Privacy

This website

By default this site sets nothing. Until you choose, no analytics load and nothing you do here is recorded.

Cookies and analytics. With your consent, given on the banner, the site and the members’ app (app.bootstrappedmakers.com) use PostHog, a product-analytics tool hosted in the EU, to understand how they are used: page views, which buttons are clicked, and session replays. In the app, events are linked to your account so I can see where people get stuck, from signing in to joining; everything you type is hidden in replays, and the payment window is never recorded. It is the same setup as agentaos.ai. Decline and nothing loads. One choice covers the site and the app; it is remembered in a cookie on bootstrappedmakers.com, and you can change it by clearing site data.

Fonts are loaded from Google Fonts, which means Google receives your IP address in order to serve the font files. If you would rather that didn't happen, a content blocker will stop it and the site will still work with your system fonts.

The site is hosted on Cloudflare Pages, which keeps standard server logs including IP addresses for security and abuse prevention, under Cloudflare's own terms.

If you joined the waitlist before 7 October 2026

You sent me: your product link, what you charge, who has paid you or nearly did, your name, and a way to reach you. That arrived by email or direct message and is kept in my mailbox and in a private spreadsheet of members.

Your entry (name, email, what you are building, stage, your referral code and the code you arrived with, and the time) is stored on Cloudflare, in the EU, for two purposes only: to count the list and to match referrals. The waitlist closed when the community opened; the entries are deleted on request.

I use it to decide whether the community fits and to run it. I do not sell it, share it, add you to any mailing list, or pass it to anyone else. If you are not accepted, I delete it within 30 days.

When you're a member

I keep: your name, your contact detail, your product link and price, which live workshops you attended, and your stage (no checkout / live / paying customers). This is what lets the community work — it's how I know who to chase on a Monday.

Calls are recorded and shared only inside the community. Recordings are deleted after twelve months.

The members’ chat is a private Telegram group. When you join it, the app stores your Telegram user ID and username so that one membership lets in one Telegram account, and so that the bot can remove you when your membership ends. Other members see what you post there, under your Telegram name. Telegram’s own privacy policy applies to the group itself.

When you save a seat for a live workshop, I add your name and email to the event on Luma, which then emails you the call link and reminders.

Your account and the services behind it

Your account is your email address. You sign in with a one-time code sent to it; there is no password. The app keeps your email, your name if you add one, your answers to the three questions about your product, which playbooks you have finished, your membership dates, and, if you cancel, the reason you give.

These services handle that data for me, each only for its own job:

• Supabase: the database behind the app, hosted in the EU (Ireland).
• Vercel: hosts the app; it runs in the EU (Frankfurt).
• Resend: sends the app’s emails, such as sign-in codes, receipts of your actions and renewal reminders.
• Cloudflare Turnstile: checks that a sign-in is made by a person and not a bot.
• Kit: sends Keep Going, the newsletter, only if you tick the box for it. Every issue has a one-click unsubscribe.
• Telegram and Luma: the members’ chat and the live workshops, as described above.
• AgentaOS: payments, as described below.

Some of them are based outside the EU. Where your data leaves the EU, it does so under the European Commission’s standard contractual clauses or an adequacy decision, as each provider sets out in its own terms.

Payments

Payment processing: through AgentaOS, contact@agentaos.ai. Seller of record: Aristokrates OÜ, Reg. 16961316, Tornimäe tn 5, 10145 Tallinn, Estonia. Card details are handled by the payment processor and never reach me — I see the amount, the date, your name and your email, which is what I need to issue a receipt and meet Estonian accounting requirements. Records required for accounting are kept for seven years.

Your rights

Under the GDPR you can ask for a copy of what I hold about you, ask me to correct it, or ask me to delete it. Email panche@bootstrappedmakers.com and you'll get an answer from a person, normally within a few days and always within 30. There is no form to fill in.

Deletion applies to everything except records I am legally required to keep for accounting, and messages you posted in the community that other members have already seen.

If you think I've handled your data badly, tell me first — and if that doesn't resolve it, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the supervisory authority in your own country.

Controller

Panche Isajeski · panche@bootstrappedmakers.com