1. Scope and responsibilities
Startit Services LLC operates Startit Agents. This policy covers the commercial website, platform accounts, support and infrastructure enabling independent agents to publish websites and manage relationships. Privacy contact: info@startitservices.com.
Startit determines the processing of account, billing, security and support information needed to operate its own service. When an agent enters contacts, documents, appointments, deals or event registrations, that agent determines the purpose and Startit processes the data under the agent's instructions. The privacy notice on the agent's website identifies the contact for questions about that relationship. Legal classification as controller, processor, business, service provider or contractor depends on applicable law.
2. Information we collect
- Account and professional identity: name, email, language, protected access information, security preferences, photo, phone, trade name, license, brokerage, professional address, domain and settings.
- Service and content: pages, properties, images, articles, files, contacts, tags, notes, deals, tasks, forms, appointments, responses, event attendance and documents you choose to share.
- Billing: plan, billing interval, customer and subscription identifiers, payment status, invoices and limited payment-method details supplied by Stripe. We do not store complete card numbers or security codes.
- Support: messages, attachments you send, the page from which you request help and technical context needed to investigate.
- Technical and security information: IP address, user agent, requests, errors, dates, session identifiers, changes, authorizations and activity needed to detect abuse and maintain the service.
- MCP connections: authorized provider or client, permissions, tool requests, proposals, approvals and action results. We avoid recording passwords, payment keys or complete tokens in the history.
We receive information directly from you, visitors completing forms, the agent administering the account, and payment, email or authentication providers confirming operations. General forms do not require sensitive information. Do not use the service as a repository for medical records, banking credentials, complete government identity documents or children's data.
3. How information is used
We use information to create and protect accounts, publish authorized content, manage inquiries and reservations, operate the CRM and portal, record attendance, execute approved automations, process subscriptions, deliver operational email, respond to support, investigate incidents, maintain audit records, prevent fraud and comply with legal obligations.
We do not sell personal information, share it for cross-site behavioral advertising or incorporate advertising networks or third-party commercial profiling. We do not use CRM data to train our own AI models. If you connect an external assistant, information sent to it is also subject to that provider's terms; see the AI policy.
Where law requires identification of a legal basis, we rely on contract performance or requested precontractual steps, legal obligations, proportionate legitimate interests in security and operations, and consent where appropriate. An agent must separately determine a valid basis for each contact relationship and respect preferences. We do not make decisions with legal or similarly significant effects based solely on automated profiles of people.
4. Who may receive information
Information may be accessible to the agent responsible for the account, clients regarding documents and steps shared with them, authorized Startit personnel when necessary for operations or support, and infrastructure, email, payment and security providers that need to process it to deliver their services.
Stripe receives payment information you provide through its protected flow. Resend processes addresses and the content of sent emails. AI clients you authorize receive responses within the permissions granted. The provider register distinguishes operational services from user-selected connections. Providers may act for limited independent purposes when their legal obligations require it.
We may disclose information when required by law or a valid demand, to protect rights or prevent harm, or in a legitimate corporate transaction subject to protection and notice commitments. Other agents do not gain access to your CRM by using the same platform. Publishing content makes it publicly accessible and may enable indexing or copies outside our control.
5. Retention and deletion
We retain data while needed for the stated purpose, an active relationship or a legitimate obligation. Account and service data remain during service delivery and the closure or export process. Payment records may be retained for periods required by tax, accounting, antifraud and claims-defense rules. Security and support records are retained proportionately to investigation, auditing and preventing recurrence.
The agent may correct or delete resources using available controls and request closure or additional deletion. A plan change is not an instruction for immediate deletion. When closing an account, we verify the request, address outstanding obligations and coordinate export or deletion; we explain if a legal obligation prevents deletion of particular records. Backups rotate and are not ordinarily used to reintroduce deleted data. Minimal records proving an opt-out or preventing abuse may be retained with restricted access.
Indefinite retention of canceled accounts is not guaranteed. The operational export and deletion period for a closure is communicated when processing it. You may request information about the period applying to a particular data category without canceling your account.
6. Protection, location and transfers
We apply authentication, account- and plan-based authorization, data separation, input validation, session protection, action logging and backup mechanisms. Public deployment must use HTTPS. We limit administrative access to operational needs. These measures reduce risks, but no system guarantees absolute security.
Startit is a US company and providers may process information in the United States and other locations described in their contracts. The server location and active providers should be checked in the provider register and deployment configuration. If a transfer requires contractual clauses or other safeguards under applicable law, they must be established before transferring the data; using the service does not replace that requirement or waive rights generally.
If you detect an incident, write to info@startitservices.com with "Security" in the subject. Do not include secrets or exploit or disclose another person's information to demonstrate the issue. We will meet applicable assessment, containment and notification obligations.
7. Your rights and how to exercise them
Depending on residence and applicable law, you may request access or knowledge of data, copies and portability, correction, deletion, restriction or objection to certain processing, withdrawal of consent, recipient information and review of a decision on your request. We do not discriminate for exercising rights. Withdrawing consent does not invalidate earlier processing or prevent necessary uses based on another valid obligation.
Write to info@startitservices.com with the email used, related website or account and request type. We will verify identity proportionately without requesting unnecessary information. An authorized representative must demonstrate authority. Do not send complete identity documents without arranging a secure channel. We will respond within the applicable legal deadline and explain permitted extensions and their reasons.
If your information belongs to an agent's CRM or event, direct the request to that agent first; you may also contact us for help routing it. We will not alter the controller's valid instructions without a basis. If dissatisfied, request review at the same address with "Privacy appeal" in the subject, and you may complain to the competent authority without affecting other rights.
For California residents, rights to know, access, correct, delete and limit or object apply when legal conditions are met. We do not sell or share information for behavioral advertising, so there is no such activity that must be enabled to process an opt-out signal. We respect privacy signals recognized by applicable law and do not treat a "Do Not Track" signal as consent to tracking.
9. Updates and contact
The policy date and version appear at the beginning. We will communicate material changes appropriately to their significance; where a new purpose requires consent, we will not presume a prior acceptance covers it. The single contact for privacy, rights and security is info@startitservices.com.
Private app and notification preferences
In the agent's app we process conversations, shared searches and links, favorites, comments, appointments, document requests, submissions, reviews and preferences you provide. The agent accesses information about their relationship with you; other agents do not gain access by using the platform.
Activating a device creates a private session with its technical name and dates of use, expiration and revocation. Activation links expire after 30 minutes and are used once. A device session lasts up to 30 days; you can revoke it in Preferences and the agent can revoke the portal. Session credentials are not exposed to page scripts.
If you authorize push notifications, we store the browser subscription endpoint and keys encrypted. Browser providers may process metadata needed to deliver alerts. Push content is generic: private details require entering the app. Distinguishing provider acceptance from reading avoids attributing unverified activity. We record a read when you mark the message as read.
You may choose channels, language, time zone and quiet hours, pause reminders and withdraw promotional communications. Removing push on one device does not delete conversations. Essential access or security notifications may remain necessary to provide the service. For access, correction or deletion, contact the agent or info@startitservices.com.
Acceptances, publications and contractual evidence
We retain the complete version of the documents presented and their digital fingerprint, the account and identity or reference of the accepting person, language, date, channel, express confirmations and technical data needed to evidence the operation, such as IP address or network and browser fingerprints. Publication receipts include the operation, affected record where applicable and a fingerprint of the approved content. A fingerprint helps verify integrity; it does not mean that Startit has legally verified the content or that the client has read every word.
These records are used to administer the contract, demonstrate instructions and consents, investigate abuse, address claims and meet legal obligations. They are not used as advertising consent. Necessary evidence may be retained after account closure, with restricted access and data minimization, for the period justified by applicable obligations and claim deadlines. We assess deletion requests and explain legal exceptions; we do not promise to delete evidence we must preserve or to retain it indefinitely without justification. You may consult and save versions and your receipts from the legal center or request a copy.
Document fingerprint (SHA-256): 1a2fc14ba3838343046b75a198c18f6083a4172ea938312861d2f114f6847824
We are here to help.
Startit Services LLC · Florida, United States.
11851 Southwest 179th Terrace, Miami, FL 33177, United States