Privacy Policy

Most privacy policies begin with what a company collects. Ours begins with where your memory lives, because that determines everything else. When you set up your organization you choose a repository.

If you choose Notion, you authorize Starling to read from and write to a workspace you own. Your Persistent, Active, and Learning memory, the substance of what your organization knows, is stored there, as plain-text markdown, under your control, and we hold only a working copy derived from it.

If you choose a Nest, we host the repository for you on our own infrastructure in the United States. Your memory is stored there as plain-text markdown at permanent addresses, encrypted at rest; we hold the key that protects it in escrow on your behalf. You can export the whole of it at any time as a plain archive that opens without Starling. For Enterprise engagements, we can deploy your Nest into your own cloud (your AWS), where only you hold the key, under your Enterprise agreement.

In both cases, what we hold beyond the memory itself is derived from it: an index of your library, chat history, usage records, generated documents, and excerpts of uploaded source material. These are working copies used to operate the Platform. The index is a fast-access copy holding structural information about your library together with content cached from it (summaries, keywords, section titles, and document text), so a session loads in milliseconds instead of minutes.

For a Notion organization, none of what we hold is authoritative and all of it can be regenerated from your workspace. For a Nest organization, the Nest is the authoritative copy, and the export is how you hold it yourself.

Account information. Your name, email address, and organization name, provided by you at signup.

Connection data. For Notion organizations, an OAuth token authorizing Starling to access the workspace you designate. You can revoke it in Notion at any time, which immediately ends our access.

Organizational memory. For Nest organizations, the memory itself, in the Nest we host for you.

Derived and operational data:

• Session and chat history: your conversations with Starling. These contain your memory quoted and reasoned over, because that is what the conversation is.
• A memory index, a catalog of what your library contains: each node’s semantic address, title, memory tier, status, and its declared relationships to other nodes. It also caches short content drawn from your Notion (document summaries, keywords, subtitles, and body content) so a session loads quickly. For a Notion organization it is rebuilt by scanning your workspace, so it can be deleted and regenerated at any time.
• Derived documents: the formatted outputs (PDF, Word, PowerPoint, HTML) Starling produces from your memory.
• Uploaded source material: the files, and the text excerpts we split them into so the right passage can be loaded into the right session.
• Usage records: token consumption, model selection, and request counts, so we can bill accurately and show you where your usage went.

User Library data. Personal working notes you create in your own User Library are isolated and are never loaded into another user’s session, not your System Librarian’s, not an Owner’s. This is enforced architecturally, not by policy.

Payment information. Processed by Stripe. We receive confirmation of payment and the last four digits of your card. We never see or store your full card details.

Technical data. IP address, browser type, device information, and server logs, which are standard and used for security and debugging.

Voice input. If you use realtime voice, your audio streams directly from your browser to OpenAI for transcription. We don’t store the audio; we retain only usage information for billing.

• We don’t treat your organizational memory as our asset.
• We don’t buy data about you from third parties.
• We don’t sell your data.
• We don’t run ads, and we don’t accept payment to influence Starling’s output.
• The Platform itself does not track you across other websites. The marketing website’s tags are described in section 11.

• To operate the Platform and serve your sessions
• To bill you and show you your usage
• To respond when you contact support or send feedback
• To debug, secure, and improve the Platform
• To send you service messages (billing, outages, material changes)
• To comply with law

We use aggregated, anonymized usage data to understand how the Platform performs. It can’t identify you or your organization.

We do not use your content for advertising, profiling, or resale, and we do not train models on it — there is no training pipeline in our software.

When you work in Starling, your prompts and the context assembled for them are sent to a third-party AI provider: Anthropic (Claude) as the primary provider, OpenAI as the automatic fallback for text generation and the provider for realtime voice, or Google (Gemini) for document analysis, depending on the model selected for your organization.

Every call is stateless: we send only the context assembled for that request, and we never ask a provider to keep a conversation for us.

If you use realtime voice, your audio streams directly from your browser to OpenAI for transcription; we don’t store the audio.

These providers do not train on your content under their commercial and API terms. They may retain inputs and outputs for up to 30 days for abuse monitoring and then delete them; certain Anthropic models carry that 30-day retention on every plan.

We state this as the providers’ commitment, which we verify against their published terms, not as a property of our software; our own no-training commitment (section 4) is architectural. This differs from consumer chatbots, where training on conversations may be the default.

We choose the model per task. You can see and change your organization’s model selection in the Platform.

We don’t sell or rent your data. We share it with service providers who help us run the Platform, each bound by contract to protect it: Notion (your organizational memory, in your own workspace, when you choose it); Amazon Web Services (hosting for Nests, in the United States — for a self-hosted Nest, the Nest runs in your own cloud account, and what Starling holds is governed by your Enterprise agreement); Supabase (operational data: sessions, index, derived documents); Vercel (application hosting); Anthropic (AI processing for Claude), OpenAI, and Google (additional AI processing as we route across providers); Stripe (payment processing); Resend (transactional email); Firecrawl (web content retrieval, when you ask Starling to read a site); and our self-hosted OnlyOffice Document Server (document rendering and format conversion). Our own infrastructure is located in the United States; our other providers process data on our behalf under their standard terms.

We may also disclose data if legally required, to protect our rights or someone’s safety, or in connection with a merger or acquisition, in which case we’d notify you.

• Account data: while your account is active.
• Your memory in a Nest: while your organization exists, and for 30 days after you delete the organization so that you can still export it.
• Session and chat history: while your account is active, or until you delete it.
• Usage records: while active, plus as long as tax and accounting law requires.
• Derived documents: while active, or until you delete them.
• Server logs: retained for operational and security purposes; we don’t currently commit to a fixed retention period.

Your memory in Notion is retained by Notion under your control, on your terms with them. We don’t set its retention, because we don’t hold it.

If your memory lives in Notion, deleting your account does not affect it: it remains in your workspace, in plain-text markdown. There is nothing to export from us, because we never held the authoritative copy, and revoking our access in Notion ends our access immediately.

If your memory lives in a Nest, we keep the Nest for 30 days after you delete your organization so that you can still export it — the export is available at any time from the Platform, including during those 30 days — and then delete it permanently.

Everything else is deleted at once. When you delete your organization, we permanently delete your account and organization records, sessions and chat history, the memory index, derived documents, uploaded source material, usage and billing records, and our event and audit logs. Deletion cannot be undone. We retain only limited records that the law or our service providers require us to keep, such as payment and invoice records held by our payment processor and security and system logs, and only for as long as those purposes require.

We may keep anonymized aggregate statistics that can’t identify you.

To delete your organization, use Settings in the Platform; to delete an individual account, email support@starlingmx.com.

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, or to object to or opt out of certain processing. To exercise any of these, email support@starlingmx.com; we’ll respond within 45 days and won’t discriminate against you for asking. If we deny a request, you may appeal by replying to our response, and we’ll tell you the outcome. The Platform is currently offered only in the United States (see the Terms of Service); we are not offering it in the European Union or the United Kingdom, and this policy does not address the GDPR or UK GDPR.

We use encryption in transit and at rest, access controls, and access logging and monitoring, and we encrypt sensitive credentials such as your Notion authorization token. Nests are encrypted at rest with a key per organization, protected by a key we hold in escrow on your behalf; for a Nest deployed into your own cloud, only you hold the key. Your User Library is isolated so that it is not loaded into other users’ sessions.

We’re in beta, and we won’t overstate our security posture. We hold no security certification today and will state one only once we have it — if certification is a requirement for you, contact us before relying on the Platform for sensitive material.

No system is perfectly secure. If we discover a breach affecting your personal data, we’ll notify you and any regulator without unreasonable delay and as required by applicable law, including the New Jersey breach-notification statute (N.J.S.A. 56:8-163).

There are two different sites, and they work differently.

The Platform (the app you sign in to) uses cookies only to operate: your sign-in session, and two small preferences — whether the sidebar is open, and whether you have completed onboarding. It runs our own first-party page-view logging and Vercel’s cookieless analytics and performance measurement, so we can see how the Platform is used and how fast it is. It sets no advertising cookies, carries no advertising or ad-platform tags, and does not track you across other websites.

Our marketing website (starlingmx.com) uses the standard tags most companies use to measure their marketing: cookieless analytics (Vercel Web Analytics and Speed Insights); the Meta Pixel; the LinkedIn Insight Tag; and Google Analytics. These tags may set cookies and may be used by those platforms to measure our campaigns and to show ads to people who have visited our site.

They run on the marketing website only. They never run inside the Platform, and they never touch your organizational memory or anything derived from it — the commitments in sections 1 through 8 are about the product, and marketing-site tags cannot reach it.

You can limit these tags through your browser’s cookie settings and through the ad settings Meta, LinkedIn, and Google provide. Because there is no industry-standard response to browser “Do Not Track” (DNT) signals, we do not respond to them at this time.

The Platform isn’t for anyone under 18, and we don’t knowingly collect data from children.

If we make a material change we’ll notify you by email or in the Platform at least 30 days before it takes effect. The “last updated” date always reflects the current version.