplete, incorrect, or outdated.

How and why we use information

We use information to provide accounts, profiles, program discovery, applications, invitations, billing, support, and security; to prevent abuse; and to meet legal obligations. Where data protection law requires a legal basis, these uses depend on providing the service you request, our legitimate interests in running and protecting it, legal obligations, or consent for optional processing. You can withdraw optional consent without affecting processing that was lawful before withdrawal.

Where an AI brief feature is available, a program operator can request a summary of one application using its submitted startup profile, questions, answers, and program description. Cloudflare Workers AI processes that input. Briefs can be inaccurate and should be checked against the submitted application; Startup Tier does not use them to automatically accept, reject, or score founders.

Service providers and other disclosures

• Cloudflare — Hosting, databases, file storage, security, and AI processing where application briefs are available.
• Clerk — Account authentication and session management.
• Stripe — Subscription billing and hosted payment pages.
• Resend — Notification and program ownership verification email delivery, processing recipient addresses and email content.
• You.com — Optional public-source startup research and external program research.
• U.S. Securities and Exchange Commission (SEC) — Public issuer records and Form D filings used in opted-in startup research.
• Government company registries — Public incorporation dates and jurisdictions, using company names or public record identifiers for registry lookups.
• PostHog — Optional usage analytics and account-linked signup and paid-conversion events after consent.
• Google — Google Workspace sign-in when chosen, plus website font delivery and the associated font requests.
• LinkedIn — Identity services for LinkedIn sign-in when chosen.

Providers process information needed for their role under their applicable terms and privacy notices. The sections above describe the information involved and your sharing and consent choices in more detail.

We may disclose information when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or carry out a business transfer subject to appropriate protections. Information may be processed in the United States and other places where we or our providers operate. Contact us about applicable international-transfer safeguards before sharing information that requires particular contractual or location restrictions.

Storage, retention, and browser data

We retain account and business records to provide the service and as needed for security, legal obligations, billing records, and disputes. Retention depends on the record and purpose. Application snapshots and review history can outlast a profile’s discovery permission. When information is no longer needed, it should be deleted or de-identified; backups and records subject to legal retention may remain for their necessary retention period.

The site uses authentication cookies and browser storage for sessions, workspace preferences, selected startups, and demo identifiers. We do not use advertising trackers in the current service. Provider-hosted authentication and payment pages may use their own cookies. Demo workspaces contain fictional sample information and are scheduled for deletion after 24 hours; do not put real confidential data into a demo.

Requests, corrections, and changes

You can edit your startup profile and sharing settings in the service. Contact contact@inferal.com for account deletion, access, a copy of your information, corrections, or other privacy requests. Depending on your location, you may also have rights to restriction, objection, consent withdrawal, portability, and complaint to a data protection authority. We may need to verify your identity and explain any lawful exceptions. Do not send passwords or identity documents with your first request.

Startup Tier is intended for adults acting in a business capacity, not children. Contact us if you believe a child has supplied personal information. We will update this notice when practices change and provide appropriate notice of material changes before they take effect.