Privacy Policy

doesithaveamoat.com is run by Elderine Holdings, LLC, 800 N King Street, Suite 304-3288, Wilmington, DE 19801, United States. We decide how the personal data described here is used (we're the “controller”). For anything about your data, email will@elderine.co.

• You don't need an account, and we never ask visitors for their name or email.
• No advertising, no tracking cookies, no selling or sharing your data for ads.
• We never store raw IP addresses. Where we need to tell visitors apart (for daily check limits and to count sponsor clicks once), we store a scrambled, one-way version.
• Sponsors give us an email address and pay through Stripe. We never see card details.

When you visit. We count page views. To count unique visitors and show how many people are on the site right now, your browser keeps a random ID in local storage; it isn't linked to who you are and we delete it from our side after two days of inactivity. We also use Vercel Web Analytics, which counts visits without cookies, and Vercel BotID, which looks at signals from your browser to tell people from bots. Like any website, our host briefly logs requests, including IP addresses, for security.

When you check a website. We store the website you entered and the report we write about it, which is public. To enforce the daily limit on checks, we store a one-way hash of your IP address with each check you start.

When you click a sponsor. We log the click with a one-way hash of your IP address (so it counts once a day), your country, your device type (phone, tablet or desktop) and the page you clicked from. Sponsors see totals, never individual visitors.

When you sponsor. We store your startup's name, website, pitch and logo (all shown publicly), your email address, what you paid and Stripe's reference numbers for the payment. Stripe handles the payment itself, including your card details and billing address, under its own privacy policy.

When you email us. We keep the conversation so we can reply and follow up.

About startups. Reports cover companies and their public footprint: revenue from TrustMRR, and what's published on the web, which can include founders' public profiles. We only use information that's already public. See corrections and removal if something's wrong.

• Running, securing and improving the site, including bot protection, check limits and visitor counts. Our legal basis is our legitimate interest in keeping a free site working and safe.
• Delivering a sponsorship: putting your slot live, emailing your confirmation and stats link, answering you, handling refunds and disputes. Our basis is our contract with you.
• Keeping records of payments for accounting and tax. Our basis is our legal obligations.

Only the services that run the site for us, each limited to what it needs:

• Vercel (USA): hosting, web analytics and bot protection.
• Neon (USA): our database.
• Stripe (USA, Ireland): payments.
• Resend (USA): sends sponsor confirmation emails.
• Anthropic (USA): the AI that researches startups. It gets the startup's name, website and public details, never anything about you as a visitor.
• Telegram: private notifications to us when a sponsor goes live, which include the sponsor's details and email.

Logos on the site load from Google's favicon service and from TrustMRR's image servers, which see your IP address like any image host. We may also share data if the law requires it, or with a buyer if the site is ever sold. We don't sell personal data, and we don't share it for cross-context behavioural advertising.

The site doesn't set cookies for visitors. The only thing it keeps in your browser is the random visitor ID described above, which you can clear any time along with your browser's site data. The site owner's admin sign-in uses its own cookies. Stripe's checkout page sets its own cookies to process payments and prevent fraud.

• Visitor IDs on our side: deleted after two days without a visit. Page views are kept only as daily totals.
• Hashed IP addresses: kept with the check or click they belong to.
• Sponsor details and payment records: for as long as tax and accounting rules require, usually up to seven years.
• Sponsor click logs: for at least as long as a payment could be disputed.
• Emails: as long as we need them to help you.

Depending on where you live (including the UK, the EU and US states such as California), you can ask to see the personal data we hold about you, correct it, delete it, get a copy, or object to how we use it. Email will@elderine.co and we'll reply within a month. We won't treat you differently for asking.

We only hold IP addresses as one-way hashes and never try to reverse them, so we usually can't match them to you. If you're in the UK or EU, you can also complain to your data protection authority, such as the ICO in the UK.

We're a US company and our providers mostly run in the United States. When data leaves the UK or EU, our providers protect it with the safeguards the law requires, such as the EU's standard contractual clauses.

The site isn't meant for children under 16, and sponsors must be adults able to make a payment. We don't knowingly collect data from children; if you think we have, email us and we'll delete it.

If we change this policy, we'll update the date at the top. Questions, requests or complaints: will@elderine.co, or post to Elderine Holdings, LLC, 800 N King Street, Suite 304-3288, Wilmington, DE 19801, United States.