Legal
Privacy Policy
How Startup Thinking School collects, uses, protects, and shares personal data in Bangladesh-focused founder, mentor, partner, and platform workflows.
Last updated: September 1, 2026
This policy applies to Startup Thinking School (“STS”, “we”, “us”). We operate as a school and platform scaffold for founders in Bangladesh. We use data to run applications, readiness workflows, events, mentor loops, partner communications, ecosystem research, and platform services.
Our privacy approach is designed around Bangladesh's applicable ICT and cyber safety laws and the principles reflected in Bangladesh's personal data protection and national data governance policy work. Where those frameworks are updated or brought into force, we intend to adapt our practices accordingly. This policy is not legal advice.
Data we collect
- Account data, including your email address, one-way hashed password credentials, email verification status, and sign-in security records.
- Profile data such as your name, photo, biography, residence, nationality, location, ecosystem roles, organization, education, tags, expertise, sectors, interests, and ways you can help.
- OAuth data received from Facebook, GitHub, or LinkedIn, such as provider account ID, name, verified email when available, profile photo, and public profile details you authorize the provider to share.
- Identity and contact details submitted through application, event, mentor, partner, or inquiry forms.
- Startup profile information such as stage, sector, location, founder needs, pitch-readiness data, and mentor-loop notes.
- Startup organization data such as venture identity, problem, product, team invitations, traction, capital, relationships, visibility choices, and optional private pitch links.
- Community content such as posts, reaction explanations, comments, Startup Stories, resource contributions, BlogBooks, and the authorship attached to them.
- Community and communications data, including event registrations, feedback, support requests, preferences, and correspondence.
- Technical data such as device, browser, approximate location, log data, security events, cookies, and analytics signals.
Why we use data
- To review startup applications and manage founder participation.
- To maintain your member profile, authenticate you, help members discover and contact one another, and operate follows, connections, posts, comments, startup organizations, Startup Stories, BlogBooks, and STS Resources.
- To reuse verified profile details in STS forms so you do not have to enter the same identity information repeatedly.
- To provide pitch-readiness, tool, event, and mentor-loop services.
- To communicate with founders, mentors, partners, investors, and enablers.
- To improve STS content, tools, security, operations, and ecosystem learning.
- To prevent abuse, protect platform integrity, and comply with lawful requests.
Legal bases and consent
We process personal data when you consent, when it is necessary to provide requested services, when we have a legitimate operational or safety interest, when we need to comply with law, or when processing is needed for research and ecosystem reporting in a responsible, aggregated, or de-identified way. Optional marketing and non-essential cookies should rely on consent where required.
AI-assisted tools and mentor loops
STS tools may provide an AI-assisted or rules-based first pass. These outputs are for founder guidance and should not be treated as investment, legal, tax, accounting, or regulatory advice. We do not intend to make consequential automated decisions about founders without meaningful human review.
Profiles, visibility, and form reuse
You control whether your profile is public, visible to signed-in STS members, or private. A public profile is listed in the member directory, and visitors who are not signed in see your name, photo, role, and short bio, so someone searching for you can tell you are part of STS; the rest of the profile, including every contact field, is shown only to signed-in members. A profile set to STS members only is neither listed nor shown to signed-out visitors at all, and a private profile is not shown to anyone but you. Contact fields such as email, phone, WhatsApp, social links, website, and CV each have their own Public, STS Members Only, or Private setting. When a verified member submits an STS application, board item, resource, blog post, or connected note, STS uses the current profile as the authoritative source for repeated identity fields. The submission still stores a snapshot for operational records, and content-specific answers remain separate from the profile.
Startup organizations and team invitations
A startup profile is separate from a person's STS Profile. Its owner controls whether it is public, visible only to STS members, or private. Adding another person sends that member an invitation; their name and role do not appear as an accepted team member until they approve it. Optional pitch links and other fields marked private are used only for the requested workflow. STS may send a small, capped number of completion reminders to the verified email of an incomplete startup profile's owner; those reminders stop automatically and can be stopped sooner by replying.
Authentication and connected accounts
You can sign in with an email and password or, when enabled, through Facebook, GitHub, or LinkedIn. OAuth providers handle their own authentication and apply their own terms and privacy policies. STS stores the provider account identifier needed to link your account, but does not retain provider access tokens after sign-in. Passwords are stored using one-way Argon2id hashing; one-time verification codes and browser session tokens are also stored only in hashed form.
Sharing and partners
We may share data with trusted partners, mentors, service providers, event operators, cloud or software vendors, analytics providers, professional advisers, or authorities when necessary. We share only what is reasonably needed and expect recipients to protect data, use it for the agreed purpose, and respect confidentiality. We do not sell personal data.
Analytics
We use PostHog (PostHog Inc.), hosted in the European Union, to understand how the website and founder tools are used. Analytics only run with your consent, and you can change or withdraw that consent at any time from the Cookie settings link in the footer.
What we deliberately do not do matters as much as what we do: we never send your name, email address, phone number, or the contents of anything you type — applications, problem descriptions, blog drafts, and calculator figures stay in our own database on our own infrastructure. Where we need to know how long an answer was or how large a file was, we record a size range rather than the value itself. If our analytics need to recognise a returning visitor, they use a random identifier that means nothing outside our system, never your email address. Session recordings mask everything typed into a form, and the admin panel is never recorded at all.
Cross-border processing
Some tools, cloud services, analytics, communications, or partner workflows may process data outside Bangladesh — our analytics provider processes data in the European Union. When this happens, we aim to use reasonable contractual, technical, and organisational safeguards appropriate to the data and risk.
Security
We use proportionate safeguards such as access controls, least-privilege practices, secure configuration, encrypted transport, one-way credential hashing, expiring HttpOnly sessions, login throttling, private CV storage, audit trails where available, backups, and incident response procedures. No online service is perfectly secure, so users should avoid submitting unnecessary sensitive personal data or confidential trade secrets unless requested for a specific STS workflow.
Your rights and choices
- Ask what personal data we hold about you.
- Ask us to correct incomplete or inaccurate data.
- Ask us to delete data when we no longer need it, subject to lawful retention needs.
- Withdraw consent for optional communications or non-essential processing.
- Object to or restrict processing where appropriate.
- Ask for human review of significant automated or AI-assisted outputs where such features are used.
Retention
- Account, profile, connection, follow, post, and reaction data: kept while your account is active and for a reasonable period afterward for recovery, safety, and legal needs.
- Application and startup profile data: kept while your STS relationship is active and for a reasonable period afterward for audit, learning, and program continuity.
- Mentor-loop and pitch-readiness records: kept as long as needed to support founder guidance, showcase readiness, and legitimate ecosystem reporting.
- Legal, security, and abuse-prevention records: kept as needed to comply with applicable law and protect STS, founders, partners, and users.
- Cookie and analytics data: kept for the shortest practical period consistent with measurement, security, and improvement needs.
Children and young users
STS works with young founders and students, but our platform is not intended to collect data from children without appropriate consent and safeguards. If we learn that a child has provided personal data without appropriate permission, we will take reasonable steps to delete or limit that data.
Deleting your account and data
To delete your STS account, email info@startupthinkingschool.com from the address on the account with the subject “Delete my account”. We verify the request, then remove your profile, photo, CV, posts, connections, and any connected Facebook, LinkedIn, or GitHub sign-in link within 30 days. Content you posted to a public board stays only where we are required to keep it, and is otherwise removed with the account. Ask instead for a single connected account to be disconnected and we sever only that link.
Contact
To exercise privacy choices or ask questions, contact STS through the official contact channel published on this website or in direct STS communications. We may need to verify your identity before acting on a request.