Privacy Policy

1. About this policy

This Privacy Policy describes how we handle your personal information when you use Startup Compass, a web application available at startupcompass.tech. It explains what we collect, why we collect it, who we share it with, where it is stored, how long we keep it, and the rights you have over it.

This policy applies whenever you interact with Startup Compass, including when you create an account, sign in, complete the commercial readiness assessment, view or save opportunities in the Index, use the Sessions or Toolkit features, or receive communications from us.

2. Who we are and how to contact us

Startup Compass is operated by Hieland Road Pty Ltd (ABN 50 665 485 941) trading as The Product Bus. References in this policy to "we", "us" and "our" mean Hieland Road Pty Ltd trading as The Product Bus.

If you have any questions about this policy, or about how we handle your personal information, you can contact us at hello@theproductbus.com. Privacy-specific enquiries are handled by our team and may be escalated to a privacy officer where appropriate.

3. The personal information we collect

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether it is recorded in a material form or not. The personal information we collect about you depends on how you use Startup Compass.

3.1 Account information

When you create a Startup Compass account, we collect:

• your email address;
• your name;
• a password (if you choose email and password sign-up), which we do not store in readable form;
• your profile picture URL, if you sign in or link your account with Google.

3.2 Founder profile information

As you use Startup Compass, you provide additional information about yourself and your venture through the commercial readiness assessment and progressive profile capture. This includes:

• the stage your venture is at;
• your fundraising priority;
• your business model;
• your location (country and state level, not street address);
• other founder profile fields you complete from time to time.

You can review and update most of this information from your account settings.

3.3 Activity information

We collect information about how you use Startup Compass, including sign-in history, the date and time you complete or update your assessment, and the opportunities you view or save in the Index. We use this information to operate the platform and to personalise what we surface to you.

3.4 Communications

If you contact us, or if we send you transactional or platform communications, we keep a record of those exchanges and any information you choose to provide in them.

3.5 Technical information

When you visit startupcompass.tech we automatically collect certain technical information, including your IP address, browser type and version, device type, operating system, and the pages you visit on the site. This information is collected through cookies and similar technologies, described further below.

3.6 What we do not collect

Startup Compass is not designed to collect sensitive information as defined in the Privacy Act 1988 (Cth), such as health information, racial or ethnic origin, political opinions, religious beliefs, or financial account details. Please do not submit sensitive information through the platform.

4. How we collect personal information

We collect personal information in the following ways:

• Directly from you, when you create an account, complete the assessment, update your profile, save opportunities, or communicate with us.
• From Google, when you choose to sign up or sign in using Google Sign-In, or when you link your existing account with Google. The information we receive from Google is described in section 6.
• Automatically, as you use the platform, through cookies and analytics tools described in section 12.

5. Why we collect personal information and how we use it

We collect, hold and use your personal information for the following purposes:

• to create and operate your account, including authenticating you when you sign in;
• to deliver the features of Startup Compass, including the commercial readiness assessment, the Index, opportunity matching, the Sessions feature, and the Toolkit;
• to personalise what we show you based on the profile information you provide;
• to communicate with you about your account, the platform, and changes to our services;
• to provide customer support and respond to your enquiries;
• to improve the platform, using aggregated information that does not identify you personally;
• to detect and prevent misuse, fraud, or breaches of our Terms of Service;
• to comply with our legal obligations.

We do not use your personal information for advertising or marketing by third parties, and we do not sell your personal information.

6. Sign-in via Google

You can create or access your Startup Compass account using Google Sign-In. When you choose to sign in with Google, we receive the following information from your Google account:

• your email address;
• your full name;
• your profile picture URL.

We use this information to create your account, identify you when you sign in, and personalise your account experience. We do not access any other information from your Google account.

You can review the data Google shares with third-party applications in your Google Account permissions and learn more about how Google handles your data in the Google Privacy Policy and the Google API Services User Data Policy.

6.1 Duplicate account prevention

If you attempt to sign up with Google using an email address that is already registered to a Startup Compass account, we will not create a new account. You will be directed to sign in using your existing method. This prevents duplicate accounts and protects your data.

6.2 Linking and unlinking Google

If you already have a Startup Compass account, you can choose to link Google as an additional sign-in method from your account settings. Linking Google enables you to sign in using Google but does not change your existing account information or transfer account ownership. You can unlink Google at any time from the same settings page.

7. How we share personal information with third parties

We share personal information only with the service providers we rely on to operate Startup Compass, and only to the extent necessary to provide those services. We do not sell personal information, and we do not share it with third parties for their own marketing purposes.

The categories of third parties we share personal information with are:

• Lovable. Platform builder. Lovable supports the development and operation of the Startup Compass application.
• Supabase. Backend infrastructure provider, including database and authentication services. Supabase stores your account and profile data.
• Netlify. Application hosting provider. Netlify hosts the Startup Compass web application.
• Resend. Transactional email provider. Resend delivers account-related and platform emails to you.
• Google. When you choose to sign in or link your account with Google, Google processes the authentication information described in section 6.

Each of these providers handles personal information only for the purpose of providing the relevant service to us. We take reasonable steps to ensure they handle your personal information consistently with this policy and the Australian Privacy Principles.

We may also disclose personal information where required or authorised by law, or where necessary to protect our rights or the safety of others.

8. Overseas disclosure

Some of the service providers we use are located outside Australia, or process or store personal information on infrastructure located outside Australia. By using Startup Compass, you acknowledge that your personal information may be disclosed to recipients in the following jurisdictions:

• Supabase. United States.
• Netlify. United States.
• Resend. United States.
• Google. United States and other jurisdictions in which Google operates infrastructure.
• Lovable. Sweden and the European Union.

Where we disclose personal information overseas, we take reasonable steps to ensure that the overseas recipient handles your personal information consistently with the Australian Privacy Principles. This includes selecting service providers that publish privacy and security commitments appropriate to the data they handle.

9. How we store and protect personal information

Your personal information is stored on infrastructure provided by Supabase and Netlify, located in the United States. We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification and disclosure. These steps include access controls, encryption of data in transit, and reliance on the security controls maintained by our infrastructure providers.

No method of transmission over the internet or method of electronic storage is completely secure. While we take reasonable steps to protect your personal information, we cannot guarantee absolute security.

10. How long we keep personal information

We keep your personal information for as long as your Startup Compass account remains active, and for as long as reasonably necessary to provide the services to you, comply with our legal obligations, resolve disputes, and enforce our agreements.

If you unlink Google from your account, the email, name, and profile picture obtained from Google will remain associated with your account unless you also update or delete that information. If you delete your Startup Compass account, your personal information is deleted in accordance with our standard account deletion process, subject to any legal retention obligations and backup retention cycles.

11. Your rights: access, correction and deletion

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you;
• Correct personal information that is inaccurate, out of date, incomplete, irrelevant or misleading;
• Ask us to delete your personal information, subject to any legal obligations we have to retain it.

Most of your personal information is available to view, edit or delete directly from the Settings page in your Startup Compass account. If you would like to make a request that you cannot complete through the Settings page, contact us at hello@theproductbus.com and we will respond within a reasonable time. We may need to verify your identity before acting on your request.

12. Cookies and similar technologies

Startup Compass uses cookies and similar technologies to operate the platform, keep you signed in, remember your preferences, and understand how the platform is used.

You can control cookies through your browser settings. If you disable cookies, parts of Startup Compass may not function correctly.

13. Notifiable data breaches

If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required under the Privacy Act 1988 (Cth) and the Notifiable Data Breaches scheme. We will also take reasonable steps to contain the breach and mitigate any further harm.

14. Who Startup Compass is for

Startup Compass is currently designed for, and made available to, users in Australia. We are not targeting users outside Australia at this stage. If we expand to users outside Australia in the future, we will update this policy and any other notices required by the laws of those jurisdictions.

15. Children

Startup Compass is intended for users who are 18 years or older. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us and we will take reasonable steps to delete it.

16. Complaints

If you believe we have not handled your personal information consistently with this policy or the Australian Privacy Principles, you can make a complaint to us at hello@theproductbus.com. We will acknowledge your complaint and respond to it within a reasonable time, usually within 30 days.

If you are not satisfied with our response, you can escalate the complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

17. Changes to this policy

We may update this policy from time to time. If we make changes that materially affect how we handle your personal information, we will notify you through the platform or by email before the changes take effect. The date this policy was last updated is shown at the bottom of this page.