Privacy policy

The short version

• Nothing on Lineup is public. Profiles and projects are visible only to signed-in members who have published a profile of their own.
• Lineup never sends a message between members. When you contact someone, we give you their email address and your own mail app writes to them. Publishing a profile means agreeing that your address may be handed over in that way.
• We email you about Lineup itself from time to time — what is new, what has changed. Every one of those has an unsubscribe link that works without signing in, and there is a switch for it in your account. You can tell us to stop at any time and we must.
• Everything Lineup stores is held on servers in the United States (Oregon). We explain below what protects it there.
• We do not sell personal information, show third-party advertising, or use third-party analytics or tracking. There is no cookie banner because there is nothing to ask you about.

What we collect

Account. Your email address and a password, which is stored only as a hash. If you sign in with Google, we receive the name, email address and profile picture on your Google account, and keep a record that the two accounts are linked; we do not get access to anything else in your Google account.

Profile. Everything you write into your profile: your first and last name, introduction, relevant experience, the projects you are looking for, fields of interest, startup experience, skills, time commitment, city, LinkedIn address and other links, and the photo and cover image you upload. Two answers — your motivation for joining and how you heard about Lineup — are collected for our own understanding and are never shown to other members.

Projects. Everything you write about a project you list: its name, one-liner, description, field, stage, the skills it is looking for, city, links and logo, and whether you have consented to us promoting it on Lineup's own channels.

Technical. Each sign-in session records the IP address and browser it was created from. Our server logs record each request with the signed-in member's identifier and a masked form of their email address, so that we can diagnose faults. Images you upload are resized and have their embedded metadata (such as camera location data) removed before they are stored.

Contacts. When you ask to contact another member, we record that a handover of their address happened — which member, which channel, and whether it was allowed — in the server log for that request. We do not keep a list of who has contacted whom, and we cannot see whether an email was actually sent. If you ask for a copy of your information, those log lines are part of it for as long as they exist, with the other member's identity removed.

Lineup does not ask for any of the special categories of information the GDPR singles out — health, beliefs, ethnicity and the like. The free-text answers are yours to write, so please do not put anything of that kind into them.

Why we collect it, and on what basis

The GDPR requires us to have a specific lawful basis for each thing we do with your information. These are ours.

• To run the directory and make introductions — to show your profile and projects to other published members, to show you theirs, and to give a member who contacts you the email address they need. This is our contract with you: it is the service you signed up for, and it cannot be done without this information.
• To keep your account secure — to verify your email address, let you reset your password, and recognise your session. Also our contract with you.
• To keep the service working and honest — to diagnose errors, and to limit how many addresses a single member can obtain in a period of time. Our legitimate interest in running a service that works and is not harvested, weighed against the very limited information involved.
• To understand who Lineup is for — the motivation and referral answers, read in aggregate. Our legitimate interest in knowing whether the directory is reaching the people it is meant for. These two answers are never shown to another member.
• To tell you about Lineup — occasional email about new features, changes worth knowing about, and how the directory is going. Our legitimate interest in keeping the members of a directory informed about it. You may object at any time and we will stop; see below.
• To promote a project you have listed on Lineup's own channels such as LinkedIn or a newsletter. Your consent, given separately per project and withdrawable at any time.
• To comply with the law — where we are legally required to keep or disclose something.

Who sees it

Other members. Once you publish your profile it is visible to every other member who has also published theirs. Setting your profile's visibility to hidden removes it from the directory and stops the direct channel, but any projects you have listed stay visible and contactable. Your email address is never displayed; it is disclosed only to a published member at the moment they choose to contact you, so that they can write to you from their own mail app. What they send from there is between the two of you and never passes through Lineup.

Service providers. We use a small number of companies to run Lineup. Each is our processor and handles information only on our instructions, under a written data processing agreement:

• Render hosts the application and its database — every piece of information Lineup stores lives on Render's infrastructure, in the United States.
• Resend delivers the emails Lineup itself sends: address verification, password reset, and the occasional update about Lineup. It receives your email address and the content of those messages, nothing else.
• Cloudflare stores the images you upload (profile photo, cover image, project logo) and provides the lineup.nz domain and DNS.

When the law requires it. We may disclose information to comply with a lawful request from an authority in New Zealand or Finland, or to prevent a serious threat to someone's safety. Because our providers are in the United States, an order from a United States authority could also reach them directly; we have no record of that ever having happened, and each provider's contract with us requires it to tell us where the law allows.

We do not sell personal information to anyone, and we do not use it to make any automated decision that has a legal or similarly significant effect on you.

Where your information is stored

Lineup's application and its database run in the United States (Oregon), and the images you upload are stored there too. So everything Lineup holds sits outside both the European Economic Area and New Zealand. That is a deliberate choice — it is where our hosting provider gives us the service we need — and it means every provider below is a transfer that has to be justified rather than an incidental one.

• Render — transfers are made under the European Commission's standard contractual clauses.
• Resend — transfers are made under the European Commission's standard contractual clauses.
• Cloudflare — transfers are made under the European Commission's standard contractual clauses.

For the purposes of the Privacy Act 2020 we have also satisfied ourselves that each provider is required to protect the information to a standard comparable to that Act's. You can ask us for a copy of the safeguards we rely on at [email protected].

Email we send you

About your account. Some email is part of having an account and cannot be turned off while you have one: confirming your address when you sign up, the code that resets your password, and notice of a material change to these documents or of Lineup shutting down. There are no others.

About Lineup. We also send the occasional email about the service itself — a new feature, a change to how something works, an invitation to come back and look at the directory. Having an account is what puts you on that list; we do not add addresses from anywhere else, we never send on behalf of anyone else, and we do not give your address to an advertiser. We send these on the basis of our legitimate interest in keeping members informed about the directory they joined, and we tell you at sign-up that they will arrive.

Stopping them. You have an unconditional right to object to this kind of email, and objecting ends it — we do not weigh it against anything. Every one of those emails carries an unsubscribe link that works without signing in, and where your mail app offers its own unsubscribe button, that works too. There is also a switch in the account section at the foot of your profile, which you can turn back on if you change your mind. We act on an unsubscribe immediately and always within five working days. Unsubscribing stops this kind of email only; account email keeps working, and your profile and projects are untouched.

Cookies and local storage

Lineup sets a cookie to keep you signed in, and a short-lived signed copy of your session so that most pages need not consult the database to recognise you. Your light-or-dark theme preference is kept in your browser's local storage. There are no advertising or analytics cookies, and nothing here tracks you anywhere else.

All of these are strictly necessary to provide the service you asked for, which is why Lineup has no cookie consent banner: there is nothing on this site that we would need your permission to set, and we would rather not have one than ask you a question with only one honest answer.

How long we keep it

Your account, profile and projects are kept for as long as you have an account, because that is what makes the directory work. Closing a project keeps its page in place so that it can be reopened; deleting one removes its page from the directory but leaves the underlying row in our database, so if you want a deleted project erased outright, ask us and we will do it.

Server logs are written to our hosting provider's log stream and kept only as long as that provider retains them — currently a matter of days. Lineup itself copies them nowhere else. Sessions expire on their own, and expired sessions and used password-reset codes are removed.

You can delete your account yourself from the account section at the foot of your profile; doing so removes your account, profile, projects and uploaded images, and we keep only what we are required to retain by law.

Your rights

You may ask us to confirm whether we hold personal information about you and to give you a copy of it; to correct anything wrong; to erase it; to restrict what we do with it while a question about it is open; to object to processing we do on the basis of a legitimate interest, including, without any qualification at all, email about Lineup; and to receive the information you gave us in a portable, machine-readable form. Where we rely on your consent — project promotion is the only place we do — you can withdraw it at any time, and withdrawing it does not undo anything done beforehand.

You can do most of this yourself: almost every answer is editable on your profile and project pages, the broadcast switch is in your account section, and account deletion is there too. For anything else — a copy of what we hold, a correction you cannot make yourself, an erasure — write to [email protected]. We will answer within one month, and will tell you if we need longer and why. We do not charge for this.

Complaints

If you think we have handled your information badly, please tell us first at [email protected] — most things are quicker to fix directly. If that does not resolve it, you can complain to a supervisory authority, and which one depends on where you are rather than where we are.

• In New Zealand: the Office of the Privacy Commissioner at privacy.org.nz.
• In the European Union or European Economic Area: the Office of the Data Protection Ombudsman in Finland at tietosuoja.fi, which is our lead authority — or the authority in the country you live or work in, if that is easier for you.

Security

Passwords are stored as hashes and never in a readable form. Password reset codes are stored only as hashes and expire after a few minutes. Connections to Lineup are encrypted. No system is perfectly secure. If there is a breach that puts your rights at risk we will report it to the Office of the Data Protection Ombudsman without undue delay and, where feasible, within 72 hours of becoming aware of it, and where the risk to you is high we will tell you as well. We will notify the Office of the Privacy Commissioner on the terms the Privacy Act sets for a breach likely to cause serious harm.

Age

Lineup is for people who are at least 18 years old. We do not knowingly collect information from anyone younger; if you believe we have, tell us and we will remove it.

Changes

When this policy changes we update the date at the top of it. If a change materially affects how your information is used we will tell members by email before it takes effect.

Contact

Noaur Group Oy, business ID 3469604-2, Nuikontie 74, 21140 Rymättylä, Finland. [email protected]. Our terms of service describe the agreement under which Lineup is provided.