Privacy Policy
Last updated: October 23, 2026
Who We Are and What This Policy Covers
Our legal entity is START ME UP AI LTD, company number 15330056, with registered office at 128 City Road, London, United Kingdom, EC1V 2NX.
START ME UP AI LTD (“we,” “us,” or “our”) operates www.startmeup.ai and byblosai.app, including the Byblos AI MCP server. This policy covers personal information processed through our corporate website, enquiries, marketing and business communications, consulting and software development engagements, support, and the products and services we operate that link to this policy. It includes Byblos AI’s agents, supported integrations, MCP connections and connected AI tools.
We determine how personal information is used for our own account administration, business communications, billing, security and support. Where a business customer determines the purposes of processing personal information in its workspace and we process it on that customer’s instructions, the customer acts as controller and we act as processor for that processing. Any applicable signed service or data-processing agreement governs that relationship. Contact us about the agreement applicable to your service.
This policy explains our practices; browsing our website or accepting our terms does not by itself give consent to every use of personal information. Where consent is required, it must relate to the particular processing.
Information We Process
The information involved depends on the service and features you use:
| Category | Information and source |
|---|---|
| Enquiries and service engagements | Details you provide through our contact form, email or discussions, including your name, email, company, message, project requirements and any website or professional-profile links you supply. Submitting the form sends you a confirmation email and an internal copy to our team. |
| Accounts and teams | Account identifiers, contact and profile details, authentication records, project membership, roles and invitations. |
| Workspace content | Project documents, conversations, requirements, Product Manager artifacts, brand information, campaign drafts, tasks and generated content you create or ask us to process. |
| Files and media | Uploaded files, images, audio, video, attachments, file names and metadata, and extracted text or transcripts when the selected feature processes them. |
| Connected accounts | Provider and account identifiers, permissions, authorization records and credentials, and the calendar, publishing or other information accessed through the connection you choose. |
| Calendar and communications | Meeting details, bookings, invitations, inbox messages and notification preferences associated with the features you use. |
| Support and feedback | Your messages, replies, screenshots and other attachments, reported page/component context and diagnostics associated with your report. |
| Billing and usage | Plan and subscription details, payment status, transaction references, credit balances and metered usage. Payment providers process payment credentials through their checkout. |
| Technical and security records | Network addresses, browser/request information, timestamps, connection and tool identifiers, access events, errors and activity counts used to operate and protect the services. |
Workspace information can also be supplied by other members of a project you belong to. Connected providers supply information within the permissions granted to the connection. Public website imports and research features retrieve information from the sources requested by the feature.
Purposes and Lawful Bases
For processing where we act as controller, the applicable basis depends on the purpose and our relationship with you:
| Purpose | Basis |
|---|---|
| Respond to a request for a service, provide an individual account or perform a service contract with you | Steps requested before a contract, or performance of that contract. |
| Administer business-customer accounts and communications with their representatives | Our legitimate interests in managing business relationships and delivering the agreed services. |
| Protect accounts, investigate misuse, diagnose failures and handle support or feedback | Our legitimate interests in secure, reliable services and resolving reported problems, subject to individuals’ rights. |
| Keep records required by tax, accounting or other applicable law | Compliance with legal obligations. |
| Send marketing communications | Consent where required; otherwise an applicable lawful basis and the conditions of electronic-marketing law. |
| Use optional tracking or share optional diagnostic content where consent is requested | Your consent for that specific activity. |
Required account or service information enables us to provide the requested feature; without it we may be unable to do so. Optional marketing and diagnostic choices are separate from essential service communications.
Byblos AI MCP and Connected AI Tools
You can connect a supported AI assistant, such as Claude or ChatGPT, to your Byblos AI workspace. The connection acts within your account access, project roles, granted permissions and applicable plan limits. For OAuth workspace connections, reading is included. The authorization screen lists the requested write permissions, already selected; untick any you do not want to grant before approving.
What Flows Through a Connection
When your assistant calls a tool, we receive the tool arguments and connection information. Arguments can include instructions, draft text, project content or excerpts from your conversation with the assistant. The MCP connection does not automatically send us your entire assistant conversation.
The assistant receives the workspace information returned by the tools it calls. Depending on your access and the requested tool, this can include project documents, files, brand and campaign content, tasks, calendar information, inbox messages, support, feedback, profile and usage information. The connected assistant processes the information it receives under its own terms, privacy policy and account settings.
Write permissions can allow creation or editing of Product Manager and brand documents, campaign drafts and settings, tasks, your profile, feedback and support requests, and expert-review requests using your allowance. Calendar permissions allow booking and RSVP actions, and requests for you to approve meeting changes. Granting a connection does not bypass role checks or make every action available.
Files, Attachments and Diagnostics
MCP tools can read permitted existing project files. A connection does not provide unrestricted file uploads or access to every file. Feedback attachments are stored with the report and follow its retention.
The workspace MCP operational call log contains metadata such as tool, user/connection identifiers, a masked credential prefix, time, outcome, duration and failure code. It does not store tool arguments or results. Unexpected server errors can be recorded in our server logs. When you report a problem through MCP, up to ten recent call-metadata entries from the preceding 30 minutes can be copied into the report and retained with it.
Separately, failed AI generations can produce limited, redacted diagnostic snapshots containing prompt/message excerpts and model output. These are retained for 14 days. Attaching a snapshot to a support case requires your choice on that report; the attached copy follows the support case’s retention. This is separate from the MCP call log.
Disconnecting
Revoke a workspace connection in Byblos AI → Account → Connected apps. Revocation prevents further authorized access through that grant. You can also remove the connection in the assistant. Disconnecting does not automatically erase content already saved in your workspace, approval/security history or copies already received by the assistant or another provider. Security records include a shortened network address: the first three parts of an IPv4 address or the first four groups of an IPv6 address. Contact us to exercise deletion rights; contact the other provider about copies it controls.
Who Receives Information
Information is shared as needed for the feature or engagement involved:
- Project participants: members with access to the relevant shared workspace and content.
- Processors: the hosting, AI, research, publishing, payment, email and analytics providers listed in Our Processors and Where They Process Data process the records, files, prompts and messages needed for their services.
- Connected assistants: the assistant you connect receives tool results as described above, including relevant workspace content.
- Calendar and social platforms you connect: connected calendar providers, including Google or Microsoft where selected, receive the meeting data needed for the action. LinkedIn, X, Meta, TikTok, YouTube and similar platforms receive publishing content when you connect those accounts, whether directly or through Upload-Post, and handle it under their own privacy notices as independent controllers.
- Staff and service advisers: authorized people supporting the service, handling an engagement, resolving issues or meeting legal/accounting obligations receive relevant information.
- Authorities or parties to a legal claim: information may be disclosed where legally required or necessary to establish, exercise or defend legal rights.
Authorized staff may use restricted AI-assisted administration tools to investigate support and feedback, including supplied attachments. Member identities are pseudonymized in those tools. Unredacted content is revealed only for a stated purpose; every reveal is logged, and access logs are kept for 12 months. Selected report information can be sent to the assistant or model provider used for that investigation. This is distinct from a customer’s workspace connection.
Our Processors and Where They Process Data
These providers process personal information for us. Where a business customer is the controller of its workspace content, they act as our sub-processors for that content. We list each provider’s role, what it receives and where it processes data. The safeguards named are those in the provider’s published or accepted data-processing terms. Providers that members connect to their own accounts are listed separately above, because they act as independent controllers.
| Processor | What it does and what it receives | Where it processes data | Safeguard for transfers outside the UK |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosts the Byblos AI application and the backend behind our website forms and email. Receives the data the application handles, in encrypted form. | Main production in AWS Ireland (eu-west-1). Other regions we use are in London, Frankfurt and Paris. Any region we add stays within the UK or EEA. | Data stays in the UK and EEA; AWS data-processing terms apply. |
| MongoDB Atlas | Database service for accounts, workspaces, projects, messages, tasks and records. | Atlas clusters in the same UK and EU regions, with backups held in the UK or EU. | Data and backups stay in the UK and EEA; MongoDB data-processing terms apply. |
| Cloudflare | Delivers and protects this website and runs its contact-form function; stores Byblos AI files and media in R2 object storage. Receives request data such as network addresses, and the form fields and files you submit. | Cloudflare’s global network handles requests at a nearby location. R2 files are stored with a Western Europe location hint. Cloudflare treats a location hint as a preference, not a guarantee, so files can be held elsewhere. | Cloudflare’s data-processing terms. |
| OpenAI | Text, image generation, transcription, speech and voice features. Receives prompts, selected context and media for the requested action, and admin investigation of support reports. | OpenAI OpCo, LLC in the United States and the locations on OpenAI’s sub-processor list. | Standard Contractual Clauses with the UK Addendum. |
| Anthropic | Text features, including Claude models. Receives prompts and selected context for the requested action. | The United States and the locations of Anthropic’s sub-processors. | Standard Contractual Clauses with the UK Addendum, under Anthropic’s data-processing addendum. |
| Perplexity | Web research for market analysis and news. Receives search queries built from the idea, market, competitor and geography context you provide. | Perplexity and its sub-processors, including in the United States, as listed on its trust centre. | Standard Contractual Clauses with the UK Addendum. |
| Upload-Post | Social publishing intermediary. Receives post copy, images, video and documents, schedules, and the OAuth tokens for the social accounts you connect. | Germany for its application, databases and backups; EU-restricted media storage; EU backups. Its optional AI features can use providers in the United States. | Standard Contractual Clauses with the UK International Data Transfer Agreement. |
| Revolut | Processes Byblos AI checkout and renewal payments. We receive billing status and transaction references. | Revolut group companies and the partners behind each payment method, as set out in Revolut’s privacy notice for your account. | Revolut’s terms and privacy notice. |
| Stripe | Processes payments and payouts for the Byblos AI Experts marketplace through Stripe Connect, once that marketplace is offered. Byblos AI checkout and renewals use Revolut. Stripe is a processor for payments and an independent controller for its own legal duties. | Stripe Payments Europe and Stripe, LLC (United States), and their sub-processors. | EU-U.S. Data Privacy Framework with the UK Extension, with Standard Contractual Clauses and the UK Addendum. |
| Microsoft 365 (Exchange Online) | Sends our email: enquiry confirmations, account invitations, verification, notifications, newsletters and data-request links. Receives recipients, names and message content, and holds our business mailboxes. | Our Microsoft 365 tenant data is located in the United Kingdom. Microsoft can process some data elsewhere, for example for support and through its sub-processors. | Standard Contractual Clauses and the EU-U.S. Data Privacy Framework with the UK Extension. |
| Google (Analytics), only if you opt in | Measures website use if you accept analytics. Receives page addresses, referrers, browser and device information and visit events. See Cookies and Browser Storage. | Google data centres, which can be outside the UK and EEA. | Google’s data-processing terms. |
Provider data use, model-training practices and retention depend on each service, contract and account setting. This policy makes no blanket no-training or zero-retention promise across providers. Additional providers for features that are not yet generally available will be listed before those features are offered. Contact us for the current list of a provider’s sub-processors or to ask how a provider handles your information.
International Processing
Our company is based in the United Kingdom. Our application and database hosting is in UK and EEA regions, as shown in the table above. Providers and connected services may process information in other countries; the table shows where, provider by provider. Where a restricted transfer requires safeguards, these must be established for that transfer, for example an applicable adequacy decision, the UK Addendum to the Standard Contractual Clauses, the UK International Data Transfer Agreement or the Data Privacy Framework with its UK Extension. Contact us for information about the recipients, locations and safeguards relevant to your service.
Retention and Deletion
Different records have different purposes and retention rules. Credential expiry ends authorization; it does not delete workspace content. The following periods describe the configured schedules for these records; automatic cleanup is asynchronous.
| Record | Retention period or rule |
|---|---|
| Workspace MCP call metadata | 30 days from the call. Copies included in feedback follow that report’s retention. |
| Hourly activity counts | 180 days from the activity bucket. A per-feature activity summary, including your name and email, is kept while your account exists and is deleted with it. This does not define retention for separate billing records. |
| Workspace OAuth credentials | Access tokens are valid for one hour; refresh tokens for 30 days, renewed on rotation. Hashed expired and revoked token records are removed seven days after the token’s original expiry. |
| Connection approvals and security history | Approval records remain marked revoked after disconnection. Security audit records include a shortened network address and do not currently have automatic time-based expiry. After account deletion, these records are kept with your identifier removed. They are separate from the short-lived operational call log. |
| Feedback and its attachments | Resolved, dismissed or cancelled reports are eligible for deletion 365 days after their last update; active reports remain. If you delete your account, your reports are kept without your identity, and their attachments are deleted. Attachment deletion failures are retried before the report is removed. |
| Notifications | 365 days from creation. |
| Closed support cases | 24 months after resolution, with associated messages and attachments. A diagnostic snapshot copied to a case follows this rule. |
| AI failure diagnostic snapshots | 14 days from creation, except a copy you choose to attach to support. |
Deleting your account immediately removes the account record and associated profile data. Content in shared projects, files and media, some chat content, and billing records may remain and can be removed on request, subject to legal retention. Enquiries and service-engagement records are retained according to the continuing engagement, follow-up needs and applicable legal or dispute requirements. Backup and provider-held copies have separate deletion cycles; deleting a live record does not establish immediate erasure of every copy.
Contact us for the retention information applicable to your records or to request erasure. Where information must be retained, the applicable purpose and legal requirements affect what can be removed.
Marketing Communications
We maintain an outreach list for account contacts, people who request product updates or launch information, and business contacts added with a recorded reason. Byblos AI account holders receive product-update emails unless they opt out at signup or in their account settings. An account or an entry on this list does not itself establish consent to marketing. Email marketing must meet the applicable consent or other permitted-contact conditions.
Marketing emails include an unsubscribe link. Account holders can also change product-update email preferences in their account. You may object to direct marketing by contacting us; essential service and security messages are separate.
For contacts without an account, the outreach system sets expiry 12 months after the last recorded interaction or contact update. Email delivery records have a 12-month retention period; sequence enrolments expire 30 days after they end. A suppression fingerprint can remain to prevent an automated import from re-adding an erased address; a new signup can establish a new relationship.
Cookies and Browser Storage
The corporate website stores a theme preference in local storage and uses a service-worker page cache in the browser. Cloudflare can set security and bot-detection cookies and scripts on www.startmeup.ai, and network error reporting may send technical error information. Byblos AI uses cookies and browser storage for authentication, workflow state and optional preferences. Its consent banner offers Necessary and Preferences categories; no analytics or advertising cookies are active. See the Byblos AI Cookie Policy. Browser settings also let you manage stored information, although blocking storage can affect functionality.
If you accept Google Analytics on the corporate website, Google receives page addresses and referrers, browser and device information, and visit events to help us understand website use. Its tag can set first-party _ga cookies for visitor and session measurement. Rejecting the choice keeps the tag from loading; changing your choice to reject stops further collection from that browser. Information already sent is not erased by changing the choice.
Analytics and consent settings can differ between the corporate website and the app. When Google Analytics is configured on the corporate website, we offer an Accept analytics or Reject analytics choice before its tag loads. You can change that choice through Analytics settings in the footer of the main website pages. This does not cover server/network logs or analytics inside connected products; website use is not blanket permission for tracking.
YouTube Videos
Some product pages include a standard YouTube player using Google’s privacy-enhanced embed domain. The player loads directly when it approaches the visible part of the page, without a separate media permission prompt. Loading it connects to Google, which receives technical information such as your IP address, browser information and this website’s origin, and may use cookies or browser storage. The player is independent of our optional Google Analytics setting. See Google’s Privacy Policy. You can pause playback using YouTube’s controls or leave the page to close the player. The Watch on YouTube link opens YouTube directly.
Your Rights and Choices
Depending on the applicable law and processing, you can request access, correction, erasure, restriction or portability of personal information, and object to processing. You can object to direct marketing at any time. Where we rely on consent, you can withdraw it without affecting processing that was lawful before withdrawal.
Email contact@startmeup.ai to exercise your rights. We may need to verify your identity and clarify the request. For information controlled by your business customer, we may need to refer the request to that controller or assist it in responding. Rights can be subject to legal conditions and exceptions.
In Byblos AI account settings, Delete My Account removes the account immediately and cannot be undone. Some content may remain as described above. Export My Data starts a request that we review before issuing an email link. The Services are intended for users aged at least 18.
You can complain to the UK Information Commissioner’s Office or the competent supervisory authority where you live or work. This policy does not limit statutory privacy rights or available remedies.
Changes and Contact
We update this notice when practices change and identify the revision date above. Where required, material changes receive additional notice.
For privacy questions and requests, contact our privacy contact, Nicolas Hawat, at contact@startmeup.ai, or write to:
START ME UP AI LTD
128 City Road, London, United Kingdom, EC1V 2NX
For Byblos AI product support, use support@startmeup.ai. Privacy questions and rights requests should use the privacy contact above.