Privacy Policy

This Privacy Policy explains how Buildflin LLC (“STARTLESS”, “we”, “us”), the operator of https://startlessco.com, collects, uses, shares and protects personal information, and the rights you have. It applies to the website and the purchase and delivery of our digital resources. For payments we use Paddle as Merchant of Record; Paddle is an independent controller of the payment data it collects and publishes its own privacy notice.

1. Who is responsible for your data

Buildflin LLC is the data controller for the personal information described here. For privacy questions, requests or complaints, contact hello@startlessco.com.

2. Information we collect

• Account information — your name, email address and password hash (managed by our authentication provider), created when you sign up or when we create an account so a guest purchase can be delivered.
• Order information — the resources you bought, order totals, order status, and the email associated with the transaction. Card and billing details are collected and processed by Paddle; they never reach our servers.
• Library and download activity — which resources are in your library and when download links are used, so we can deliver files and detect abuse.
• Email-list information — your email address and which list (newsletter or a resource list) you subscribed to, plus subscription status and timestamps.
• Support messages — the content of messages you send us and the address you send them from.
• Usage and device data — a first-party visitor identifier stored in a cookie, pages viewed, referring pages, and coarse event data (for example “product viewed”, “checkout started”). This is recorded in our own database. We do not use third-party advertising or cross-site tracking cookies.

3. Cookies and similar technologies

We use a small number of cookies and local storage: a session cookie set by our authentication provider to keep you signed in; a first-party analytics identifier (“sl_vid”) used to count unique visitors and measure conversion; and local storage for lightweight interface preferences. These are strictly necessary or first-party analytics cookies; we do not set marketing or third-party tracking cookies. You can clear or block cookies in your browser, though sign-in will not work without the session cookie.

4. How we use information and our legal bases

• To provide the service — create your account, process and deliver Orders, operate your library and download links, and provide support. Basis: performance of a contract.
• To send email you asked for — resource-list and newsletter email, with an unsubscribe link in every message. Basis: consent.
• To send service email — order confirmations, account and security notices. Basis: performance of a contract / legitimate interests.
• To understand and improve the site — first-party analytics and aggregate reporting. Basis: legitimate interests in running and improving a small storefront.
• To protect the service — prevent fraud, abuse and unauthorised access, and enforce our terms. Basis: legitimate interests.
• To meet legal obligations — tax, accounting and responding to lawful requests. Basis: legal obligation.

We do not sell or share your personal information, and we do not use it for automated decisions that produce legal or similarly significant effects.

5. Service providers we share data with

We share personal information only with the providers that run the store, and only as needed for them to perform their function:

• Paddle — payment processing, tax, invoicing and receipts (Merchant of Record).
• Supabase — authentication, database and private file storage for accounts, orders, libraries and resource files.
• Vercel — website hosting and content delivery.
• Our email provider — sending transactional email, resource-list and newsletter email.

We may also disclose information if required by law, to enforce our terms, or in connection with a merger, acquisition or sale of assets (with notice to you where required).

6. International transfers

Our providers may process data in the United States and other countries. Where personal information is transferred out of the EEA, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

7. Retention

We keep account information for as long as your account is active. We keep order and transaction records for the period required by tax and accounting law (generally up to 7 years). Email-list records are kept until you unsubscribe and then only as needed to honour that choice. Analytics event data is kept in identifiable form for a limited period and then aggregated or deleted. Support messages are kept as long as needed to handle the matter and a reasonable period afterwards.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, export (port), restrict or object to the processing of your personal information, and to withdraw consent at any time. Where the GDPR or UK GDPR applies, you also have the right to lodge a complaint with your local data-protection authority. Where the California Consumer Privacy Act applies, you have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising these rights; we do not sell or “share” personal information as those terms are defined there.

To make a request, email hello@startlessco.com from the address on your account. We will verify your request and respond within the time the law requires (generally 30 days or 45 days). You can unsubscribe from marketing email at any time using the link in the message.

9. Security

We use access controls, encryption in transit, hashed credentials, private (non-public) file storage with short-lived signed download links, and vetted providers. No method of storage or transmission is completely secure; we cannot guarantee absolute security, and you share information with us at your own risk. If a breach affects your personal information, we will notify you and the relevant authorities as required by law.

10. Children

The site is not directed to children. We do not knowingly collect personal information from anyone under 16 (or under 13 where that is the applicable threshold). If you believe a child has given us information, contact us and we will delete it.

11. Do Not Track

Because we do not track users across third-party sites, we do not respond differently to browser “Do Not Track” signals. Our analytics are first-party only.

12. Changes to this policy

We may update this policy. We will change the “last updated” date and, for material changes, take reasonable steps to notify account holders. Continued use after a change takes effect means you accept the updated policy.

13. Contact

Buildflin LLC — privacy questions and requests: hello@startlessco.com. See also our Terms of Service.