Privacy policy

At SYB we protect your information like it's our own. This policy explains what data we collect, what we use it for, and what rights you have over it.

1. Data we collect

• Account: email, name, language, country of residence.
• Business plan: questionnaire answers, idea, industry, capital, financial projections, roadmap and anything you upload to the workspace (tasks, employees, customers, expenses, investments, debts).
• Your customers' data: if you use bookings, the sales log or the database, you will store third-party information (name, phone, email, appointments, purchases). That data is yours and theirs: we only store and process it to provide the service. See section 11.
• Product usage: copilot messages, generated reports, competition analyses, basic navigation events for diagnostics.
• Phone: if you install the app and accept notifications, we store a device identifier so we can deliver them. It is not your phone number.
• Payments: card data NEVER touches our servers. The payment processor you choose handles it, and it is PCI-DSS compliant.

2. Encryption

All sensitive information (answers, reports, workspace, copilot conversations, competition analyses) is encrypted at the application layer with AES-256-GCM before being written to the database. The master key never lives in the database — even if someone dumps it, the data is unreadable without the key.

3. What we use your data for

• To provide the service (generate reports, manage your workspace, respond with the copilot).
• To process your subscription and prevent fraud.
• To improve the product (aggregated, anonymized metrics; never individualized content).
• To send essential notifications (plan changes, payment failures, legal updates). Marketing only if you opt in.

4. Artificial intelligence

When you talk to the copilot, generate a report, or use any AI feature, that text leaves our servers and goes to the model provider. We use their commercial APIs, not the free consumer versions: they are different products and handle data differently.

We rotate providers based on cost and quality, and some operate outside Argentina, including China. Each applies its own data-usage terms, which we do not control. That is why we send the minimum a feature needs, and leave out personal data that isn't required.

If that doesn't work for your business, the AI features can simply go unused: the rest of SYB (bookings, sales, stock, finances, team) works without sending anything to any model.

5. Who we share with

These are the services involved. Some always act; others only if you turn on the matching feature.

• Always: hosting (Vercel, US), database (Supabase), transactional email (Resend), error monitoring (Sentry), and a rate-limiting service (Upstash) that sees IP addresses to stop abuse.
• AI providers: see section 4.
• If you enable phone notifications: Google Firebase, which delivers the alert to your device.
• If you enable WhatsApp booking confirmations:Meta receives your customer's phone number and the message text. That is the only way WhatsApp can deliver it.
• If you connect your ad account: Meta, to read your campaign metrics.
• If you pay for a plan: the gateway you choose.
• Authorities: only when compelled by a valid legal order.
• Never do we sell or rent your data.

6. Retention and deletion

While your account is active we keep your information. To have it deleted, email privacidad@startyourbusiness.app from your account address: we erase it in full within 30 days, except records the law requires us to retain (billing, tax).

Export anything you want to keep first — the Database section lets you download everything as Excel, CSV or PDF, and deletion cannot be undone. See the step by step.

7. Your rights

You have the right to access, correct, export or delete your data, and to object to specific processing. To exercise them, email us at privacidad@startyourbusiness.app. We respond within 30 calendar days at most.

SYB processes personal data under Argentina's Personal Data Protection Law 25,326. The Agency for Access to Public Information (AAIP), as the supervisory authority, handles complaints and claims for breaches of data-protection rules. Data subjects may exercise the right of access free of charge at intervals of no less than six months (sec. 14(3), Law 25,326).

8. International transfer

Nearly all of our infrastructure sits outside Argentina: the US and the EU for hosting, database and email, and China in the case of one of the AI providers. Using SYB means your data travels to those countries.

9. Changes

If we update this policy we notify you by email before applying substantive changes and update the date at the bottom of the document.

10. Contact

For any privacy question email privacidad@startyourbusiness.app.

11. Your customers' data

This part matters and is easy to miss. When you store customers, appointments or sales, you are holding data about other people, and towards them the responsible party is you, not SYB: we are the tool that stores it on your behalf and under your instructions.

Concretely, it is on you to:

• Have a legitimate reason to store that data, and tell your customers you do.
• Have their consent before sending them WhatsApp or email messages from SYB.
• Respond if one of them asks to see, correct or delete their data — you can do it from the Database, without asking us.

On our side: that data is encrypted just like yours, we never use it for anything other than providing the service, and it is deleted when you delete your account.