Sign InMy LibraryExplore Resources

STARTLESS / LEGAL

Privacy Policy

This Privacy Policy explains how Buildflin LLC (“STARTLESS”, “we”, “us”), the operator of https://startlessco.com, collects, uses, shares and protects personal information, and the rights you have. It applies to the website and the purchase and delivery of our digital resources. For payments we use Paddle as Merchant of Record; Paddle is an independent controller of the payment data it collects and publishes its own privacy notice.

1. Who is responsible for your data

Buildflin LLC is the data controller for the personal information described here. For privacy questions, requests or complaints, contact hello@startlessco.com.

2. Information we collect

  • Account information — your name, email address and password hash (managed by our authentication provider), created when you sign up or when we create an account so a guest purchase can be delivered.
  • Order information — the resources you bought, order totals, order status, and the email associated with the transaction. Card and billing details are collected and processed by Paddle; they never reach our servers.
  • Library and download activity — which resources are in your library and when download links are used, so we can deliver files and detect abuse.
  • Email-list information — your email address and which list (newsletter or a resource list) you subscribed to, plus subscription status and timestamps.
  • Support messages — the content of messages you send us and the address you send them from.
  • Usage and device data — pages viewed, the site or campaign link that brought you here, and coarse event data (for example “product viewed”, “checkout started”), recorded in our own database. If you accept analytics cookies, these are tagged with a first-party visitor identifier so we can count unique visitors; if you decline, the same page views are recorded with no identifier at all (see section 3). We also use third-party measurement tools (Google Analytics and PostHog) which receive the page you opened, the page that referred you, and technical details your browser sends such as your IP address, device type and language. We do not use advertising or cross-site tracking cookies, and we have not enabled Google's advertising and personalisation features.

3. Cookies and similar technologies

We use a small number of cookies and local storage: a session cookie set by our authentication provider to keep you signed in; a first-party analytics identifier (“sl_vid”) used to count unique visitors and measure conversion; a first-party attribution cookie (“sl_src”) that remembers, for up to 90 days, which site or campaign link brought you here, so a purchase can be credited to it; local storage for lightweight interface preferences; and, once you accept analytics cookies, Google Analytics cookies (“_ga” and “_ga_<id>”) used to recognise a returning browser so visits and conversions can be counted. These are strictly necessary or analytics cookies; we do not set advertising or cross-site tracking cookies. You can clear or block cookies in your browser, though sign-in will not work without the session cookie.

If you decline, we set neither analytics cookie, and any we set before are deleted. We still count the page view itself — the page visited, the date and time, the country our host derives from the connection, and the kind of site or campaign that sent you (for example “linkedin” or “google”), taken from the link you arrived on. That record carries no identifier of any kind: no cookie is set or read, nothing is stored on your device, and the view cannot be linked to you, to your account, or to any other page view. Unique visitor counts, and anything that follows a person from one page to the next, happen only if you accept.

Declining also tells Google Analytics not to use storage: it sets and reads no cookie, nothing is stored on your device, and the measurement it sends carries no identifier that could join one visit to the next or to you. PostHog, our product-analytics provider, is loaded on every page and sets its own cookie holding a randomly generated identifier for your browser, but no events about what you do are sent to it unless you accept.

4. How we use information and our legal bases

  • To provide the service — create your account, process and deliver Orders, operate your library and download links, and provide support. Basis: performance of a contract.
  • To send email you asked for — resource-list and newsletter email, with an unsubscribe link in every message. Basis: consent.
  • To send service email — order confirmations, account and security notices. Basis: performance of a contract / legitimate interests.
  • To understand and improve the site — first-party analytics and aggregate reporting. Basis: legitimate interests in running and improving a small storefront — except for analytics cookies and third-party measurement that identifies a browser, where the basis is your consent, given through the cookie banner and withdrawable at any time.
  • To protect the service — prevent fraud, abuse and unauthorised access, and enforce our terms. Basis: legitimate interests.
  • To meet legal obligations — tax, accounting and responding to lawful requests. Basis: legal obligation.

We do not sell or share your personal information, and we do not use it for automated decisions that produce legal or similarly significant effects.

5. Service providers we share data with

We share personal information only with the providers that run the store, and only as needed for them to perform their function:

  • Paddle — payment processing, tax, invoicing and receipts (Merchant of Record).
  • Supabase — authentication, database and private file storage for accounts, orders, libraries and resource files.
  • Vercel — website hosting and content delivery.
  • Resend — sending transactional email, resource-list and newsletter email.
  • Google — Google Analytics, for website measurement and aggregate reporting. Google's advertising and personalisation features are switched off, and analytics storage is disabled until you accept analytics cookies. See Google's privacy notice.
  • PostHog — product analytics. Its script loads on every page and sets a cookie identifying your browser; events about what you do are sent to it only if you accept analytics cookies.

We may also disclose information if required by law, to enforce our terms, or in connection with a merger, acquisition or sale of assets (with notice to you where required).

6. International transfers

Our providers may process data in the United States and other countries. Where personal information is transferred out of the EEA, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

7. Retention

We keep account information for as long as your account is active. We keep order and transaction records for the period required by tax and accounting law (generally up to 7 years). Email-list records are kept until you unsubscribe and then only as needed to honour that choice. Analytics event data is kept in identifiable form for a limited period and then aggregated or deleted. Support messages are kept as long as needed to handle the matter and a reasonable period afterwards.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, export (port), restrict or object to the processing of your personal information, and to withdraw consent at any time. Where the GDPR or UK GDPR applies, you also have the right to lodge a complaint with your local data-protection authority. Where the California Consumer Privacy Act applies, you have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising these rights; we do not sell or “share” personal information as those terms are defined there.

To make a request, email hello@startlessco.com from the address on your account. We will verify your request and respond within the time the law requires (generally 30 days or 45 days). You can unsubscribe from marketing email at any time using the link in the message.

9. Security

We use access controls, encryption in transit, hashed credentials, private (non-public) file storage with short-lived signed download links, and vetted providers. No method of storage or transmission is completely secure; we cannot guarantee absolute security, and you share information with us at your own risk. If a breach affects your personal information, we will notify you and the relevant authorities as required by law.

10. Children

The site is not directed to children. We do not knowingly collect personal information from anyone under 16 (or under 13 where that is the applicable threshold). If you believe a child has given us information, contact us and we will delete it.

11. Do Not Track

We do not track you across other websites: we run no advertising tags, and Google's advertising, remarketing and personalisation features are switched off. Because of that we do not respond differently to browser “Do Not Track” signals. Analytics that can recognise your browser, including Google Analytics cookies, run only if you accept them in the cookie banner, and you can withdraw that at any time from the same banner.

12. Changes to this policy

We may update this policy. We will change the “last updated” date and, for material changes, take reasonable steps to notify account holders. Continued use after a change takes effect means you accept the updated policy.

13. Contact

Buildflin LLC — privacy questions and requests: hello@startlessco.com. See also our Terms of Service.

Last updated 7 October 2026.