Privacy Policy

1. Customers: what we collect

• Account details: name, company name, email address, and your encrypted password (handled by our authentication provider; we never see it in plain text).
• Billing: handled by Stripe. We receive your plan, subscription status, billing dates and a Stripe customer ID. We never see or store your full card number.
• Usage: which investors you unlock, how many unlocks and exports you use, and your subscription state.
• Technical: standard server logs (IP address, browser, pages requested) kept by our hosting provider, and an irreversibly hashed network address used only to rate-limit our public forms.
• Cookies: we use only strictly necessary cookies to keep you signed in. We do not currently use advertising or analytics cookies.

2. Customers: how we use it

• To provide the Service, enforce plan limits, and process payments (contract).
• To send account and transactional emails such as verification, password reset and receipts (contract).
• To keep the Service secure, prevent abuse and comply with law (legitimate interests, legal obligation).

3. Investors: information in our database

Our database holds business information about investor firms: firm name and type, stage and industry focus, typical cheque size, countries of investment, office address, website and social links, and a description. For some firms it also holds one named contact person's name, job title, business LinkedIn profile and business email address.

We compile this from publicly available sources. We do not collect sensitive categories of personal data.

We process it so founders can research and contact investors about fundraising. Where GDPR or similar law applies, our lawful basis is legitimate interests: investors publish this information to be found by founders, and we limit contact details to business ones. This section serves as our notice to those individuals.

4. Investor rights and removal

If you are listed, you can ask us to remove your contact details or the entire firm listing, or to correct a record, using our removal request form or by emailing us. We verify each request by email, complete it, and confirm.

To stop a removed record returning in a later data update, we keep a minimal suppression entry (the record identifier and, where relevant, the email address). We use it only for that purpose.

5. Who we share data with

We do not sell personal data. We use these service providers (processors) who handle data only to provide their service to us:

• Supabase: database and authentication.
• Vercel: website hosting.
• Stripe: payments and billing portal.
• Resend: sending transactional email.
• Cloudflare: DNS and email forwarding for our domain.
• Google: when investor lists load, your browser requests firm logos from Google's favicon service, which reveals the firm's domain and your IP address to Google.
• Professional advisers, and authorities where the law requires.

6. International transfers

Our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards such as standard contractual clauses.

7. How long we keep data

• Account data: while your account is active, then 12 months, unless we must keep it longer by law.
• Billing records: as long as tax and accounting law requires.
• Investor records: until they are removed or updated. Suppression entries are kept so removals stick.
• Removal and privacy requests: 3 years, as proof we handled them.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our use of your personal data, to data portability, and to withdraw consent. California residents have rights under the CCPA/CPRA, including to know, delete and correct, and we do not sell or share personal information for advertising.

To use a right, email hello@seedlist.app (investors can also use the removal form). We respond within the time the law requires, typically one month. You can also complain to your local data protection authority.

9. Security

We use access controls, encryption in transit, row-level database security so customers can see only their own account data, and least-privilege access. No system is perfectly secure; we will notify affected people and authorities of breaches as the law requires.

10. Children

The Service is not for anyone under 18 and we do not knowingly collect their data.

11. Changes and contact

We may update this policy and will post the new date above, notifying you of material changes. Questions: hello@seedlist.app, Truthdatalabs LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA.