Privacy Policy

Most privacy policies begin with what a company collects. Ours begins with where your memory lives, because that determines everything else. When you set up your organization you choose a repository.

If you choose Notion, you authorize Starling to read from and write to a workspace you own. Your Persistent, Active, and Learning memory, the substance of what your organization knows, is stored there, as plain-text markdown, under your control, and we hold only a working copy derived from it.

If you choose a Nest, we host the repository for you in our Amazon Web Services account in the United States. Your memory is stored there as plain-text markdown at permanent addresses, encrypted at rest under a key we manage, backed up in escrow. You can export the whole of it at any time as an archive encrypted with a passphrase you set, which opens to plain text without a Starling account. For Enterprise engagements, we can deploy your Nest into your own cloud (your AWS), where only you hold the key, under your Enterprise agreement.

In both cases, what we hold beyond the memory itself is derived from it: an index of your library, chat history, usage records, generated documents, and excerpts of uploaded source material. These are working copies used to operate the Platform. The index is a fast-access copy holding structural information about your library together with content cached from it (summaries, keywords, section titles, and document text), so a session loads in milliseconds instead of minutes.

For a Notion organization, your workspace is the authoritative copy, and the memory index can be regenerated from it at any time. Drafts awaiting approval, chat history, generated documents and uploads exist only with us, and are deleted with your organization. For a Nest organization, the Nest is the authoritative copy, and the export is how you hold it yourself.

Account information. Your name, email address, and organization name, provided by you at signup.

Connection data. For Notion organizations, an OAuth token authorizing Starling to access the workspace you designate. You can revoke it in Notion at any time, which immediately ends our access. If you connect Google Drive, Microsoft OneDrive, or Dropbox to Studio, we hold an authorization token for the account you connect, used only to import the files you choose and export the documents you ask for. You can revoke it in that service at any time.

Organizational memory. For Nest organizations, the memory itself, in the Nest we host for you.

Derived and operational data:

• Session and chat history: your conversations with Starling. These contain your memory quoted and reasoned over, because that is what the conversation is.
• A memory index, a catalog of what your library contains: each node’s semantic address, title, memory tier, status, and its declared relationships to other nodes. It also caches short content drawn from your Notion (document summaries, keywords, subtitles, and body content) so a session loads quickly. For a Notion organization it is rebuilt by scanning your workspace, so it can be deleted and regenerated at any time.
• Derived documents: the formatted outputs (PDF, Word, PowerPoint, HTML) Starling produces from your memory.
• Uploaded source material: the files, and the text excerpts we split them into so the right passage can be loaded into the right session.
• Usage records: token consumption, model selection, and request counts, so we can bill accurately and show you where your usage went.

Payment information. Processed by Stripe. We receive confirmation of payment and the last four digits of your card. We never see or store your full card details.

Technical data. IP address, browser type, device information, and server logs, which are standard and used for security and debugging.

Voice input. If you use realtime voice, your audio streams directly from your browser to OpenAI for transcription. We don’t store the audio. What is said on a call is transcribed and saved as chat history, the same as a typed message.

• We don’t treat your organizational memory as our asset.
• We don’t buy data about you from third parties.
• We don’t sell your data.
• We don’t run ads in the Platform, and we don’t accept payment to influence Starling’s output.
• The Platform itself does not track you across other websites. The marketing website’s tags are described in section 11.

• To operate the Platform and serve your sessions
• To bill you and show you your usage
• To respond when you contact support or send feedback
• To debug, secure, and improve the Platform
• To send you service messages (billing, outages, material changes)
• To comply with law

We use aggregated, anonymized usage data to understand how the Platform performs. It can’t identify you or your organization.

We do not use your content for advertising, profiling, or resale, and we do not train models on it — there is no training pipeline in our software.

When you work in Starling, your prompts and the context assembled for them are sent to a third-party AI provider. Today these are Anthropic (Claude), our primary provider; OpenAI, the automatic fallback for text generation and the provider for realtime voice; and Google (Gemini), when your organization selects a Gemini model. We keep the current list on our Trust page and update it before a new provider receives your content.

Every call is stateless: we send only the context assembled for that request, and we never ask a provider to keep a conversation for us. We do use Anthropic’s prompt caching, which keeps the opening of a prompt for about five minutes so the next turn costs less; it is not a stored conversation.

If the provider your organization selected fails during a Workspace turn or an inline edit, the request is retried on OpenAI’s GPT-4.1, whichever model your organization selected; the retry is logged and billed as GPT-4.1. Realtime voice always runs on OpenAI, whatever model is selected.

When Studio converts a file, it sends the file to Anthropic to read, whichever model your organization selected. Anthropic may keep it for up to 30 days.

If you use realtime voice, your audio streams directly from your browser to OpenAI for transcription; we don’t store the audio.

These providers do not train on your content under their commercial and API terms. Each may keep inputs and outputs for a bounded period for abuse monitoring and then delete them. Today that is up to 30 days for Anthropic and OpenAI and up to 55 days for Google, and certain Anthropic models carry that 30-day retention on every plan; we keep each provider’s current period on our Trust page.

We state this as the providers’ commitment, which we verify against their published terms, not as a property of our software; our own no-training commitment (section 4) is architectural. This differs from consumer chatbots, where training on conversations may be the default.

We recommend the model per task. You can see and change your organization’s model selection in the Platform.

We don’t sell or rent your data. We share it with service providers who help us run the Platform, each bound by contract to protect it: Notion (your organizational memory, in your own workspace, when you choose it); Amazon Web Services (hosting for Nests, in the United States — for a self-hosted Nest, the Nest runs in your own cloud account, and what Starling holds is governed by your Enterprise agreement); Supabase (operational data: sessions, index, derived documents); Vercel (application hosting); Cloudflare (the secure network connection between the Platform and the Nest engine); Anthropic (AI processing for Claude, and files Studio converts), OpenAI (fallback text generation and realtime voice), and Google (AI processing for Gemini, when your organization selects a Gemini model); Stripe (payment processing); Resend (transactional email); Firecrawl (web content retrieval, when you ask Starling to read a site); Google Drive, Microsoft OneDrive, and Dropbox (file import and export, when you connect them); and our self-hosted OnlyOffice Document Server (document rendering and format conversion). Nests are hosted in the United States; our other providers process data on our behalf under their standard terms. This list is current as of the date at the top of this policy. We keep it current on our Trust page and update it before a new provider begins processing your data.

We may also disclose data if legally required, to protect our rights or someone’s safety, or in connection with a merger or acquisition, in which case we’d notify you.

• Account data: while your account is active.
• Your memory in a Nest: while your organization exists, for 30 days after you cancel, and for 30 days after you delete the organization, so that you can still export it.
• Session and chat history: while your organization exists, or until you delete the session.
• Event log: a record of activity in the Platform, including the text of messages and documents, kept while your organization exists; a session’s entries are deleted when you delete that session.
• Usage records: while active.
• Billing records: as long as tax and accounting law requires.
• Derived documents: while active, or until you delete them.
• Server logs: retained for operational and security purposes; we don’t currently commit to a fixed retention period.

Your memory in Notion is retained by Notion under your control, on your terms with them. We don’t set its retention, because we don’t hold the authoritative copy.

If your memory lives in Notion, deleting your account does not affect it: it remains in your workspace, in plain-text markdown. There is nothing to export from us, because we never held the authoritative copy, and revoking our access in Notion ends our access immediately.

If your memory lives in a Nest, we keep the Nest for 30 days after you delete your organization so that you can still export it — the export is available at any time from the Platform, including during those 30 days — and then delete it permanently.

Everything else is deleted at once. When you delete your organization, we permanently delete its records, sessions and chat history, the memory index, drafts awaiting approval, derived documents, uploaded source material, usage records, and our event and audit logs, and we end our access to your Notion workspace. Deletion cannot be undone. Copies in our encrypted database backups roll off within 30 days.

We keep only limited records: a billing record of your final balance, with no content; payment records, held by us and our payment processor; sign-in records, which are not linked to an organization; and a log of administrative actions taken by our staff. Billing records are kept as long as tax and accounting law requires.

We may keep anonymized aggregate statistics that can’t identify you.

To delete your organization, use Settings in the Platform. Deleting an organization does not delete your account: you return to setup, and you can delete the account separately, from Settings or by emailing support@starlingmx.com.

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, or to object to or opt out of certain processing. To exercise any of these, email support@starlingmx.com; we’ll respond within 45 days and won’t discriminate against you for asking. If we deny a request, you may appeal by replying to our response, and we’ll tell you the outcome. The Platform is currently offered only in the United States (see the Terms of Service); we are not offering it in the European Union or the United Kingdom, and this policy does not address the GDPR or UK GDPR.

We use encryption in transit and at rest, access controls, and access logging and monitoring, and we encrypt sensitive credentials such as your Notion authorization token. Nests are encrypted at rest with a key we manage, backed up in escrow on your behalf; for a Nest deployed into your own cloud, only you hold the key.

We’re in beta, and we won’t overstate our security posture. We hold no security certification today and will state one only once we have it — if certification is a requirement for you, contact us before relying on the Platform for sensitive material.

No system is perfectly secure. If we discover a breach affecting your personal data, we’ll notify you and any regulator without unreasonable delay and as required by applicable law, including the New Jersey breach-notification statute (N.J.S.A. 56:8-163).

There are two different sites, and they work differently.

The Platform (the app you sign in to, at starlingmx.ai) uses cookies only to operate: your sign-in session, and two small preferences — whether the sidebar is open, and whether you have completed onboarding. It runs our own first-party page-view logging and Vercel’s cookieless analytics and performance measurement, so we can see how the Platform is used and how fast it is. It sets no advertising cookies, carries no advertising or ad-platform tags, and does not track you across other websites.

Our marketing website (starlingmx.com) uses the standard tags most companies use to measure their marketing: cookieless analytics (Vercel Web Analytics and Speed Insights); the Meta Pixel; the LinkedIn Insight Tag; and Google Analytics. These tags may set cookies and may be used by those platforms to measure our campaigns and to show ads to people who have visited our site.

They run on the marketing website and, for the Meta Pixel, on our Calendly booking page. They never run inside the Platform, and they never touch your organizational memory or anything derived from it — the commitments in sections 1 through 8 are about the product, and marketing-site tags cannot reach it.

You can limit these tags through your browser’s cookie settings and through the ad settings Meta, LinkedIn, and Google provide. Because there is no industry-standard response to browser “Do Not Track” (DNT) signals, we do not respond to them at this time.

The marketing website also has four ways to reach us. Ask Starling sends your question, typed or spoken, to OpenAI and Anthropic, which answer from Starling’s own published library; it never reaches any customer’s organizational memory, and we store neither your question nor the audio. Book a Consult is handled by Calendly, which collects the name, email, and time you give it; our booking page there carries the Meta Pixel. Messages sent through our contact form are delivered to us by email at hello@starlingmx.com. Our newsletter is sent through Substack, which holds the email address you subscribe with.

The Platform isn’t for anyone under 18, and we don’t knowingly collect data from children.

We’ll update this policy as the Platform develops. The “last updated” date always reflects the current version.

• Changes that reduce your protections. If a change materially reduces how we protect your data, we’ll notify you by email or in the Platform at least 14 days before it takes effect, and we won’t apply it to data we already hold without your consent where the law requires it.
• Other changes (for example, adding detail, describing a new feature, or updating the provider list in section 6) take effect when we post them.
• Changes required by law or for security may take effect immediately.