Privacy Policy

Last updated: November 3, 2026

The startups being built on campus, before anyone knows their names.

Five Star Startups discovers, researches, and curates early-stage companies founded by students and university builders. We identify projects at their origin—in lecture halls, hackathons, campus demo days, and open-source repositories—long before they appear on conventional startup databases.

This Privacy Policy explains what information we collect, how we find and verify it, how we use and share it, and the choices and rights available to founders, account holders, and visitors.

1. Who We Are and What This Policy Covers

Five Star Startups ("Five Star Startups," "we," "us," or "our") operates the Five Star Startups website, directory, intelligence, and account services (collectively, the "Service"). This policy applies to the Service, including our public pages, the founder index, and the signed-in dashboard and settings area.

It does not apply to third-party websites or services we link to—such as our demo booking form, a founder's project site, or a repository hosted elsewhere. Those services have their own privacy policies.

2. Information We Collect

A. Public Campus Traces

Student founders leave traces long before anyone notices them. We gather publicly accessible information to identify emerging startups, including:

• Project & Demo Information: Public project submissions, demo day pitches, hackathon presentations, live demo URLs, repository links, and release histories.
• Founder Details: Public names, university affiliations, student status, public campus or professional email addresses, GitHub profiles, and publicly shared professional links.
• Team & Traction Signals: Co-founder relationships, campus grant awards, public customer testimonials, and launch announcements.

Every entry in Five Star Startups is reviewed by hand. We do not use automated scrapers to publish unverified lists, nor do we accept unvetted self-reported submissions.

B. Account Information

If you create an account, we collect and store:

• Email address and password. Passwords are handled by our authentication provider (Supabase Auth) and stored in hashed form; we never see your plaintext password.
• Profile details. Your display name and, if you add one, a profile image URL.
• Account preferences. Settings such as your selected theme.
• Session data. Cookies and tokens that keep you signed in and secure your session.

C. Information You Provide Directly

• Founder Submissions: If you are building something on campus and share your project with us directly, we collect the details you provide about your product, team, and university.
• Demo Requests: When you request access or book a demo, we collect your name, email address, organization or fund name, and any notes you include in your submission.
• Direct Communications: If you contact us by email or other messaging channels, we retain your message and contact information to assist you.

D. Technical & Usage Data

When you visit our website, our hosting and analytics providers may automatically collect standard technical data, such as:

• IP address, browser type, operating system, and device information.
• Pages visited, referral source, and timestamps.
• Basic interaction events, such as page views and page leaves.

This information is used to ensure site security, diagnose technical issues, understand how the Service is used, and improve the user experience.

3. Cookies and Analytics

We use a small number of cookies and similar technologies:

• Strictly necessary cookies. Set by our authentication provider to keep you signed in and to protect your account. The Service cannot function without them.
• Analytics. We use PostHog to understand aggregate usage—primarily page views and page leaves. PostHog may set cookies or use local storage and may collect device and usage information. Our current configuration does not include session recording; if we enable it or add new tracking, we will update this policy first.

We do not use advertising cookies, and we do not sell or share personal information for cross-context behavioral advertising. You can block or delete cookies in your browser settings, but the account area may not work correctly if you do.

4. How We Use Information

We use the information we collect to:

• Research, verify by hand, and maintain the earliest reliable index of companies built by people still in school.
• Distinguish active, real companies from abandoned or hypothetical projects.
• Create and operate your account, authenticate you, and keep the Service secure.
• Send transactional messages you request, such as email confirmations and password resets.
• Communicate with founders about their listings, milestones, or opportunities.
• Respond to demo bookings and inquiries from founders, operators, and investors.
• Maintain the reliability, security, and integrity of our platform.
• Comply with legal obligations and enforce our Terms and Conditions.

5. Our Guarantees

• We don't sell placement: Companies cannot pay to be listed, featured, or ranked in Five Star Startups. Every company is included solely because we found it and a person checked it.
• We don't sell personal data: We do not sell, rent, or trade your personal information to data brokers or third-party advertisers.
• No predatory tracking: We do not track private student activity or buy private student directories. All research is anchored in public, verifiable signals.
• Account data stays out of the index: We do not copy account data—your password, settings, or sign-in details—into the research index. Founder details in the index come from public sources, as described in Section 2A.

6. How Information Is Shared

• Subscribers & Research Access: The Five Star Startups index—including verified company profiles, public links, campus affiliations, and public founder details—is made available to vetted subscribers, such as investors and scouts looking to discover campus startups early. This does not include account data.
• Service Providers: We share limited information with trusted providers who help us operate the Service. These currently include Supabase (authentication and database), Vercel (web hosting), Google Forms (demo request processing), and PostHog (product analytics). These providers are contractually obligated to protect your data and may process it on our behalf.
• Legal Compliance: We may disclose information if required to do so by applicable law, regulation, subpoena, or legal process, or where we believe disclosure is necessary to protect our rights, users, or the public.
• Business Transfers: If Five Star Startups is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will require the recipient to honor this policy or provide notice before your information becomes subject to a different one.

7. Founder Rights & Removal Requests

We deeply respect the founders building on campus. If your project is included in Five Star Startups and you would like to:

• Review or update the information listed about your company,
• Correct any inaccurate or outdated information, or
• Request the removal of your project or personal details from our database,

simply reach out to us. We honor all verified removal and opt-out requests promptly and without hassle.

8. Your Account, Corrections, and Deletion

You can review and update your display name and email address at any time in your account settings. Changing your email requires confirmation through our authentication provider.

You can delete your account from the settings area. When you do, we delete your profile and associated account data, and your access to the dashboard ends. Residual copies may remain in encrypted backups for a limited period before they are overwritten, and we may retain limited records where the law requires it or to resolve disputes.

Deleting your account does not automatically remove a company listing from the research index. Index entries are handled under Section 7, so please also send a removal request if you want your project or personal details excluded.

9. Data Security & Retention

We implement reasonable administrative, technical, and physical safeguards to protect information against unauthorized access, loss, misuse, or alteration, including encryption in transit and access controls on our systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

We retain account information for as long as your account is active and for a reasonable period afterward as needed to comply with legal obligations, resolve disputes, and enforce our agreements. Demo requests and correspondence are retained for as long as necessary to respond and maintain our records. Analytics data is retained according to our provider's settings and our legitimate business needs.

10. Children and Age Requirements

The Service is not directed to children under 13, and you must be at least 13 years old to create an account. If you are under the age of majority where you live, you may use the Service only with the involvement of a parent or guardian.

If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a child under 13 has provided us information, please contact us.

11. Your Privacy Rights

Depending on where you live, you may have rights over your personal information, including the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your information.
• Receive a portable copy of the information you provided.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Complain to your local data protection authority.

To exercise any of these rights, email us at alexander@mirenta.ai. We may need to verify your identity before acting on a request, and some rights are subject to legal exceptions—for example, where we must retain information for compliance.

Five Star Startups does not sell personal information or share it for cross-context behavioral advertising as those terms are defined under California law, and we will not discriminate against you for exercising your privacy rights.

12. International Data Transfers

Five Star Startups is based in the United States, and our service providers may process information in the United States and other countries. Where required, we rely on appropriate safeguards for international transfers, such as standard contractual clauses offered by our providers.

13. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable legal requirements. The updated version will be posted on this page with a revised "Last updated" date. If changes are material, we will take reasonable steps to notify account holders.

14. Contact Us

If you have questions about this Privacy Policy, wish to update your details, or want to request removal from the index, email us at alexander@mirenta.ai or reach out through our demo booking form.