Last updated: 2026-10-11
StartWith, Trade Centre Rd, Dubai, United Arab Emirates, is the controller. For general support, contact support@startwith.xyz. For privacy requests, contact privacy@startwith.xyz. Our website is https://startwith.xyz.
This policy covers StartWith, a cloud-based service that helps founders and small teams create and coordinate marketing assets and campaigns. It includes AI-assisted generation, public publishing, analytics, collaboration, and an authenticated hosted MCP for ChatGPT and Codex. The service is available in the United Arab Emirates, European Economic Area, and United Kingdom.
Users retain ownership of their uploaded data and content. The service processes uploaded data only under the following limited permission: A limited permission to host, process, reproduce, and transmit user content only as needed to provide the service and the outputs requested by the user. Personal data is not sold, used for targeted advertising, or shared for unrelated purposes.
| Data category | Purpose | Lawful basis | | --- | --- | --- | | Account and profile information | Create accounts, authenticate users, manage workspace membership, and provide the service. | Performance of a contract | | Project, campaign, and user content | Store, generate, edit, localise, publish, and provide requested features. | Performance of a contract | | AI prompts, context, and generated outputs | Generate requested text and images, including compliance drafts, while preserving project attribution and safety controls. | Performance of a contract | | Billing and subscription information | Administer plans and credits, process payments through the configured billing provider, keep transaction records, and prevent payment abuse. | Performance of a contract and legal obligation | | Usage, device, and operational log data | Operate, secure, troubleshoot, measure, and improve the service and prevent fraud or abuse. | Legitimate interests | | Support communications | Respond to support, privacy, security, and account requests and maintain an appropriate request record. | Performance of a contract and legitimate interests | | Cookies and preference data | Maintain sessions and preferences and, where permitted, measure product and marketing performance. | Performance of a contract for essential cookies and consent for non-essential cookies | | Marketing preferences and communications | Send opted-in product or marketing communications and honour unsubscribe choices. | Consent or legitimate interests where permitted by law | | MCP OAuth connection and action data | Authenticate ChatGPT or Codex, enforce live workspace and project authority, bind action intents, prevent replay, and maintain bounded audit receipts. | Performance of a contract and legitimate interests | | Publicly published content and attribution | Render landing pages, blog posts, author profiles, legal documents, and other assets the user explicitly publishes. | Performance of a contract |
Users retain ownership of their content. StartWith has limited permission to host, process, reproduce, and transmit it only as needed to provide the service and the outputs users request. StartWith does not sell personal data, use personal data for advertising, or share it for unrelated purposes.
The authenticated StartWith MCP server at https://app.startwith.xyz/api/mcp lets users connect ChatGPT or Codex to authorised StartWith projects. After browser sign-in and OAuth consent, the host stores a revocable credential. StartWith checks current user and client identity, workspace membership, project authority, and the scope of each operation. There is no manual bearer-token fallback.
MCP operations can return bounded connection, project, strategy, content, asset, author, and compliance-document information. For an exactly requested asset or document, they can return its content. Other operations can prepare or save project-scoped drafts and settings, generate content, and prepare publication changes. Sensitive writes use exact versions, idempotency controls, and short-lived single-use action intents. MCP compliance generation can spend one credit but cannot publish a compliance document; publication and OpenAI submission are separate actions. Social provider actions, when enabled, require current-user confirmation for the exact prepared request.
StartWith stores project content and versions, usage records, and bounded action and diagnostic receipts to provide, secure, and audit the service. MCP diagnostics exclude raw OAuth credentials and secrets, full request bodies, tool arguments, document bodies, and unrelated customer data. OAuth expiry, revocation, or disconnecting the server in ChatGPT or Codex ends access. Disconnecting does not itself delete StartWith project data; deletion requests are described below.
StartWith uses Vercel for hosting and delivery; Convex for application data, backend functions, and file storage; Clerk for authentication, membership, OAuth, and billing administration; OpenAI for user-requested AI generation; and Postmark for email delivery. Sentry supports error and performance diagnostics and replay where configured; Axiom supports operational observability where configured; Hotjar and Google Analytics and Google Tag Manager support analytics or configured tags where enabled. Cloudflare Turnstile supports bot detection and abuse prevention. Meta and LinkedIn are social destinations only when a user connects a provider and explicitly approves an action.
Personal data may be transferred internationally. Where a safeguard is required, StartWith uses an applicable lawful mechanism, such as adequacy decisions, contractual protections including Standard Contractual Clauses, or another valid transfer mechanism.
StartWith uses administrative, technical, and organisational safeguards, including authenticated access, live role and project-ownership checks, least-privilege controls, encryption in transit, managed infrastructure controls, version and idempotency checks for writes, monitoring, and incident investigation. No system is guaranteed to be completely secure.
StartWith retains account, workspace, project, and generated content for the life of the account or project, and afterwards only as needed to complete deletion, comply with law, resolve disputes, enforce agreements, or protect the service. Billing and transaction records are retained as required by applicable obligations. Support and privacy request records are retained as needed to handle and document requests, resolve disputes, and comply with law. Security, usage, diagnostic, and MCP audit data are retained for the shortest period reasonably needed for security, abuse prevention, troubleshooting, audit integrity, and legal obligations. Backups remain until rotated out under managed backup and disaster-recovery cycles unless preservation is legally required. Marketing preferences remain until consent is withdrawn or the user opts out, with a limited suppression record retained to honour that choice.
Deletion requests are separate from these retention rules. Deletion may be limited by legal obligations, fraud or security needs, legal claims or agreement enforcement, residual encrypted backups awaiting rotation, or organisation-controlled data that the relevant workspace administrator must address.
Depending on applicable law, individuals may access and receive a copy of personal data; correct it; request deletion; restrict or object to certain processing; receive eligible data in a portable format; withdraw consent for future processing based on consent; opt out of marketing communications; and complain to the relevant data-protection authority.
For a deletion request, email privacy@startwith.xyz with the subject “Privacy Request (StartWith)” from an address associated with the account where possible. Requests are subject to verified authority and applicable exceptions. StartWith responds without undue delay and within the period required by applicable law; GDPR rights requests are generally answered within one month, subject to permitted extensions.
StartWith is intended for business users with legal capacity to enter into the service terms and is not directed to children. A parent or guardian who believes a child submitted personal data should contact privacy@startwith.xyz.
StartWith does not use automated decision-making.
For questions about this policy or StartWith’s privacy practices, contact privacy@startwith.xyz.
© 2026 StartWith