Privacy Policy

Who is responsible for the data

StarUp is a service provider to businesses. When a business connects StarUp to its invoicing system, that business decides what customer data is processed and for what purpose — so it is the data controller, and StarUp acts only as a processor on its behalf.

In practice: if you received a message from us after a job was done for you, questions about your data should go to the business that did the work. We will help them answer.

For the business owners' own data — sign-in details, settings and billing — StarUp is the controller.

What we collect about end customers

A phone number in international format, first and last name where the business supplied them, preferred language, and the recorded source of consent.

Details of the job the request relates to: the job's identifier in the business's own system, the service type, when it was completed, and which location it belongs to.

The status of messages sent — sent, delivered, failed — and the time of any opt-out.

StarUp does not collect the content of the review written on Google and does not link it back to the customer. The review is written on the business's own profile and published subject to Google's terms.

What we collect about business owners

An email address and sign-in credentials, the business name, its locations, time zone and country.

Authorisation to your Google Business Profile, if connected. We store an account identifier and an encrypted refresh token, used only to read your review link and sync location details.

Keys and webhook secrets used to connect your invoicing system. These are stored encrypted and cannot be read back after they are created.

What the data is used for

To send at most one review request and one reminder following a job completed by the business.

To honour opt-outs, and to make sure anyone who asked not to be contacted is not contacted again.

To show the business an aggregate report: how many requests went out, how many were delivered, how many resulted in a review.

To secure the service, detect abuse and meet legal obligations.

Data is never sold, never rented, and never used for third-party advertising.

AI in the service

There are two places in the service where a language model reads personal data. Both use Claude, made by Anthropic, queried through its API. The description below is deliberately full: a system that draws conclusions about a person is hard to understand from the outside, and without an account of how it works you cannot decide what you think of it.

WhatsApp job intake: when a business connects the WhatsApp conversation it uses to report finished jobs, the model reads every message that arrives there and decides whether it reports work that has been completed. From a message it reads that way, it extracts the customer's phone number, their name if the message contains one, the service type, and a confidence score of its own. That output — including the finding that a message describes a job, and the confidence attached to it — is itself personal data about the customer, and is stored alongside the job record.

Review themes: the model reads the public reviews published on the business's Google profile and produces up to three recurring themes for the business to see. The reviews it reads are the ones Google returns, at most five, so this is a sample rather than a full picture.

What leaves the service: the message text or the review text, the business name, and the working language — nothing beyond that. Anthropic does not use data sent through its API to train its models, and StarUp does not train any model on customer or business data. Anthropic's servers are outside Israel, and the transfer is subject to the section on transfers below.

The replies sent back into the WhatsApp conversation — a mark on a message that was picked up, or a note that we could not read a particular message — are sent by an automated system, not by a person.

What can go wrong: the model can be wrong, which is why this belongs in the description rather than in a footnote. It may read a message that is not a job report as though it were one, or attach a phone number to a job that is not the customer's — an address, a price, or another person's number that appeared in the same message. The possible result is a review request sent to someone who was not expecting one. The confidence score is recorded but does not by itself block a send, so the responsibility to watch the delivery log and stop a mistake rests with the business.

What the model does not do: it does not score customers, does not assess personality, does not screen who gets contacted by predicted satisfaction, and decides nothing about you beyond whether the message describing your job becomes one review request.

Consent and opting out

Every message includes a way to stop receiving them. An opt-out is recorded against the business and takes effect immediately for all of its future messages.

The business is responsible for having a lawful basis to contact its customer. StarUp provides the tools to record the source of consent and to honour opt-outs, but does not decide for the business who may be contacted.

Who the data is shared with

Messaging providers: 019 Mobile for SMS in Israel, and in some cases Twilio. If the business has connected its own WhatsApp Business account, messages go through that account.

Infrastructure: Supabase, for database hosting and user authentication.

Anthropic, to run the model that reads job reports and review text, as described in the AI section above.

Google, to read business profile details and the review link, where the business has connected its account.

Competent authorities, where required by law or court order.

Each provider receives only the minimum needed to do its job.

Transfers outside Israel

Some providers operate servers outside Israel, including in the United States. Where that happens, the transfer is made subject to the Protection of Privacy Regulations (Transfer of Data Abroad).

How long data is kept

End-customer records and message history are kept while the business's account is active, and deleted within a reasonable period after it closes.

Opt-out records are kept beyond that point — it is the only way to guarantee that someone who asked to be removed is not messaged again.

A business can ask us to delete its customer data sooner.

Once a year we review whether the database still holds data that is no longer needed for the purposes it was collected for, and delete what is not.

Security

Access is scoped to the owning business and enforced at the database layer. Secrets and third-party connections are stored encrypted.

Customer personal data is not put into general-purpose AI tools used by staff. The only two paths that send data to a model are the ones described in the AI section, and they send the minimum needed.

No system is perfectly secure. If a security incident occurs that requires notification, we will follow the reporting duties that apply and inform the affected businesses.

Your rights

Under the Protection of Privacy Law, 5741-1981, as amended by Amendment 13, you may learn who controls the database holding data about you, inspect that data, ask for anything inaccurate, incomplete, unclear or out of date to be corrected, and ask for it to be deleted.

Where the data was produced by a model — details extracted from a job report, for instance — the right to correction covers that too. If the extraction turns out to keep making the same mistake, correcting the single record is not enough: we will act at the level of the process and stop automatic intake from that conversation until the fault is resolved.

You are under no legal obligation to give us data, and you do not give it to us directly — it reaches us from the business that did the work for you. If you do not want to be contacted, an opt-out takes effect immediately and covers every later message from that business.

If the data was collected by a business you were a customer of, contact that business. For anything else — or if you do not know which business to ask — write to the address at the bottom of this page and we will help.

If the answer you get does not satisfy you, you can complain to the Privacy Protection Authority at the Ministry of Justice.

Children

The service is intended for businesses and is not directed at children. We do not knowingly collect data about them.

Changes to this policy

We will update this page when the policy changes and change the date at the top. Material changes will be communicated to businesses in advance.