Privacy Policy

We have not appointed a Data Protection Officer, because we are not required to. Privacy questions go to the address above and are handled by the founder.

The short version, with the detail below. This summary is for convenience and does not replace the rest of the policy.

• We collect what you type into our forms, plus your IP address and, on the membership application, the campaign parameters in the link you arrived from.
• We use it to reply to you, review applications, run the directory, and keep the site from being abused.
• We do not sell or share your personal information, and we do not run advertising trackers.
• We set no cookies and use no browser storage of any kind. Our analytics is cookieless, and we switch it off entirely for anyone sending a Do Not Track or Global Privacy Control signal.
• We keep inquiries and applications for 24 months from our last contact with you, and marketing contacts until you unsubscribe.
• You can ask us for a copy of your data, or to correct or delete it, by emailing kyle@bitcoinforstartups.com.

Information you give us

We collect only what a given form asks for. Fields marked optional on the form are optional here too.

Collected automatically

We want to be precise about this, because it is the part you did not type in:

• IP address. When you submit a form, we use your IP address as a rate-limiting key to stop automated abuse. It is held in server memory only, is not written to a database, and is discarded when the server instance restarts.
• Campaign and referral data on the membership application. If you reach /apply through a link carrying utm_source, utm_medium or utm_campaign parameters, those values are captured with your application, along with the address of the page that referred you. This tells us which channels bring people in. It is included in the notification email we receive.
• Server logs. Our hosting provider records standard request logs, which include IP addresses, timestamps, requested URLs, and user-agent strings, for security and reliability.
• Cookieless usage measurement. We use Vercel Web Analytics to count page views and a short list of interactions, so we know which pages are worth keeping. It sets no cookies and stores nothing on your device. See Analytics for exactly what is recorded and how to switch it off.

We use no advertising networks, no pixels, no fingerprinting, no session recording, and no cross-site tracking of any kind.

Information from third parties

We do not buy personal data, and we do not enrich or append data from brokers. If an existing member refers you, we will know your name because they told us.

If you are in the UK, the European Economic Area, or Switzerland, the UK GDPR and EU GDPR require us to identify a lawful basis for each purpose. These are ours.

We do not use your information to make automated decisions that produce legal or similarly significant effects about you. A person reads every application.

We do not ask for special category data (such as health, religion, political opinions, or biometric data). Please do not send it to us in a form field or an attachment.

This site includes a public member directory, an ecosystem directory, and an events listing, so it matters which information is published and which is not.

• Nothing you submit in a membership application is published without your explicit, separate permission. The application form asks for that permission as its own choice.
• If you consent to a public profile, the fields intended for publication become visible to anyone on the internet and may be indexed by search engines. Your email address and phone number are not published.
• A submitted event, once approved, is published with its details and organiser. Your name and email as the submitter are not published.
• You can ask us to unpublish a profile or listing at any time by emailing kyle@bitcoinforstartups.com. Search engines may retain a cached copy for a period we do not control.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done so.

We use a small number of service providers, who process data on our instructions and are bound to protect it:

We may also disclose information where we are required to:

• To comply with applicable law, a subpoena, a court order, or other lawful request from a public authority.
• To establish, exercise, or defend a legal claim, or to investigate suspected fraud, abuse, or a security incident.
• To a successor entity in connection with a merger, acquisition, financing, or sale of assets. If that happens, we will post notice here before your information becomes subject to a different policy.

We are based in the United States and our service providers are located in the United States. If you are in the UK, the European Economic Area, or Switzerland, submitting a form means your information is transferred to the United States, which those jurisdictions do not treat as offering equivalent protection by default.

Where such a transfer takes place, we rely on the European Commission's Standard Contractual Clauses, and the UK Addendum where applicable, as incorporated into our agreements with the providers listed above. You can request more detail about the safeguards that apply by emailing kyle@bitcoinforstartups.com.

We keep personal information only as long as we have a reason to, then delete it. Where a period runs from "last contact", that means the most recent substantive exchange between us.

We may keep information longer where we must in order to comply with a legal obligation, or to establish, exercise, or defend a legal claim. In that case we keep only what is needed for that purpose.

Depending on where you live, you have some or all of the following rights. We extend them to everyone who contacts us, regardless of location, because it is simpler and fairer than checking first.

• Access. Ask whether we hold information about you and get a copy of it.
• Rectification. Have inaccurate information corrected and incomplete information completed.
• Erasure. Ask us to delete information where we no longer have a reason to keep it.
• Restriction. Ask us to pause processing while a dispute about accuracy or legitimate interests is resolved.
• Portability. Receive the information you gave us in a structured, commonly used, machine-readable format.
• Objection. Object to processing based on legitimate interests, including our use of campaign data. You can object to direct marketing at any time, and we will stop.
• Withdrawal of consent. Withdraw consent at any time where we rely on it. This does not affect processing carried out before you withdrew.

To exercise any of these, email kyle@bitcoinforstartups.com. We will respond within one month. If a request is complex we may extend that by up to two further months and will tell you why. We may ask you to confirm your identity, and we will not charge you unless a request is manifestly unfounded or excessive.

If you are a California resident, the CCPA as amended by the CPRA gives you the rights to know, delete, and correct the personal information we hold, to opt out of its sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of them.

In the twelve months before the date above we collected the categories of information described in What we collect: identifiers, professional and employment information, internet activity limited to the campaign and referral data and the cookieless analytics described above, and geolocation no more precise than the city and country you type in. We collected it for the purposes in Why we use it and disclosed it only to the service providers listed in Who we share it with.

We did not sell or share personal information, and we do not have actual knowledge of selling or sharing the personal information of anyone under 16. We do not collect sensitive personal information as the CPRA defines it, so there is nothing to limit.

To exercise a California right, email kyle@bitcoinforstartups.com with "California privacy request" in the subject line. We will confirm receipt within 10 business days and respond within 45 days, extendable once by a further 45 days. An authorised agent may act for you with your written permission.

The site is served over HTTPS with HTTP Strict Transport Security and a Content Security Policy. Form submissions are validated on the server, rate limited by IP, and protected by a honeypot field. Access to the mailbox that receives submissions is limited to people who need it and protected by multi-factor authentication.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant supervisory authority where the law requires it, without undue delay.

Please do not send passwords, private keys, seed phrases, or government identification numbers through any form on this site. We will never ask you for them.

This site is for people working on or with companies, and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, email kyle@bitcoinforstartups.com and we will delete it.

We use Vercel Web Analytics to understand which pages and features are used. We chose it specifically because it measures without identifying you.

• No cookies, no storage. It sets no cookies and writes nothing to your browser. There is no profile of you, and nothing persists between visits that would let anyone recognise you as the same person.
• No new company sees your visit. The measurement script is served from our own domain and reports back to our own domain. Vercel already hosts this site, so it already handles every request you make. Adding analytics introduced no additional third party.
• Aggregate counts, not free text. We record page views and a fixed list of interactions: opening the directory, running a search, using a filter, viewing a member or event, clicking through to register for an event, opening a tool, and submitting one of our forms.
• What is never sent. Your search terms, form answers, message bodies, names, and email addresses are never passed to analytics. A search records only how many results it returned. A filter records only which filter was used, never the value you picked.

Our legal basis is our legitimate interest in understanding how the site is used (Art. 6(1)(f)). Because the measurement is cookieless and stores nothing on your device, it does not require consent under the ePrivacy rules that govern cookie banners, which is why you are not asked to dismiss one.

How to turn it off

We honour Global Privacy Control and Do Not Track, and we implement them rather than merely acknowledging them. If your browser or extension sends either signal, we send no analytics at all: no page views and no interaction events. Nothing is queued and released later. Any ad or tracker blocker will also block it, and we do not attempt to work around one.

This site sets no cookies and uses no localStorage, sessionStorage, or any other browser storage. There is no consent banner because there is nothing stored on your device to consent to, including for the analytics described above.

We run no advertising or social media pixels, no fingerprinting, and no session recording. The fonts are served from our own domain rather than a font network, so loading a page does not tell a third party that you visited.

Do Not Track and Global Privacy Control are honoured as described in Analytics. We do not track you across sites at all, so there is nothing further for those signals to switch off.

If we ever add something that does store data on your device, we will update this policy before it goes live and add a consent mechanism where one is required.

We may update this policy as the site changes. The date at the top always reflects the current version. If a change materially affects how we use information you already gave us, we will tell you by email where we have your address and a way to reach you.

Questions, requests, and complaints about this policy go to kyle@bitcoinforstartups.com, or by post to the address in Who we are.

We would like the chance to resolve a concern first. You also have the right to complain to a data protection authority. In the UK that is the Information Commissioner's Office. In the EEA it is the supervisory authority where you live, work, or where you believe the issue occurred.

For how the site itself may be used, see our Terms of Service.