Privacy Policy | Colorado Startups

Colorado Startups, Ltd. runs this website for a community of entrepreneurs building companies in Colorado, and for the wider startup community around them. This page says what we collect, why, and what you can ask us to do with it.

The short version

We collect what you type into a form or ask Resourcus, and the few things listed under “What happens automatically”.
We do not sell or rent your information, and we do not use advertising trackers.
Our site analytics set no cookies.
You can unsubscribe from any email in one click, and you can ask us to delete what we hold about you.

What we collect, and why

The Startupers newsletter. When you sign up, we collect your email address and send it to Kit, the service that sends our newsletter. Kit emails you a confirmation link first, and nothing else arrives until you click it. This website does not keep a copy of your address. We use it only to send Startupers and occasional news from Colorado Startups.

Leaderboard nominations. The nomination form collects the company’s name, website, HQ city and county, and founding year. It also asks whether the company is private, independent and for-profit, its sector, its base-year and current-year revenue, and its full-time-equivalent headcount. From you, it collects your name and email, your consent to publish and your signed attestation. We store nominations in our database on Cloudflare (D1), and we do not store your IP address with them.

How we use what you send:

We use nomination data only to verify and rank companies for the Leaderboard.
We never use it for investment sourcing, and we never share it with investors.
Only Paul Foley, Founder and President of Colorado Startups, can see it.
When an edition is assembled, we email you to ask for documents that verify the figures.
We delete the revenue figures and headcount 90 days after the edition they feed is published.
On the same day, we delete your name and email from the nomination, and the emails we exchanged about it, including your documents (our commitment).
If we decline your nomination, we delete the figures, your name and your email when we decide (our commitment).
If your nomination is still waiting for an edition when it is 180 days old, a weekly job deletes the figures, your name and your email (our commitment). No nomination waiting for an edition keeps its figures, name or email longer than 187 days (our commitment).
Deleted nomination details can stay in Cloudflare’s restore points of our database for up to 30 days (Cloudflare’s D1 Time Travel documentation, read 2026-10-18).
If the company is listed, we may publish its name, website, sector, HQ city and a revenue range, as you agreed on the form.
We take the HQ city from the company’s own website or press coverage, not from the form. We use the county you give only to check that the company is headquartered in Colorado, and the Leaderboard does not show it.
We store the HQ city you give with the nomination. The notice email Paul gets about a new nomination shows the city and county. We use the city, with the county, to check that the company is headquartered in Colorado. The form also uses the city to fill in the county.
A listing also shows facts we find in public sources, such as the founding year, with a link to each source.
The Leaderboard shows revenue as a range, never an exact figure.

Resource suggestions. The suggest form on the Ecosystem Canvas collects the resource’s name and a link to its website. It also takes, if you choose, the stage it helps most, its city, a note on what it does for founders, and your email. We store suggestions in our database on Cloudflare (D1), and we do not store your IP address with them.

A person reviews every suggestion before it goes into the Canvas.
We keep your suggestion, and your email if you give one, only to review this suggestion.
We use your email only to ask a follow-up question about this suggestion.
Your email is kept in one place, the suggestion record, and we delete it from there once we accept or decline the suggestion.
The site never visits the link you send.

Applications. The seat application form (/get-involved/apply/) collects the seat you choose, your name, your email and where you are based. It also collects why you are excited about the seat, and a link to each Claude Academy completion badge the seat needs. If you choose, it takes your LinkedIn profile and anything else you want us to know. We store applications in our database on Cloudflare (D1), and we do not store your IP address with them.

We use your application only to consider you for the seat you chose.
Paul Foley reads every application. We never share it outside Colorado Startups.
We contact you about this seat only, as you agreed on the form.
The site stores your links as text and never visits them. Paul opens your badge links himself to check them.
Once Paul decides, we delete your name, contact details and answers. We keep only the seat, the dates and the outcome.
If we have not decided within 180 days, a weekly job declines the application and deletes it the same way. No applicant’s name, contact details or answers stay in our database longer than 187 days (our commitment). The seat, the dates and the outcome stay, as for a decided application.
Cloudflare keeps restore points of our database for 30 days (Cloudflare’s D1 Time Travel documentation, read 2026-10-18). A deleted application can stay in those restore points for up to 30 days after we delete it.
Each application sends Paul a short notice email with the seat and a record number, never your details. That email stays in his inbox.
If the form sends you back with an error, your browser keeps your answers in this tab’s session storage so you can fix and resend them. They never leave your browser, and they clear when you close the tab or your application goes through.
If you take the seat, we name you on the Team page only with your agreement.

Questions to Resourcus. Resourcus is an AI agent that answers questions about Colorado startup resources. We keep each question, its answer and a random session identifier for 90 days, so we can check answers and improve the directory, and then we delete them. We do not store your IP address with them. Please do not put personal details in a question.

Joining our Slack. Joining starts with a short Google Form. Google hosts the form, and Google’s privacy policy covers your visit to it. The form says what it asks for and why.

Communitas in our Slack. Communitas is an AI agent in the Colorado Startups Slack. It sends one welcome message when you join, and it reads only messages that mention it. When it passes a question to Resourcus, it replaces your Slack user ID with a one-way code first. Slack’s own privacy policy covers your Slack account.

Messages to us. When you write to info@coloradostartups.org, we keep the conversation so we can reply and follow up. At our monthly check, we delete each conversation whose last message is more than 12 months old (our commitment). The nomination, suggestion and application forms also email Paul a short notice of each new entry. A notice names the company, resource or seat and gives a record number. It never includes your name or contact details.

What happens automatically

Bot protection. Our forms and the Resourcus question box use Cloudflare Turnstile to check that a person, not a bot, is using them. Turnstile receives your IP address from your browser when the check runs, and from us when we confirm the result. Cloudflare uses it to tell people from bots and to improve its bot detection, not to identify, profile or target you (Cloudflare’s Turnstile Privacy Addendum, read 2026-10-22).
Abuse limits. We use your IP address for a short time to limit how often a form can be sent from one connection. We do not store it with anything you send.
Request logs. Cloudflare logs each request that reaches our server code, with its headers, which include your IP address, and the approximate location Cloudflare matches to that address. That code runs for every address under /api/, which carries our forms, Resourcus questions and security reports. It also runs for some requests to addresses where no page or file exists. Requests for our pages and files skip it and are not in these logs. We use these logs only to find and fix errors, and Cloudflare keeps them for up to 7 days (Cloudflare’s Workers Logs documentation, read 2026-10-22).
Security reports. If your browser blocks something on our pages for security reasons, it may send us a report of what was blocked and on which page. We keep only the rule that was broken, the site or type of content it blocked, and the path of our page. We count repeats of the same report instead of storing each one. These records live in our database on Cloudflare (D1), with no IP address, and we use them to fix our site. A weekly job deletes each type of report that no browser has sent in the last 90 days (our commitment).
Analytics. We use Cloudflare Web Analytics, which counts visits without cookies and without tracking you across other sites.
The event calendar. Our events page shows a Google Calendar. Google provides it and may collect information when it loads, under Google’s privacy policy.

Who helps us run the site

Service	What it does for us
Cloudflare	Hosts the website, runs our forms and our database, protects forms from bots, counts visits, and runs the AI models behind Resourcus (Workers AI)
Kit	Sends the Startupers newsletter and holds the subscriber list
Slack	Hosts our community workspace, where Communitas runs
Google	Our email (Google Workspace), the embedded event calendar, and the form you fill in to join our Slack (Google Forms)

Each of these services handles information under its own privacy policy. We do not share your information with anyone else unless the law requires it.

Your choices

Unsubscribe. Every newsletter has an unsubscribe link at the bottom. One click takes you off the list.
Delete or correct. Email info@coloradostartups.org and tell us what you would like changed or deleted. We will answer within 30 days (our commitment).
Ask what we hold. Email the same address, and we will tell you what we have about you.

Changes to this policy

When we change this policy in a way that matters, we update the date at the top of this page and tell newsletter subscribers in our next email.

November 2, 2026. The nomination form now asks for the company’s HQ city and its founding year. We added that we store the city with the nomination, show it in Paul’s notice email and use it to check the HQ.

October 22, 2026. We named the Google Form that starts joining our Slack. We added how long we keep a nominator’s name and email, messages to info@coloradostartups.org and security reports. A weekly job now deletes the details of unclaimed nominations and old security reports, instead of a person once a month. We added the request logs Cloudflare keeps for our server code, which include your IP address. We added that Cloudflare Turnstile receives your IP address. We also made clear that the Leaderboard shows a company’s HQ city from public sources, never the county from the form.

Contact

Colorado Startups, Ltd.
951 20th Street, Unit 2194
Denver, CO 80201

info@coloradostartups.org