Privacy Policy

1. Introduction

At Lyftoff, we take your privacy seriously. This Privacy Policy explains how Business for Development ("we", "us", or "our") collects, uses, stores, and protects your personal information when you use Lyftoff (available at https://lyftoff.io) and any related services (collectively, the "Service").

By using Lyftoff, you acknowledge that you have read and understood this Privacy Statement and consent to the collection and use of your information as described herein.

This statement applies to all users worldwide, including those in the European Economic Area (EEA), the United Kingdom, and the United States of America, and has been drafted to comply with the General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA) where applicable.

2. Data controller

The data controller responsible for your personal data is:

If you have any questions or concerns about how we handle your personal data, please contact us at the address above.

3. Information we collect

We collect the following categories of personal information:

3.1 Account information

When you register for Lyftoff, we collect your name and email address. This information is necessary to create and manage your account, authenticate your identity, and communicate with you about the Service.

3.2 Initiative and workspace content

As part of using Lyftoff, you enter information about the initiatives you are working on. This may include details submitted through structured frameworks such as the Business Model Canvas, experiment logs, hypotheses, and other planning or validation data. This content is stored on your behalf to provide the core functionality of the Service and is not used for any purpose beyond delivering and improving that Service.

This content may contain information about third parties (such as customers, partners, or team members). You are responsible for ensuring you have an appropriate basis to enter such information into the platform.

3.3 Payment information

If you purchase a paid plan, payment processing is handled by our third-party provider, Mollie. We do not store your payment card details on our systems. Mollie collects and stores billing information on our behalf in accordance with their own privacy policy (available at mollie.com/en/privacy). We receive only a confirmation of payment and, where required for invoicing, your billing name and address.

3.4 Usage and analytics data

We collect information about how you interact with the Service, including pages visited, features used, session duration, and general device and browser information. We also use Cloudflare Real User Monitoring (RUM), which automatically injects a JavaScript snippet to measure real-world page load performance. RUM collects data such as page load times, geographic region (derived from IP address), device type, and browser. This data is processed by Cloudflare on our behalf and is used solely to monitor and improve the performance of our website. It is not used for advertising or cross-site tracking. See Section 6 for details on the cookies this sets.

3.5 User-generated content

Lyftoff includes AI-powered features (such as a chat interface) powered by Mistral AI. Any content you submit through these features — including messages, queries, and uploaded materials — is processed in order to deliver the Service to you. Your data is not used to train any AI model. Please see Section 5 for more detail on how AI processing works.

3.6 Information you provide voluntarily

We may collect additional information you choose to provide, for example when you contact our support team or respond to surveys.

4. How we use your information

We use your personal information for the following purposes, and only where we have a valid legal basis to do so:

• To provide and maintain the Service — including account management, authentication, and delivering AI-powered features. Legal basis: Performance of a contract.
• To process payments — facilitating subscription purchases and billing through Mollie. Legal basis: Performance of a contract.
• To improve and secure the Service — analysing usage patterns to fix bugs, optimise performance, and protect against fraud and abuse. Legal basis: Legitimate interests.
• To communicate with you — sending transactional emails (e.g. account confirmations, password resets) and, where you have opted in, product updates or newsletters. Legal basis: Performance of a contract / consent.
• To comply with legal obligations — retaining records as required by applicable law. Legal basis: Legal obligation.

5. AI-powered features and third-party AI processing

Lyftoff uses large language model (LLM) technology provided by Mistral AI to power its AI chat and related features. When you interact with these features, your input (including any text or content you submit) is transmitted to Mistral AI's systems for processing in order to generate a response.

We want to be clear about the following:

• Your data is not used to train AI models. Neither Business for Development nor Mistral AI will use the content of your conversations to train, fine-tune, or improve any AI model.
• Mistral AI processes your inputs solely to return a response for the purpose of providing the Service to you.
• We encourage you not to submit sensitive personal information (such as financial data, health information, or government identification numbers) through AI chat features.

Mistral AI is a data processor acting on our behalf. For more information on Mistral AI's data practices, please refer to their privacy policy at legal.mistral.ai/terms/privacy-policy.

6. Cookies and tracking technologies

Lyftoff uses cookies and similar technologies. The table below describes the cookies currently in use, their purpose, and the legal basis for setting them.

We do not use advertising, retargeting, or social media tracking cookies. If this changes, we will update this Privacy Policy and, where required by applicable law (including the EU ePrivacy Directive and UK PECR), seek your prior consent.

Managing cookies: Most browsers allow you to view, block, or delete cookies through their settings. Blocking strictly necessary cookies may impair your ability to use the Service. The Cloudflare RUM beacon is a JavaScript snippet; you can prevent it from running by using a browser extension that blocks scripts (such as uBlock Origin), though this may affect other site functionality.

For more information about Cloudflare's data practices, see Cloudflare's Privacy Policy.

Session storage: When you log in, your session token is stored in your browser's local storage (rather than as a cookie) by our authentication provider, Supabase. This is strictly necessary to keep you logged in and is not used for tracking purposes. You can clear this at any time by logging out or clearing your browser's local storage via your browser's developer tools.

7. Data storage and security

Your personal data is stored with Supabase, with data residency within the European Union. The Service is delivered via Cloudflare's global network infrastructure.

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include encryption in transit (TLS) and at rest, access controls, and regular security reviews.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

8. Data retention

We retain your personal data for as long as your account is active or as necessary to provide the Service. If you close your account, we will delete or anonymise your personal data within a reasonable period, except where we are required to retain it for legal, regulatory, or accounting purposes (for example, transaction records may be retained for up to 7 years).

You may request deletion of your data at any time — see Section 9 for details.

9. Your rights

9.1 Rights under GDPR (EU/EEA and UK users)

If you are located in the EU, EEA, or UK, you have the following rights under the GDPR / UK GDPR:

• Right of access — to obtain a copy of your personal data.
• Right to rectification — to correct inaccurate or incomplete data.
• Right to erasure — to request deletion of your personal data ("right to be forgotten").
• Right to restriction — to request that we limit the processing of your data.
• Right to data portability — to receive your data in a structured, commonly used format.
• Right to object — to object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint — you have the right to lodge a complaint with your local data protection authority. A list of EU supervisory authorities is available at edpb.europa.eu.

9.2 Rights under CCPA (California residents)

If you are a California resident, you have the following additional rights under the CCPA:

• The right to know what personal information we collect, use, disclose, and sell.
• The right to delete your personal information.
• The right to opt out of the sale of your personal information. We do not sell your personal information.
• The right to non-discrimination for exercising your privacy rights.

9.3 Exercising your rights

To exercise any of the rights listed above, please contact us at privacy@lyftoff.io. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

10. Third-party services and data processors

We work with the following third-party service providers who process personal data on our behalf. All processors are bound by appropriate data processing agreements.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

Please note that Pexels does not currently offer a Data Processing Agreement for API consumers. When you use the photo feature, keywords derived from your project content are sent to Pexels to retrieve relevant images. Pexels has confirmed that API queries are handled separately from their general website activity. We send only project-related search keywords — no directly identifying information such as your name or email address — to Pexels. Their Privacy Policy governs how they handle query data.

11. International data transfers

Your personal data is primarily stored and processed within the European Union. Where data is transferred outside the EEA (for example, via Cloudflare's global network), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, to protect your data in accordance with applicable law.

12. Children's privacy

Lyftoff is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly. If you believe we may have collected data from a minor, please contact us at privacy@lyftoff.io.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or via a notice within the Service.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

14. Contact information

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at: