Privacy Notice
Last updated 14 October 2026
This notice explains what personal data the CorporateVenture AI platform handles, why, and what rights individuals have in relation to it.
01Who is responsible
For data about your own users — the people in your organisation who sign in — we act as the controller in respect of account administration and security, and as a processor in respect of the pipeline data you put into the platform.
For data about third parties that you record in the platform, such as contacts at companies you are evaluating, you are the controller and we process it on your instructions.
02What we collect
The platform handles the following categories of personal data.
- Account data: name, work email address, organisation, role and preferences.
- Authentication data: credentials in hashed form, sign-in events and session records.
- Security data: IP address, user agent, and records of access and privilege events.
- Usage data: actions taken in the platform, with an actor and a timestamp, for audit purposes.
- Pipeline data you provide: companies, contacts, conversations, terms and decisions.
03Why we use it
Personal data is used only for the following purposes.
- To provide the platform and the features you use.
- To authenticate users and protect accounts against unauthorised access.
- To maintain the audit trail that makes the platform usable in a governed environment.
- To monitor security, detect abuse and investigate incidents.
- To communicate with you about your account and material service changes.
04What we do not do
We place deliberate limits on our own use of your data.
- We do not sell personal data.
- We do not share your pipeline with other customers.
- We do not use your pipeline data to market to your counterparties.
- We do not grant standing access to your data to anyone outside your organisation.
05Isolation and security
Access to your data is evaluated at the data layer against the signed-in identity on every request, so records belonging to one organisation are not reachable by another.
Data is encrypted in transit and at rest. Administrative capability is restricted, separated from the product surface, and its use is recorded.
06Processors and sub-processors
We rely on a small number of infrastructure and model providers to operate the platform. They are bound by contract to process data only on our instructions and to maintain appropriate security.
A current list of sub-processors is available on request from your account contact.
07Retention
Account and pipeline data is retained for as long as your account is active, and then for the period needed to meet legal and audit obligations.
Audit and security records are retained longer than operational data, because their purpose is to remain available for later review.
08International transfers
Data may be processed in jurisdictions other than your own. Where it is, we rely on appropriate safeguards for the transfer, and will identify the relevant mechanism on request.
09Individual rights
Depending on jurisdiction, individuals may have rights to access, correct, delete, restrict or object to processing of their personal data, and to receive a copy of it.
If you are a user of a customer account, direct your request to that organisation in the first instance, since they control the pipeline data. We will assist them in responding.
10Changes and contact
We will update this notice when our practices change, and will give notice of material changes.
Questions, requests and complaints about privacy should be directed to your account contact, who will route them to the responsible team.