Legal
Last updated 30 August 2026
This policy explains what SOC2Starter collects, why, where it is stored, who else processes it, and how to get it deleted. It applies to the SOC2Starter mobile app, our website, and the services behind them (together, the "Service").
The Service is operated by Deepak Gandhi (trading as SOC2Starter) ("we", "us"). We are the data controller for account data, and a data processor for the compliance content you put into the Service.
Your name, work email address and password (stored only as a hash, never in readable form). Provided by you at sign-up.
Company name, website, employee count, industry, country and description, plus the technology stack you select during onboarding.
This content frequently describes your security posture, including gaps. We treat it as confidential and it is never used for advertising, never sold, and never shared with other customers.
If you connect an integration, we read data from it on your instruction and store it as evidence. That data is read-only and typically includes account lists, roles, administrator lists and multi-factor authentication status. We never request a permission that can change anything in your account.
The credentials you provide for those integrations are stored in a location that the application's own database role cannot read. They are only ever transmitted back to the provider they belong to.
A push notification identifier if you enable notifications, and standard server logs (IP address, timestamp, request path) retained for security and debugging. We do not use advertising identifiers or third-party analytics or tracking cookies on the app.
We never see or store your card details. Payments are processed by our payment provider, who acts as merchant of record. We receive only your billing email address, subscription status and renewal date.
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Providing the Service to you | Performance of a contract |
| Sending reminders about your own due dates | Performance of a contract |
| Billing and preventing abuse | Legitimate interests |
| Security monitoring and audit logging | Legitimate interests, legal obligation |
| Responding to your support requests | Performance of a contract |
We do not sell personal data, and we do not use your content to train any model of our own.
Some features send context to a third-party language model provider: drafting a policy, suggesting which requirement a piece of evidence proves, writing an action plan, or explaining a requirement in plain English. What is sent includes your company profile, your technology stack, your questionnaire answers and the titles and descriptions of evidence — not the contents of uploaded files.
Read this if you are evaluating us as a vendor. Our current model provider is Google Gemini. Some providers' free tiers may use submitted prompts to improve their own products. Where that is the case for the tier we are on, we state it here rather than leaving you to find out. If our provider or tier changes, this section is updated and the change is noted in the "last updated" date above.
Every AI feature is optional in the sense that the product works without it — policy drafting falls back to built-in templates and classification falls back to keyword matching. If you would prefer no data reach a model provider at all, tell us and we will disable AI features on your workspace.
These are our subprocessors. We do not add one without updating this list.
| Subprocessor | What it does | Data it handles |
|---|---|---|
| Supabase | Database, authentication, file storage and server functions | All account data, compliance content and evidence files |
| Google Gemini | Language model for the AI features described above | Company profile, stack, questionnaire answers, evidence titles |
| OneSignal | Push notification delivery | Device push identifier, reminder title and body |
| Paddle | Payments, as merchant of record | Billing email, company name, transaction records |
| Vercel | Hosting for this website only | Standard web server logs |
Providers you choose to connect yourself — GitHub, Google Workspace, AWS, Okta and the rest — are not our subprocessors. You instruct us to read from them, and their own privacy terms govern your relationship with them.
Your data is stored on infrastructure operated by Supabase in the ap-northeast-1 (Tokyo) region. Subprocessors listed above may process data in other countries. Where personal data is transferred out of the UK or EEA, we rely on the transfer mechanisms our subprocessors have in place, such as Standard Contractual Clauses.
No system is perfectly secure, and we will not pretend otherwise. If we become aware of a breach affecting your personal data, we will notify you without undue delay and, where required, within 72 hours of becoming aware of it.
Depending on where you live, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to object to processing based on legitimate interests. To exercise any of them, email deepakgandhi2007@gmail.com. We respond within 30 days.
You can delete your account yourself, at any time, without asking us. In the app: Settings → Danger zone → Delete my account. This permanently deletes your login, your profile and every company where you are the only owner or administrator, including its policies, evidence files, tasks and activity log. It cannot be undone.
If you are in the UK or EEA and believe we have handled your data improperly, you may complain to your local supervisory authority.
The Service is a business tool and is not directed at anyone under 16. We do not knowingly collect data from children.
If we make a material change — a new subprocessor, a new category of data, a change of model provider — we will update the date at the top and notify account owners by email before it takes effect.
Deepak Gandhi (trading as SOC2Starter)
deepakgandhi2007@gmail.com