Privacy Policy

• Account data: name, email address, password (stored hashed by our authentication provider), and optionally phone number, location and bio.
• Google sign-in: if you choose it, your name, email and profile picture from Google.
• Starta applications: project details and the documents you upload, including business plans, forecasts and a government-issued ID.
• Donations: amount, the Starta supported, anonymity preference, any message you leave for the founder, and the payment reference. Card details are handled by Paystack and never stored by Starta.
• Messages: anything you send via our contact or support forms.
• Newsletter: your email address, if you subscribe.
• Technical data: IP address, browser and device information, and cookies needed to keep you signed in.

• to create and secure your account (contract);
• to process donations and send receipts (contract);
• to review Startas and verify founders, and to prevent fraud (legitimate interests, legal obligation);
• to respond to your enquiries (legitimate interests);
• to send service emails about your account, Startas and donations (contract); and
• to meet legal, tax and regulatory obligations (legal obligation).

Your name may appear publicly as the founder of a live Starta. Your email address and phone number are never shown to other users. When you donate, your name, amount and any message you leave appear on that Starta's public donor wall; if you donate anonymously, your name is replaced with “Anonymous Donor”. Starta documents are visible only to you and our review team.

We share data only with service providers who help us run Starta, under appropriate agreements:

• Supabase — database, authentication and file storage;
• Paystack — payment processing;
• Resend — transactional email;
• Vercel — website hosting; and
• Google — sign-in, if you choose it.

Some of these providers process data outside Nigeria. Where they do, we rely on the safeguards permitted by the Nigeria Data Protection Act. We may also disclose data where required by law or to protect users from fraud. We do not sell personal data.

We keep account data while your account is open. Donation and payment records are kept for as long as required for tax and accounting purposes (typically six years). Documents from rejected Starta applications are deleted within 12 months unless we need them to investigate fraud.

You can ask to access, correct, delete or receive a copy of your personal data, object to or restrict certain processing, and withdraw consent where we rely on it. You can update most profile details yourself in Settings.

To exercise your rights, email hello@startaafrica.com. If you are unhappy with our response, you may complain to the Nigeria Data Protection Commission.

We use essential cookies to keep you signed in and to secure the site. We do not use advertising cookies.

We use encryption in transit, access controls and least-privilege permissions to protect your data. No system is perfectly secure; if a breach affects you we will notify you and the regulator as required by law.

We may update this policy. We will post the new version here and, for material changes, notify you by email.