Privacy policy

Version 1.1 · 31 July 2026 · Plain language, full coverage.

1. Who is responsible

Coldstart, based in Schiedam, the Netherlands (KvK 42125737), is the controller for the processing described here, except where we act as processor for our customers (see section 5). Contact for anything privacy-related: info@getcoldstart.nl.

2. Visitors of this website

We measure how the site is used with Umami, a cookieless analytics tool we host ourselves on our own EU server. It counts page views and button clicks in aggregate; it sets no cookies, stores no IP addresses, builds no profiles, and shares nothing with third parties — which is why you don't see a cookie banner here. The only cookies this site uses are the strictly necessary ones that keep customers signed in to their portal (session and anti-forgery).

3. When you request sample leads

The sample-leads form asks for your name, email, company, and what you sell — with an explicit consent checkbox. We use these details only to run the engine for your niche and send you the samples, and we record when you gave consent. You can withdraw at any time via info@getcoldstart.nl; we then delete your inquiry. Legal basis: your consent (art. 6(1)(a) GDPR).

4. When you contact us

Messages through the contact page (name, email, message) go straight to our mailbox and are used only to answer you. Legal basis: our legitimate interest in responding, or steps prior to a contract (art. 6(1)(b)/(f)).

5. Customers and the leads we find for them

Account data — your email, company profile, notification settings, and sign-in cookies. Legal basis: performing our contract (art. 6(1)(b)). Payment details are handled by Stripe; we never see card numbers.

Lead data — the engine reads publicly available business information (job postings, funding news, company announcements) and may thereby process business contact data of people at the companies it identifies. When it does this for a customer's account we act as that customer's processor under art. 28 GDPR (our verwerkersovereenkomst is public; a countersigned copy is available on request); for our own outreach we are the controller, with legitimate interest in business-to-business prospecting (art. 6(1)(f)) as the basis. We only use public sources, never guess or fabricate email addresses, and honour objections immediately: one email to info@getcoldstart.nl and a company or person is excluded from future processing.

No automated decisions with legal effect: the engine suggests and drafts; a human reviews and decides on every email that is sent.

6. Who helps us process (sub-processors)

We keep the chain short and European where possible: Hetzner (hosting and backups, Germany), Resend (transactional email, EU region), Stripe (payments), Google Gemini API (analyzes the text of public posts to qualify leads and draft emails — it receives the public content and your outreach profile, not your account data), Twilio (WhatsApp notifications, only when enabled), and Adzuna (we send search keywords, never personal data). We don't sell data, and we don't use it for advertising.

7. How long we keep things

Inquiries: until handled, at most 12 months. Account and lead data: for the duration of your subscription, deleted within 60 days after it ends (export available up to 30 days after the end, on request). Backups rotate out after 14 days. Consent records: as long as the law requires us to be able to demonstrate them.

8. Security

Data lives on EU servers, everything is TLS-encrypted in transit, access is limited to the founder, accounts are protected with rate-limited sign-in and modern password rules, and tenants are isolated at the database level. No system is perfect; if a breach ever affects your data we will inform you and the Autoriteit Persoonsgegevens as the law requires.

9. Your rights

You can ask for access to, correction of, deletion of, restriction of, or a copy (portability) of your data, and you can object to processing based on legitimate interest — all via info@getcoldstart.nl, answered within one month. You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

10. Changes

When this policy changes materially we announce it to customers by email at least 30 days ahead; the version and date at the top always tell you what you're reading.