This Privacy Policy ("Policy") explains how we collect, use, store, share and protect your personal data, and the rights you have over it.
Starta.one is owned and operated by Collaboracia OÜ ("we", "us", "our", "Company", "Starta.one"), a company registered under the laws of the Republic of Estonia, with its registered office at Harju maakond, Tallinn, Kesklinna linnaosa, Kaupmehe tn 7-120, 10114, Estonia (registry code 16244454).
This Policy applies to the data we handle through the website https://starta.one/ and its subdomains, our web and mobile applications, our communication channels (email, SMS, push notifications and in-product chat) and our social media accounts ("Site"). It is part of, and should be read together with, our Business Terms of Use, our Customer Terms of Use and our Cookies Policy.
You can reach us about any privacy matter at:
We use the following terms, in line with the GDPR and our Terms of Use:
Starta.one is a platform that businesses use to manage their operations and serve their own clients. Our role under the GDPR depends on whose data is involved:
We are the controller of personal data about you as a user of Starta.one — for example, your account and profile data, your billing data, your support communications, and usage and analytics data we collect when you use the Site.
We are a processor of the personal data a Business enters into its Organization about its own clients, employees and contacts (for example, customer records, bookings, visit history and notes). In that case the Business is the controller, decides why and how that data is used, and we process it only to provide the platform, on the Business's instructions and under our Terms of Use (which incorporate data-processing terms). If you are a client of such a business, please direct privacy requests about that data to the business; we will assist the business in responding.
We collect only what we need for the purposes below. The categories, purposes and legal grounds are:
| Purpose | Data we process | Legal ground (Art. 6 GDPR) |
|---|---|---|
| Create and maintain your Account; authenticate you (including via Google or Apple sign-in) | Name, login, email, phone number, password (stored hashed), profile photo, language and preferences; identifiers returned by a sign-in provider you choose to use | Performance of a contract — 6(1)(b) |
| Run an Organization and Business Profile; provide CRM, calendar, bookings, analytics and related functionality | Workplace information (company name and registration number, job role) where you act for a Business; the business and operational data you enter (for client records we act as processor — see §3) | Performance of a contract — 6(1)(b) |
| Take payment for paid subscriptions and add-ons | Billing identifier, name, email, country, billing address, payment status and payment-processor reference. We do not store full card numbers — these are handled by our payment processor | Performance of a contract — 6(1)(b) |
| Answer your requests and provide support; operate in-product and AI chat | Contact details and the content of your messages (including messages you send to our AI assistant) | Performance of a contract — 6(1)(b); legitimate interests — 6(1)(f) |
| Send service messages, reminders and notifications (email, SMS, push) | Email, phone number, device push token | Performance of a contract — 6(1)(b) |
| Keep the Site secure, prevent fraud and abuse, and ensure reliability | IP address, device and browser information, session identifiers, log and security data (including reCAPTCHA signals) | Legitimate interests — 6(1)(f); legal obligation — 6(1)(c) |
| Understand and improve how the Site is used (analytics, including optional session replay) | Usage data, page views, interactions, approximate location, device and session identifiers | Consent — 6(1)(a) |
| Marketing about our own services and measuring our campaigns | Contact details, usage and advertising identifiers | Consent — 6(1)(a); legitimate interests — 6(1)(f) |
| Comply with legal obligations (accounting, tax, lawful requests, records under Art. 30 GDPR) | Account, transaction and communication records as required by law | Legal obligation — 6(1)(c) |
We do not ask for, and ask you not to provide, special categories of data (such as health, religious or political data). Where a Business chooses to store such data about its clients, it does so as the controller and is responsible for having a lawful basis.
We rely on four lawful bases under Article 6 of the GDPR:
Starta.one includes AI-powered features (such as the Starta assistant) that help you operate your business — for example answering questions, drafting content and helping you perform actions you request.
No solely-automated significant decisions. We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing within the meaning of Article 22 of the GDPR. AI outputs are tools to assist you and the people using the platform.
We use cookies and similar technologies to keep you signed in, remember your preferences, keep the Site secure, measure usage and (with your consent) for marketing. You can review and change your choices at any time through the cookie settings on the Site. Full details — including categories, providers and retention — are in our Cookies Policy.
We do not sell your personal data. We share it only as described here, and we put data-processing agreements in place with our processors.
We share data with carefully selected providers who process it on our behalf to deliver the Service:
| Provider | Purpose |
|---|---|
| Amazon Web Services (AWS) | Cloud hosting and storage (primary region in the EU — Frankfurt) |
| Cloudflare | Content delivery, security and DDoS protection |
| Stripe | Processing of subscription payments |
| Twilio SendGrid | Sending transactional email |
| TurboSMS, Twilio, SMS.to | Sending SMS notifications |
| Expo | Delivering mobile push notifications |
| PostHog (EU hosting) | Product analytics and optional session replay |
| Maps, reCAPTCHA (anti-fraud), Tag Manager and account sign-in | |
| Apple | "Sign in with Apple" authentication |
| OpenAI, Google (Gemini), xAI | AI assistant and related AI features |
Where marketing measurement is enabled, we use the Meta pixel and act as a joint controller with Meta Platforms Ireland Limited for the collection and onward transmission of certain event and statistical data, within the meaning of Article 26 of the GDPR. You may exercise your rights against either us or Meta.
When a Business uses Starta.one to take payments from its own clients, it may connect a payment provider (such as Stripe, Monobank, LiqPay or WayForPay). Those payments, and the related payment data, are handled directly between the Business, its client and the chosen provider under that provider's own terms and privacy policy. We are not a party to those payments.
We may disclose personal data to professional advisers, to authorities where required by law or to protect rights and safety, and to a successor entity in the context of a merger, acquisition or reorganisation (subject to this Policy).
We host your data primarily in the European Union (AWS, Frankfurt), and our analytics provider stores data in the EU. Some of our processors (for example Stripe, Google, Apple, Meta, OpenAI and xAI) may process personal data outside the European Economic Area, including in the United States. Where they do, we rely on an adequacy decision under Article 45 of the GDPR or on appropriate safeguards under Article 46 — in particular the European Commission's Standard Contractual Clauses (SCCs) — together with supplementary technical and organisational measures such as encryption in transit.
We apply appropriate organisational, technical and administrative measures designed to protect personal data against unauthorised access, disclosure, alteration and loss — including encryption in transit, access controls, and regular review of our procedures. No method of transmission or storage is completely secure, but we work to protect your data and to respond promptly to any incident, including notifying you and the supervisory authority where the law requires.
Starta.one is a business tool and is not directed to children. We do not knowingly collect personal data from children under 13 years of age (the digital-consent age set by Estonian law under Article 8 of the GDPR).
By registering, you confirm that you are at least 13 years old. If you are below the age of majority in your country, you confirm that you have the consent of a parent or legal guardian and the legal capacity to enter into our Terms of Use. If you believe a child under 13 has provided us with personal data, please contact [email protected] and we will delete it.
Under the GDPR you have the right to:
To exercise any of these rights, write to [email protected] (and use the relevant settings in your Account where available). We will respond within one month, as required by Article 12(3) of the GDPR. If your request concerns data a Business controls (see §3), we will refer you to, and assist, that Business.
We would appreciate the chance to address your concerns first, so please contact us at [email protected]. You also have the right to lodge a complaint with your local supervisory authority in the EEA, or with our lead authority in Estonia:
Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon)
Tatari 39, 10134 Tallinn, Estonia
Phone: +372 627 4135 · Email: [email protected]
Website: https://www.aki.ee/en
We may update this Policy from time to time — for example to reflect new features, providers or legal requirements. When changes are material, we will notify you by email, in-product notice or another appropriate means, and where the law requires we will obtain your consent. The "Last updated" date at the top shows when this version took effect. We encourage you to review this Policy periodically.
If you have any questions about this Policy or your personal data, please contact us: