Privacy Policy
Last updated August 11, 2026
Bootup Studios Inc. ("Bootup Studios," "we," "our," or "us") provides an AI-assisted platform that helps founders plan and run a business. This policy explains what information we collect, why, who we share it with, and the choices you have. It applies to bootupstudios.ai and the related services (the “Services”).
We have tried to write this in plain language. Where something is genuinely important — what our AI can do on your behalf, what information you collect about other people, and what an organization administrator can see about you — we have given it its own section rather than burying it in a list.
This document is written in English. Any translation is provided for convenience only; if a translated version conflicts with the English version, the English version controls.
1. Who this policy covers
This policy covers people who use Bootup Studios: individuals who sign up directly, and people who use the Services through an organization such as an employer, university, or accelerator.
If you use Bootup Studios through an organization, that organization controls your seat and can see certain information about your use of the Services. Section 6 sets out exactly what they can and cannot see.
The Services are offered in the United States and Latin America. They are not directed to, or offered in, the European Economic Area, the United Kingdom, or Switzerland.
2. Information we collect
Information you give us
- Account details. Your name, email address, and — if you sign up with a password — a password, which is handled by our authentication provider and is never visible to us. If you sign in with Google, we receive your basic profile information and profile picture.
- Phone number. Only if you choose to link one for text messaging. See Section 9.
- Content you create. Business ideas, project names and descriptions, business plans, timelines, tasks, notes you save to a project, and anything you type into an AI conversation.
- Files you upload. Images, PDFs, and audio attached to a conversation, and screenshots attached to feedback.
- Feedback and support messages. What you write to us, plus the page you were on and your browser and screen size at the time.
- Information about other people. Contact and profile details you gather using our lead-generation features. This is covered separately in Section 5, because it is information about people who are not our users.
Information we collect automatically
- Usage records. Which AI actions you run, when, which model handled them, how many tokens they consumed, and what they cost us. We use this to meter your plan. These records hold usage figures, not the content of your prompts.
- Server logs. Requests to our servers, including timestamps, error details, and identifiers such as your account ID. Our hosting provider records standard request information, which can include IP address.
- Sign-in activity. When you last signed in, and whether your account is active.
- Security records. For a small number of sensitive actions — such as unlocking an organization console — we record the action, the account that took it, and the originating IP address.
We do not run web analytics or advertising trackers. We do not use advertising cookies, marketing pixels, or third-party analytics tools, and we do not build advertising profiles. Section 8 lists every cookie we set.
3. How we use information
We use the information described above to:
- Provide the Services and keep your account working
- Generate business plans, timelines, chat replies, and research results when you ask for them
- Carry out actions you direct our AI to take in apps you have connected
- Meter your usage against your plan and process payments
- Send you service messages about your account, security, and projects
- Provide support and respond to what you report to us
- Detect, investigate, and prevent abuse, fraud, and security incidents
- Diagnose faults and improve how the Services work
- Comply with legal obligations and enforce our Terms of Use
We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are used under California law.
4. AI features and how your content is processed
Our AI features are built on large language models operated by third-party AI providers. To answer you, we send the relevant material to one of those providers.
What we send
Depending on the feature you are using, this can include your message, recent conversation history, your project's business plan and timeline, notes you have saved to the project, information about leads saved to that project, and links to files you have attached. We send what the feature needs to produce a useful answer, not your whole account.
Training
Bootup Studios does not use your content to train AI models. We have no model-training pipeline and your content is not used to build one. Our AI providers process your content under their own terms in order to return a response; we select providers on terms intended for business use, and we can tell you which providers we currently use if you ask.
Actions taken on your behalf
If you connect a third-party app and ask our AI to act in it, the AI can read from and write to that app — for example drafting and sending an email, creating a document, or posting content — using the access you granted. Some actions ask you to confirm first. You can also schedule tasks that run unattended, and you decide when you set one up whether it may take higher-risk actions without asking. Section 10 explains how to revoke this access.
Accuracy
AI output can be wrong, incomplete, or invented, and it is not professional advice. Review it before you rely on it or act on it. Our Terms of Use say more about this.
Where AI content is stored
Conversations and generated content are saved to your account so you can come back to them. They stay until you delete the conversation, the project, or your account.
5. Information you collect about other people
Our lead-generation features search public web sources on your instruction and return information about businesses and individuals. If you save those results, we store them in your project on your behalf.
Saved lead records can include, where the source made it available:
- Names of businesses and of individuals
- Email addresses and phone numbers
- Street addresses and approximate location
- Websites and social media profile links
- Publicly posted profile photographs, biographies, and follower counts
- A description and a relevance score generated by our AI to indicate how well the lead matches what you asked for
This is personal information about people who are not our users and who have not signed up with us. Because you decide what to search for and what to save, you are responsible for that information: our Terms of Use require you to have a lawful basis for collecting and using it, to honour requests from the people concerned, and not to use the Services to gather sensitive categories of personal information. We act on your instructions in respect of these records.
We keep lead records for as long as they remain in your project. Deleting the lead's shortlist entry removes it from that list; deleting the project or your account deletes the underlying records.
If you believe a Bootup Studios user holds information about you and you want it removed, email team@bootupstudios.ai. Tell us the details you want located and we will work with the account holder to action it.
6. Organizations and what administrators can see
If you joined through an organization — an employer, university, accelerator, or similar — that organization pays for your seat and its owners and administrators get a management console.
What administrators can see
- Your name, email address, profile picture, role, and when you joined
- When you last signed in
- How many AI credits you have used, and against what limits
- A list of the projects you own — their names, business type, when they were created, when they were last active, how many collaborators they have, and whether they have a business plan
Please read this carefully: the project list and usage figures cover your whole account, not only work you did for that organization. Projects you created before joining, or for unrelated purposes, appear in the same list.
What administrators cannot see
Administrators cannot read the contents of your projects, your business plans, or your AI conversations through the management console. They can see that a project exists and its name — not what is inside it. If you explicitly share a project with someone, they see what you shared.
Shared console access
An organization can be administered through a shared link and password rather than an individual account. Anyone holding both has the same powers as the organization's owner, including managing members and billing. Actions taken this way are recorded against the shared credential, so they cannot be attributed to a specific person.
Administrators can suspend or remove your seat. Doing so ends your access to the organization; it does not delete your account or the projects you own.
9. Text messaging
Text messaging is optional and opt-in. You can opt in either by linking and verifying your number in Settings, or by texting our number and completing the signup flow described on our SMS page.
What we store
- Your phone number, linked to your account
- A short verification code while you are confirming the number, which then expires
- A conversation session holding your recent messages, so the assistant can follow the thread. The session clears after 30 minutes of inactivity.
- Messages you exchange with our AI assistant, saved to your account so you can also read them on the web
- If you start the signup flow by text but do not finish it, the name, email, and number you gave, until you either finish or restart
Opting out
Reply STOP to any message, or disconnect your number in Settings. Either stops all messages and removes your number from your account.
One thing to know: when you reply STOP we keep a record of the number on a do-not-message list. We have to, because that record is what prevents us from ever texting the number again. It is used for nothing else.
10. Connected apps
You can connect third-party apps — email, calendar, documents, storage, CRM, social, commerce, and others — so our AI can work in them for you.
- Connections are made through an integration provider, which holds the access tokens. We do not store your third-party passwords.
- We access a connected app when you, or a task you have set up, direct us to.
- Results of those actions — including content read back from the app — may be stored in the conversation so you have a record of what happened.
- You can disconnect any app at any time from Settings, which revokes our access. You can also revoke access from the app's own security settings.
11. Payments
Payments are handled by a third-party payment processor. Your card details go directly to that processor and never reach our servers.
We store only what we need to run your subscription: a customer and subscription identifier, your plan, its status, and billing period dates. You can manage payment methods, view invoices, and cancel from the billing portal linked in Settings.
12. Security
We use reasonable administrative, technical, and organizational safeguards to protect personal information. These include:
- Encryption in transit using HTTPS/TLS, and encryption at rest by our cloud provider
- Strong encryption for particularly sensitive stored values
- Access controls that scope your data to you and to people you have shared with
- Verification of incoming payment and messaging webhooks so we act only on genuine requests
- Rate limiting on sensitive endpoints
- Restricted internal access, and a private channel for security researchers to report issues
A limited number of Bootup Studios staff can access account data where needed to operate the Services, investigate a problem you have reported, or respond to a security or legal matter. We hold no security certification and we do not claim one; if that changes we will say so here.
No system is perfectly secure. Use a strong, unique password, and tell us at security@bootupstudios.ai if you believe your account has been compromised or you have found a vulnerability.
13. How long we keep information
We keep your account information and content for as long as your account is open, so the Services keep working for you. When you delete your account we delete it, as described in Section 14.
Some things outlive the account, for specific reasons:
- Do-not-message records. Kept indefinitely, so a number that opted out is never messaged again.
- Security and audit records. Kept so we can investigate incidents. These identify an account by its internal ID.
- Billing and tax records. Kept by us and our payment processor as long as the law requires.
- Server logs. Kept for a limited period by our hosting provider and then discarded.
- Feedback you sent us. Kept, but stripped of your name and email so it can no longer be linked to you.
14. Your choices and controls
- Delete your account. Go to Settings → Account → Delete Account. This permanently deletes your projects, business plans, timelines, AI conversations, saved leads, and uploaded files, and cancels any paid subscription immediately. It cannot be undone. If you own an organization you will need to transfer or delete it first.
- Update your details. Change your name in Settings, and your password if you signed up with one.
- Delete individual content. Delete a conversation or a project at any time.
- Stop text messages. Reply STOP, or disconnect your number in Settings.
- Disconnect apps. Remove any integration from Settings to revoke our access.
- Get a copy of your information. Email team@bootupstudios.ai and we will provide a copy of the personal information we hold about you.
We respond to privacy requests within 45 days. We may need to verify your identity first, usually by confirming control of your account email.
15. U.S. state privacy rights
If you live in California — and, in substance, if you live in another U.S. state with a comprehensive privacy law — you have the right to know what personal information we collect and how we use it, to obtain a copy, to correct it, and to have it deleted. You have the right not to be discriminated against for exercising these rights.
We do not sell personal information and we do not share it for cross-context behavioural advertising. We do not use or disclose sensitive personal information beyond what is necessary to provide the Services.
In the last twelve months we have collected these categories of personal information:
- Identifiers — name, email address, phone number, account ID, IP address. Collected from you and automatically. Disclosed to service providers for business purposes.
- Commercial information — your plan, subscription status, and purchase records. Collected from you and from our payment processor.
- Internet and network activity — sign-in activity, feature usage, request logs, and the page and browser details attached to feedback.
- Audio, electronic, and visual information — profile picture, and files you upload including images, PDFs, and audio.
- Professional or business information — the business ideas, plans, and project content you create.
- Inferences — AI-generated content produced in response to your prompts, including relevance scores attached to leads you save.
We keep each category for the period described in Section 13. To exercise a right, use the controls in Section 14 or email team@bootupstudios.ai. You may use an authorized agent; we will ask for proof of their authority.
California residents may also request information under California Civil Code § 1798.83 about disclosures to third parties for their direct marketing purposes. We make no such disclosures.
16. Brazil (LGPD)
If you are in Brazil, the Lei Geral de Proteção de Dados gives you the right to confirm we process your data, to access it, to correct incomplete or outdated data, to request anonymization, blocking, or deletion of unnecessary data, to request portability, to obtain information about who we share it with, and to withdraw consent.
We process your data to perform our contract with you, to comply with legal obligations, and on the basis of our legitimate interests in operating and securing the Services. To exercise a right, use the controls in Section 14 or email team@bootupstudios.ai.
17. Children
The Services are for adults. You must be at least 18 to create an account, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, email team@bootupstudios.ai and we will delete it.
18. Where your information is processed
Bootup Studios operates from the United States, and our cloud hosting and database infrastructure is located in the United States. If you use the Services from elsewhere — including Latin America — your information is transferred to and processed in the United States, where privacy laws may differ from those where you live. By using the Services you understand that this transfer takes place.
Some of our service providers may process information in other countries in order to deliver their service.
19. Changes to this policy
We may update this policy. When we do, we will change the "Last updated" date above, and for material changes we will give you notice in the product or by email before they take effect. Continuing to use the Services after a change means you accept the updated policy.
20. Contact us
Questions about this policy, or want to exercise a privacy right? Email us and we will help.
Privacy and general enquiries: team@bootupstudios.ai
Security reports: security@bootupstudios.ai
Bootup Studios Inc.