Privacy Policy

• Account: email, password hash, display name, role, optional handle.
• Profile: sectors, region, title, track record, logos, the things you choose to write about yourself.
• Application: the membership-review answers you submit (full name, what you do, qualifications, who you can reach, payout note), kept private and used to vet your account.
• Verification (when required for larger deals): a photo of your ID, a selfie, an address. Handled by our verification partner; we do not store the raw documents.
• Need and deal content: what you post, your responses, your in-app messages.
• Usage: log entries, IP address, device, pages viewed (only via cookies you've consented to).
• Marketing preferences: what you've said yes or no to.

• Contract: running your account, the marketplace, your deals.
• Legitimate interests: keeping the platform secure, preventing fraud and abuse, vetting members at a basic level, debugging.
• Consent: non-essential cookies, marketing emails, marketing pixels. You can withdraw consent at any time.
• Legal obligation: tax, accounting, responding to lawful requests.

Members see only what we show on your public profile (first name + initial, role, region, sectors, vetted flag). Real names, contact details, and LinkedIn stay private until a deal is live and you've both accepted the Deal & Fee Agreement.

We use the following processors:

• Supabase, database, authentication, file storage (EU region).
• Resend, transactional and (if you opt in) marketing email.
• Google Analytics 4, analytics, only loaded if you accept analytics cookies.
• Meta Pixel / TikTok Pixel, measuring ads, only loaded if you accept marketing cookies.
• [Identity verification partner], only when KYC is required for larger deals.

• Account and profile: while your account exists, plus [12 months].
• Deal records and messages: [7 years] for tax and dispute reasons.
• Application answers: [3 years] after decision.
• Verification result (verified yes/no): with your account; raw documents are not stored by us.
• Marketing consent log: [6 years].

Under UK GDPR you can ask us to give you a copy of your data; correct it; delete it; restrict or object to processing; or export it. The fastest way is Account & data in your account, where you can export everything and delete your account.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

We host on managed infrastructure with row-level security and access scoped to the signed-in user. Passwords are hashed. Service-role keys are kept off the client. We use HTTPS end-to-end. No platform is bulletproof; if something serious happens we'll tell you and the ICO as required.

Our infrastructure runs in the UK / EU. Some processors (e.g. analytics) may transfer data to the US under appropriate safeguards (UK IDTA / SCCs).

We'll update this policy as the platform evolves. Material changes are notified by email and in-app.