startwave

Startwave Technology Inc.

Privacy Policy

Effective September 14, 2026

Who operates Startwave

Startwave Technology Inc. operates Startwave, a managed outbound service that helps businesses connect with customers. This policy explains how we handle information when you visit the service, use a workspace or communicate with a customer using Startwave. Contact joe@startwave.io with privacy questions or requests.

Information we process

We process account and workspace identifiers, login information, campaign settings and copy, uploaded contacts and contact attributes, exclusion lists, sender business details, and billing and usage records. Connected mailbox processing includes outgoing messages, incoming replies, message identifiers, conversation history and delivery metadata. Technical records include security events, errors and connection information needed to operate and protect the service.

Connected Google accounts

Google sign-in and mailbox authorization are separate connections. Sign-in identifies your account. With your consent, an authorized mailbox connection permits sending messages through the Gmail API. To retrieve campaign replies and display conversations, mailbox reading may use an authorized IMAP connection or read-only Gmail API access, depending on the connection you enable. Read-only access does not permit us to change or delete messages in your Gmail account. We store authorization tokens and mailbox connection credentials to maintain the connections you enable, together with the message content and metadata needed for campaigns and conversations. Disconnecting Google access does not automatically erase historical records already stored by Startwave.

How we use information

We use information to provide the features you request: manage campaigns and capacity, verify recipients, send authorized messages, organize replies, enforce exclusions, account for usage, recover uncertain operations, provide support and prevent abuse. We do not use tracking pixels to measure email opens. We do not sell Google user data or use it for advertising targeting. Startwave’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

AI-assisted replies

When an authorized user requests reply assistance, relevant conversation text and supplied campaign context are sent to our configured AI service through OpenRouter. The feature produces a proposal for human review; it does not independently send a reply. The service requests providers that disallow data collection and require zero data retention. We do not use Google user data to train or improve general-purpose AI models. Do not request assistance on information you are not authorized to share. Costs and request outcomes are recorded for accountability.

Service providers and disclosures

We share information needed to deliver requested features with hosting and security services, mailbox and email providers, recipient-verification services, payment processors and, when requested, AI providers. Recipient-verification providers receive the email addresses submitted for verification; they do not need your message copy or conversation history. Mailbox infrastructure and warmup providers process sender account information and operational data needed to provision and maintain mailboxes. Email providers process messages to send and receive them. Cloudflare handles web traffic and security, Stripe handles payment operations, and OpenRouter handles requested AI assistance as described above. These services do not all receive the same information. We may also disclose information when required by law, to protect rights and security, or in a business transfer with appropriate protections.

Storage, retention and security

The current beta runs on owner-operated single-host hardware with local backups. Access controls, encrypted stored OAuth grants and protected credential files help protect information, but no system guarantees complete security or availability. We retain campaign and conversation history while needed for the service, and may retain transaction, security, suppression and dispute records to meet obligations and prevent unwanted contact. Archiving a campaign hides it from active views; it is not deletion. Copies in backups may persist until those backups are replaced.

Your choices and requests

You can manage workspace settings and exclusions, revoke connected Google access in your Google account, and contact joe@startwave.io to request access, correction or deletion. We may verify your authority before acting. A workspace owner controls information processed for that workspace; requests about an email from a customer may need to be directed to that customer. Follow the opt-out instructions in a campaign email, including replying STOP when offered, to stop further automated outreach from that workspace. Applicable privacy rights and legal retention requirements still apply.

Cookies, transfers and updates

With your optional consent, public pages use Google Analytics (G-Y245CR1BP8) to measure page views. We do not send workspace identifiers, contact details, message content, query strings or fragments to Analytics. Advertising personalization and Google signals are disabled in the tag configuration. You can change your choice using Privacy choices on public pages. Separately, we use browser storage and session cookies for authentication, preferences and recovery of your requested operations. We do not promise that processing stays in a particular country: service providers may process information internationally. The service is intended for business users, not children. We will publish an updated policy when our practices materially change and provide additional notice where required.