Legal
Privacy Policy
How Startup Thinking School collects, uses, protects, and shares personal data in Bangladesh-focused founder, mentor, partner, and platform workflows.
Last updated: August 10, 2026
This policy applies to Startup Thinking School (“STS”, “we”, “us”). We operate as a school and platform scaffold for founders in Bangladesh. We use data to run applications, readiness workflows, events, mentor loops, partner communications, ecosystem research, and platform services.
Our privacy approach is designed around Bangladesh's applicable ICT and cyber safety laws and the principles reflected in Bangladesh's personal data protection and national data governance policy work. Where those frameworks are updated or brought into force, we intend to adapt our practices accordingly. This policy is not legal advice.
Data we collect
- Identity and contact details submitted through application, event, mentor, partner, or inquiry forms.
- Startup profile information such as stage, sector, location, founder needs, pitch-readiness data, and mentor-loop notes.
- Community and communications data, including event registrations, feedback, support requests, preferences, and correspondence.
- Technical data such as device, browser, approximate location, log data, security events, cookies, and analytics signals.
Why we use data
- To review startup applications and manage founder participation.
- To provide pitch-readiness, tool, event, and mentor-loop services.
- To communicate with founders, mentors, partners, investors, and enablers.
- To improve STS content, tools, security, operations, and ecosystem learning.
- To prevent abuse, protect platform integrity, and comply with lawful requests.
Legal bases and consent
We process personal data when you consent, when it is necessary to provide requested services, when we have a legitimate operational or safety interest, when we need to comply with law, or when processing is needed for research and ecosystem reporting in a responsible, aggregated, or de-identified way. Optional marketing and non-essential cookies should rely on consent where required.
AI-assisted tools and mentor loops
STS tools may provide an AI-assisted or rules-based first pass. These outputs are for founder guidance and should not be treated as investment, legal, tax, accounting, or regulatory advice. We do not intend to make consequential automated decisions about founders without meaningful human review.
Sharing and partners
We may share data with trusted partners, mentors, service providers, event operators, cloud or software vendors, analytics providers, professional advisers, or authorities when necessary. We share only what is reasonably needed and expect recipients to protect data, use it for the agreed purpose, and respect confidentiality. We do not sell personal data.
Analytics
We use PostHog (PostHog Inc.), hosted in the European Union, to understand how the website and founder tools are used. Analytics only run with your consent, and you can change or withdraw that consent at any time from the Cookie settings link in the footer.
What we deliberately do not do matters as much as what we do: we never send your name, email address, phone number, or the contents of anything you type — applications, problem descriptions, blog drafts, and calculator figures stay in our own database on our own infrastructure. Where we need to know how long an answer was or how large a file was, we record a size range rather than the value itself. If our analytics need to recognise a returning visitor, they use a random identifier that means nothing outside our system, never your email address. Session recordings mask everything typed into a form, and the admin panel is never recorded at all.
Cross-border processing
Some tools, cloud services, analytics, communications, or partner workflows may process data outside Bangladesh — our analytics provider processes data in the European Union. When this happens, we aim to use reasonable contractual, technical, and organisational safeguards appropriate to the data and risk.
Security
We use proportionate safeguards such as access controls, least-privilege practices, secure configuration, audit trails where available, backups, and incident response procedures. No online service is perfectly secure, so users should avoid submitting unnecessary sensitive personal data or confidential trade secrets unless requested for a specific STS workflow.
Your rights and choices
- Ask what personal data we hold about you.
- Ask us to correct incomplete or inaccurate data.
- Ask us to delete data when we no longer need it, subject to lawful retention needs.
- Withdraw consent for optional communications or non-essential processing.
- Object to or restrict processing where appropriate.
- Ask for human review of significant automated or AI-assisted outputs where such features are used.
Retention
- Application and startup profile data: kept while your STS relationship is active and for a reasonable period afterward for audit, learning, and program continuity.
- Mentor-loop and pitch-readiness records: kept as long as needed to support founder guidance, showcase readiness, and legitimate ecosystem reporting.
- Legal, security, and abuse-prevention records: kept as needed to comply with applicable law and protect STS, founders, partners, and users.
- Cookie and analytics data: kept for the shortest practical period consistent with measurement, security, and improvement needs.
Children and young users
STS works with young founders and students, but our platform is not intended to collect data from children without appropriate consent and safeguards. If we learn that a child has provided personal data without appropriate permission, we will take reasonable steps to delete or limit that data.
Contact
To exercise privacy choices or ask questions, contact STS through the official contact channel published on this website or in direct STS communications. We may need to verify your identity before acting on a request.