This policy explains how Emporium Tech, Inc., a Delaware corporation doing business as Starch ("Starch", "we", "us"), handles personal information on starch.ai (the "Site"). It is short because the Site does little: it describes what we build, lists our open roles, and lets you ask for a demo.
Starch deploys its software into each client's own environment, single-tenant or self-hosted, under a separate written agreement. The handling of a client's documents and firm data is governed by that agreement and its data processing addendum, not by this policy. The providers listed in section 4 serve this website; they are not the ones that run a client deployment, and nothing here grants Starch any right over a client's data.
| Where | What | Why |
|---|---|---|
| Demo request form | First and last name, work email address, firm, firm type, firm size, and optionally the desk you work on, how you heard about us, and anything you type in the free-text box. | To reply to you and prepare for the conversation. |
| Email to us | Whatever you choose to write, and your email address. | To answer you. |
| Job applications | Handled entirely by Reval, our applicant tracking system. We do not receive applications through this Site. | Governed by Reval's own privacy policy. |
We ask for a work email rather than a personal one. Please do not send us confidential firm material, client information, or anything you are not free to share, through the form or by email. It is not a secure channel and we have not signed anything covering it.
We use PostHog for website analytics. It records page views, the pages you arrive from and move between, approximate location derived from IP address, and browser and device characteristics. It sets a first-party cookie and a matching entry in local storage so repeat visits can be recognised as the same browser.
We also derive a one-way salted hash of the IP address that submits the demo form, and store that alongside the submission. It exists so we can rate-limit abuse and recognise a duplicate submission. It is not reversible to an address and we do not use it to identify anyone.
We do not run advertising pixels, and we do not sell or share personal information for cross-context behavioural advertising.
Not the demo requests, not the analytics, not anything you send us by email.
The Site runs on a small, fixed set of providers. Each processes personal information only on our instructions.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Vercel | Hosting and content delivery | Request metadata, including IP address, in server logs | United States |
| Neon | Database storing demo requests | Everything submitted through the form, plus the hashed IP | United States (us-east-1) |
| Resend | Delivering the notification email for a demo request | Name, work email, firm and the contents of the request | United States |
| PostHog | Website analytics | Usage events, IP address, device and browser characteristics | United States |
| Reval | Applicant tracking, for open roles | Whatever an applicant submits on Reval's own site | Per Reval's policy |
We will update this table before adding a sub-processor that handles personal information from the Site.
Beyond the sub-processors above, we disclose personal information only:
We do not sell personal information, and we have not done so in the preceding twelve months.
| What | How long |
|---|---|
| Demo requests | 24 months from submission, then deleted |
| Hashed IP on a demo request | 90 days, then cleared from the record |
| Analytics events | Per PostHog's retention, currently 12 months |
| Server logs | Per Vercel's retention, currently 30 days |
| Email correspondence | As long as the relationship is live, then per our records policy |
The first two are enforced by a scheduled job that runs daily against the database, not by anyone remembering to do it.
Traffic to the Site is encrypted in transit. The demo database is encrypted at rest and reachable only by the Site's server-side endpoint, using a credential held in our hosting provider's encrypted environment. Access to that credential is limited to the people who maintain the Site.
No system is perfectly secure. If a breach affects your personal information we will notify you and any regulator we are required to notify, without undue delay and within any deadline the applicable law sets.
Wherever you live, you can ask us to give you a copy of the personal information we hold about you, correct it, or delete it. Email hello@starch.ai and we will respond within 30 days. We will ask you to verify your identity, which for a demo request means replying from the address you used.
Our legal bases are: legitimate interests for responding to a demo request you initiated, for keeping the Site secure, and for aggregate analytics; and consent where the law requires it for analytics cookies. You may object to processing based on legitimate interests, withdraw consent at any time, request portability of what you gave us, and lodge a complaint with your supervisory authority. We have no EU establishment and no EU representative; contact us at the address above.
Under the CCPA as amended by the CPRA you may request the categories and specific pieces of personal information we have collected, request deletion or correction, and exercise these rights without being treated differently. In the last twelve months we collected the categories described in section 2: identifiers, professional or employment information, and internet activity. We disclosed them only to the sub-processors in section 4, for the business purposes in section 3. We do not sell or share personal information as those terms are defined by the CPRA, and we do not process sensitive personal information.
Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Utah and Texas, have comparable rights of access, correction, deletion and appeal. Use the same address; if we decline a request you may appeal by replying, and we will explain our reasoning.
Starch is incorporated in Delaware, operates from New York, and every sub-processor above stores data in the United States. If you contact us from outside the United States, your information will be transferred there. Where that transfer is from the EEA, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum, which are incorporated into our agreements with the providers concerned.
| Cookie | Purpose | Duration |
|---|---|---|
ph_* (PostHog) |
Recognises a returning browser so visits are not double-counted | 12 months |
That is the only cookie the Site sets. You can block it in your browser, or enable Global Privacy Control, which we honour as an opt-out signal. Blocking it does not affect the Site.
The Site is aimed at people working at financial institutions and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, write to us and we will delete it.
If we change this policy we will update the date above. For a change that materially reduces your rights or expands what we collect, we will give notice on the Site at least 30 days before it takes effect.
Emporium Tech, Inc., doing business as Starch · New York, NY
hello@starch.ai