Privacy Policy
Last updated: 2026-10-13This Privacy Policy explains how Startup Valleys (startupvalleys.com, operated by Artur Kochanov) collects, uses, and protects your personal data when you visit our website, submit information through our forms, or create an account.
Startup Valleys is a directory of Swiss startups and their open jobs — not limited to Europe. Visitors and contributors from any country can use the Service. The Swiss Federal Act on Data Protection (FADP) applies to our processing. The EU General Data Protection Regulation (GDPR) also applies where its territorial scope is met. We assess privacy requests under the law applicable to the individual processing activity.
1. Data Controller
2. What Data We Collect
2.1 Information you provide
When you register, add or claim a company, use social features, or submit other content, we collect:
- Account data: email, password hash (argon2id — never plaintext), display name
- Registration evidence: accepted Terms version, acceptance time and registration method; acceptance is not blanket consent to marketing
- Optional profile details: avatar, headline, biography and social links
- OAuth provider ID + email when you sign in with Google / Microsoft / LinkedIn / Apple
- Company and other submission details (name, description, address, map coordinates, URL, dates, tags, and an uploaded logo where provided)
- Company ownership requests: the company selected, your stated role, and whether your verified account email matches a company contact or website domain
- Company posts (text, photos, videos), comments, companies you follow, and posts you like
- Job applications: name, email, optional phone + cover letter + résumé
- Event RSVPs: name + email
- Correspondence, correction and removal requests, and email delivery information; where enabled by the email service, opening or interaction status
2.2 Information collected automatically
- Technical data: IP address, browser + device, operating system, referrer URL
- Usage data: page views, referring websites, device/browser categories, country and selected interactions, using self-hosted Umami analytics
- Operational data: access/error logs and moderation records needed for security and troubleshooting
2.3 Information from public sources
We also collect company and job information from company websites, job boards, public registers and business directories. These may include professional names, roles, business contact details and profile links. We use them to maintain listings, verify submissions and contact appropriate company representatives. Public availability does not remove data-protection rights. Private internal HR contact fields are not published through our public directory API.
2.4 Advertising and disclosure
- No cross-site advertising tracking
- We do not sell or share your data with advertisers
- Private HR contact data is never exposed through the public API
2.5 What other people can see
Company profiles and their posts, including uploaded photos and videos, are public. Comments appear publicly with the commenter’s display name. Post dates and total like and comment counts are also visible. Other people can copy public content while it is available on the Service. Removing a post cannot remove copies saved elsewhere.
The social features do not automatically publish your account email, your list of followed companies, or which posts you have liked. Your followed-company feed is available in your signed-in account. We use follows to assemble that feed and likes to update post counts. Company ownership requests and email-match indicators are provided to administrators for manual review; submitting a request does not publish them.
3. Purposes and legal bases
Where the GDPR applies, the following legal bases govern the respective activity. Under Swiss law we also observe lawful, proportionate and purpose-bound processing.
| Purpose | Legal basis |
|---|---|
| Displaying the map and public content | Legitimate interest (Art. 6(1)(f)) |
| Operating your account | Contract (Art. 6(1)(b)) |
| Aggregate audience measurement with self-hosted Umami | Legitimate interest in understanding use and improving the Service (Art. 6(1)(f)); without cross-site advertising profiles |
| Requested submissions, applications and RSVPs | Contract / pre-contractual steps (Art. 6(1)(b)) |
| Public-source listings, internal business contacts, moderation and correspondence | Legitimate interests in maintaining the directory, verifying authority and answering requests (Art. 6(1)(f)); subject to individual rights and balancing |
| Proof of Terms acceptance and legal obligations | Contract / evidence interests (Art. 6(1)(b), (f)); legal obligations where applicable (Art. 6(1)(c)) |
| Optional processing that requires consent | Separate consent (Art. 6(1)(a)), withdrawable at any time |
| Payment processing | Contract (Art. 6(1)(b)) |
| Security logging + fraud prevention | Legitimate interest (Art. 6(1)(f)) |
4. Service providers and recipients
We use the following services to operate Startup Valleys. Your data may be transferred to these providers when the relevant feature is used. Some act as processors; payment, sign-in and social-network providers may also act as independent controllers.
Contabo GmbH — Hosting (servers, Mongo, Redis)
Processes: all account and submission data at rest + in transit
Welfenstraße 22, 81541 München, Deutschland
Server location: Falkenstein, Germany
Resend Inc. (USA) — Transactional email and company invitations
Processes: recipient email, message and template data (company name, etc.), delivery information and, where enabled, opening or interaction status
Privacy: resend.com/legal/privacy-policy
Stripe Inc. (USA) — Payment processing for job posts and event tiers
Processes: your card data (Stripe-hosted checkout — we never see raw card data), billing email
Privacy: stripe.com/privacy
Mapbox Inc. (USA) — Maps and geocoding
Processes: submitted addresses; when the map loads, technical request data such as IP address, browser information and requested map tiles
Privacy: mapbox.com/legal/privacy
Anthropic, PBC (USA) — AI-assisted extraction, job checks and business-contact research
Processes: relevant page text, submitted URLs and publicly available or publication-intended business information, which can include professional personal data. We do not send account passwords or payment-card data for these tasks. Results can be cached for reuse.
Privacy: Anthropic privacy information
DeepL SE (Germany) — Translation, where enabled
Processes: company, incubator or job descriptions selected for translation.
Privacy: DeepL privacy information
Sign-in providers — Google (Ireland/USA), Microsoft (Ireland/USA), LinkedIn (Ireland/USA) or Apple (Ireland/USA), where offered and chosen by you
We receive a provider identifier, name and email/verification information for your selected sign-in method. The provider receives your authentication request and technical connection data. We do not receive your provider password. Its own privacy information also applies.
Logo retrieval services such as Brandfetch or Google’s favicon service receive company domains through our server-side proxy; they do not need your account credentials for this request.
International transfers: the recipients above can process data outside Switzerland, including Germany, Ireland and the USA. Transfers require the protections prescribed by applicable law: an adequate protection finding, applicable certification under the Swiss-US/EU-US Data Privacy Framework, or recognised Standard Contractual Clauses with the necessary Swiss adaptations. Certification is relevant only for a provider actually covered by it. You may contact us for information about the safeguards applicable to a particular provider; its privacy and processing terms explain its subprocessors.
4.1 Company mentions on LinkedIn
Under the permission described in section 5.1 of the Terms, we may present a company in a post on our LinkedIn page with its public name, the logo shown on its profile, a short description, a preview picture made from the public profile and the profile link, and tag the company page. This does not include private account/contact data or tagging personal profiles. Where this concerns an identifiable person, a separate lawful basis is required; Terms acceptance alone is not consent to publish that person’s private data.
LinkedIn Ireland Unlimited Company (Ireland) is the controller for people in Switzerland and the EEA; LinkedIn Corporation (USA) is responsible in other regions. LinkedIn can process data in the USA under its own rules. You can object to future company mentions at our contact address. LinkedIn Privacy Policy.
5. Cookies & Local Storage
| Name | Type | Purpose | Duration |
|---|---|---|---|
| sv_refresh | HttpOnly cookie | Refresh your signed-in session | 30 days |
| sv_oauth_state | HttpOnly cookie | Protect a sign-in request against misuse | Up to 10 minutes |
| sv_oauth_totp | HttpOnly cookie | Complete two-factor sign-in | Up to 5 minutes |
| sv-locale | Cookie | Remember your selected language | Up to 1 year |
| sv:locale | localStorage | Remember your language preference | Persistent |
| sv:mapStyle | localStorage | Remember your map style (light / dark / sat) | Persistent |
| sv:wizard:* | localStorage | Remember contribute-flow drafts so refreshes don’t lose progress | Until submitted |
| sv-ai-referral | sessionStorage | Avoid counting the same AI-referral source twice in a browser tab | Browser tab session |
Umami is self-hosted and uses no analytics cookies or cross-site advertising profiles. Technical requests still process network/device information. We exclude URL query strings and fragments from page-view collection and respect the browser’s Do Not Track setting. The Cookie Policy gives further details.
6. Your Rights (GDPR & FADP)
Depending on the applicable law and its conditions, you have the following rights regarding your personal data:
- Right of access — request a copy of data we hold about you
- Right to rectification — correct inaccurate data
- Right to erasure — request deletion (“right to be forgotten”)
- Right to restrict processing — limit how we use your data
- Right to data portability — receive your data in a structured format
- Right to object — object to processing based on legitimate interest
- Right to withdraw consent — for processing based on consent
- Right to lodge a complaint — with the Swiss FDPIC or your local EU data protection authority
To exercise any of these rights, email us at [email protected]. We respond within the applicable statutory deadline, generally one month or 30 days, and explain any lawful extension. We may request proportionate identity verification. Objection and withdrawal do not affect prior lawful processing; retention obligations may limit immediate deletion.
7. Data Retention
- Account data: retained while needed for your account; deletion requests are reviewed and implemented subject to statutory duties and legitimate evidence needs
- Published listings: retained while relevant and lawful; an independently sourced company listing does not automatically disappear with account deletion
- Social content: posts and comments remain displayed until removed. Comment authors can delete their comments; company owners can delete their company’s posts.
- Social interactions: follows remain until you unfollow, and likes until you remove them or the post is deleted.
- Requests, moderation and acceptance evidence: retained as needed to handle the request, prevent misuse or establish legal claims
- AI response cache: normally 7 days for imports/contact research and up to 90 days for job checks or classification; job verification results stored with a listing may remain with that listing
- Payment records: retained per Swiss tax/commercial law (10 years)
- Backups: deletion may take effect in backup copies after their rotation; retained backup data is not used as an active directory
8. Data Security
- HTTPS/TLS encryption for all traffic
- Passwords hashed with argon2id — we never store plaintext
- Admin accounts optionally protected by TOTP 2FA
- Private data (HR contacts) not exposed via public API; RBAC enforced server-side
- Restricted administrative access, security logging and regular backups
9. Children’s Privacy
Account registration is intended for people aged 16 and over. Please contact us if you believe a younger person has provided account data, so we can assess appropriate action.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Significant changes will be communicated through appropriate channels. The date above reflects the current version. If a new activity requires consent, we obtain it separately.