Privacy policy

AgencyStarter provides a hosted platform for online agencies — web, marketing, SEO, automations. For the personal data described below, the controller is AgencyStarter, reachable at privacy@agencystarter.uk. We are UK-based and this policy is written for UK GDPR.

When you open an account we hold your agency's name, your name, email address, sign-in credentials (passwords are stored only as salted hashes, never in plain text), your plan and billing history, and a log of significant account actions with the IP address they came from. We use this to run the service, to bill you, to keep the account secure, and to answer you when you write to us. The lawful basis is the contract between us; for security logs, our legitimate interest in keeping the platform safe.

Payments are handled by Stripe: your card details go to Stripe, never to our servers. Stripe's own privacy notice applies to that processing.

What you and your clients enter into your portal — client contact details, update requests, messages, documents, billing records, call-back requests and accepted service agreements — is your data. For that data you are the controller and we are your processor: we store it, back it up and display it to the people your account authorises, and use it for nothing else. We do not read it, sell it, or use it to train anything. If someone whose data you entered contacts us directly, we will refer them to you.

Two of those are worth spelling out. When a client asks you to ring them back, we store their name, phone number, what the call is about and when they can talk, so the request reaches you and you can call them.

And when a client accepts one of your service agreements in the portal, we record who accepted it, when they accepted it, and the exact wording they were shown. We keep that record even after you change the agreement: the old wording, and the acceptances against it, stay exactly as they were alongside the new version. That is deliberate — it is the record of what your client actually agreed to on the day, and it would be worth nothing if it could be edited or quietly replaced. It is kept for as long as we hold your account's data.

The lead finder returns publicly-listed details of businesses — trading name, phone number, and where available a contact name and email. Where those details identify a person (a sole trader, for example), they are personal data; our lawful basis for supplying them is legitimate interest in helping local businesses be found by agencies who can serve them. Your agency is the controller for what it then does with them — see the terms for your obligations around TPS/CTPS screening and PECR.

Your data is stored on servers in London, encrypted at rest, with backups taken every 15 minutes. We keep account data while your account is open. Close your account and we delete it within 30 days, except records we must keep longer (such as billing records for tax purposes, kept 6 years). Backups age out on a rolling schedule.

We use a small number of processors to run the service: our hosting provider (Fly.io, London region), our transactional email provider (Resend), Stripe for payments, and Cloudflare, where encrypted backups of the databases and uploaded files are stored. Each processes data only on our instructions.

The lead finder sends your search — the trade and the area, never your clients' data — to Google's Places service, which returns publicly-listed business details. Results are held in a shared pool so the same business is not bought twice over; that pool contains business listings only, and nothing about you or your clients ever goes into it.

This website sets no marketing cookies unless you agree to them. If you accept in the cookie banner, we load the Meta (Facebook) pixel, which sets cookies and tells us whether our advertising brings visitors who go on to sign up — pages viewed, the sign-up wizard opened, a sign-up completed. Meta acts as our processor for this measurement and also uses the data as a controller for its own purposes, described in Meta's privacy policy. If you reject, or simply never answer the banner, the pixel is not loaded and nothing is sent to Meta. The lawful basis is your consent, and you can withdraw it here at any time:

You can ask us for a copy of the personal data we hold about you, ask us to correct or delete it, object to processing based on legitimate interest, and ask for your data in a portable format. Write to privacy@agencystarter.uk and a person will answer within a month. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk).

If we change this policy in a way that matters, we will email account owners before the change takes effect and update the date at the top of this page.