Privacy notice.

Startiva is run by Wessel Spuij, trading as Hinterland Digital Services, Via delle Montagne Rocciose 62, 00144 Rome, Italy (“we”). We are the data controller for the personal data described here. You can reach us at wessel@start-iva.com.

• Your answers to our questions (your situation, city, language, budget). They are stored against an anonymous session cookie, not your name.
• Your email address, only if you send your brief to studios or ask for a review link.
• Usage events such as which studio profiles you open, used to show studios aggregated statistics and to improve the matching.

When you send your brief, and only after you tick the box that says so, we share your answers and email with the three studios you chose. From that moment each studio handles your data as an independent controller, under its own professional secrecy obligations.

We collect what you give us in the request to join and in your profile: studio name, contact person, email, phone, Albo registration, city, languages, specialties, team size, website and your answers about your clients. Profile details marked as public are shown in the directory. If you pay a membership, billing details are collected and processed by Stripe; we receive the payment status and invoices, never your full card number.

• Showing your matches and sending your brief: to provide the service you ask for (Art. 6(1)(b) GDPR).
• Sharing your answers with studios: your consent (Art. 6(1)(a)), which you can withdraw at any time.
• Reviewing studios and running memberships: contract and pre-contract steps (Art. 6(1)(b)).
• Invoicing and tax records: legal obligation (Art. 6(1)(c)).
• Security, rate limiting and abuse prevention: our legitimate interest (Art. 6(1)(f)).

We use a small number of providers, under data processing agreements:

• Supabase: database, hosted in the EU (Frankfurt).
• Vercel: hosting, served from the EU (Frankfurt).
• Resend: transactional email.
• Stripe: payments for studio memberships.
• Google (Google Analytics 4): visit statistics, only if you accept analytics cookies.

Where a provider may access data from outside the EU, the transfer relies on the EU Commission’s standard contractual clauses or the EU–US Data Privacy Framework.

• Anonymous sessions and answers: up to 12 months after your last visit.
• Briefs and reviews: as long as the studio is listed, then 12 months.
• Studio requests that are declined: 12 months.
• Invoices: 10 years, as Italian tax law requires.
• Login links expire after 20 minutes; studio sessions after 30 days.

Technical cookies, always on because the site needs them: one keeps your anonymous session, one keeps a studio signed in, one remembers your language, and one remembers your cookie choice.

Analytics cookies, only if you click “Accept analytics”: Google Analytics 4 counts visits and the pages people use, with IP addresses anonymised. We use it to improve the site, never for advertising. If you decline, Google Analytics is not loaded at all.

Your choice is kept for 6 months, then we ask again. You can change it at any time with “Cookie settings” at the bottom of every page. No advertising cookies are used.

You can ask us to access, correct, delete or export your data, to restrict or object to its use, and to withdraw consent, by writing to wessel@start-iva.com. We reply within one month. You can also complain to the Garante per la protezione dei dati personali (garanteprivacy.it).