Privacy and cookie policy

Who we are

StartupMap (startupmap.one) is run by Jan-Willem Denys, a self-employed sole trader in Belgium, who is responsible for your personal data (the data controller). His details are at the top of this page. This policy follows the GDPR and Belgian law.

What we collect and why

Your account

Your name, email address, profile photo and Google account ID if you sign up with Google; only your email address if you use an email code. Used to create your account and sign you in.

Legal basis: Contract (GDPR Art. 6(1)(b))

Your profile and saved roles

Your name and LinkedIn, the roles you want, your years of experience and the tools you use, what you do right now (your company and role, or your school, field and graduation year), where you live and how and where you want to work, the company stages and industries you prefer, and when you could start; plus the roles you save, startups you follow and roles you open. Used to show you matching roles and keep your saved roles on every device. If you add them on your profile page: your languages, previous jobs and studies, portfolio and GitHub links, and where you can work without a visa (including the country of a work permit); and once your profile is complete, your answers to the Standout questions (short written answers and a link to an intro video). We keep those on your profile; no startup sees your profile unless you choose to share it.

Legal basis: Contract (GDPR Art. 6(1)(b))

Preferences without an account

Your filters and choices, and a name or email if you give one, saved under a random ID so the site remembers them.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f))

Emails

Your email address and your choice for the newsletter or match emails. Newsletter emails record whether they were opened and which links were clicked.

Legal basis: Consent (GDPR Art. 6(1)(a))

Startups, featured slots and feedback

What you send when you submit or claim a startup, ask for a change or a featured slot, or send feedback. Stripe handles payments; we never see card numbers.

Legal basis: Contract (GDPR Art. 6(1)(b)) or Legitimate interest (GDPR Art. 6(1)(f))

Usage data

Pages viewed and buttons clicked (such as Apply), to run the site, prevent abuse and report anonymous totals to featured startups. Until you accept analytics cookies, the ID is new on every page load and nothing is stored on your device.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f))

Analytics

Only if you accept analytics cookies: PostHog measures page views and records some visits, with everything you type hidden. IP addresses are anonymised.

Legal basis: Consent (GDPR Art. 6(1)(a))

Google sign-in data

With "Continue with Google" we only receive your name, email address, profile photo and Google account ID. We use them to sign you in and pre-fill your profile, store them in our EU database, share them only with the providers that run StartupMap, and delete them when you delete your account. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

• Startups can't see your profile. If we ever offer that, we will ask for your separate consent first.
• We never sell your data, use it for advertising, or use it to train AI models.

Who receives it

Only the service providers that run StartupMap for us, under data processing agreements: hosting (Cloudflare), databases (Supabase, Neon), email (Resend), sign-in (Google), analytics (PostHog), maps (Mapbox) and payments (Stripe). Most keep data in the EU; where data leaves the EU it is protected by the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework. We share data with authorities only when the law requires it.

How we protect it

Data is encrypted in transit and at rest, every change to an account is checked on our server against the signed-in user, and only the operator can access the database.

How long we keep it

Delete your account from your profile page or by emailing [email protected]; it is deleted straight away and backup copies expire within 30 days. Your usage data stays but is no longer linked to you. If you also unsubscribe from the newsletter when you delete, we keep only your email address on a do-not-contact list, so we never email you again.

Your rights

You can ask to see, correct, delete or take a copy of your data, restrict or object to how we use it, and withdraw consent at any time. Email [email protected] and we reply within 30 days. You can also complain to the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be.

Your choice

Cookies and browser storage are small pieces of data a site keeps on your device. On your first visit a banner asks whether you accept analytics cookies; accepting and rejecting are equally easy, and nothing for analytics is stored until you accept. We remember your choice for 6 months, and you can change it at any time.

Always on

Only if you accept