Privacy Policy

1. Controller

The controller responsible for data processing on this platform is InvesTTable GmbH, Burgweg 4, 94469 Deggendorf (Bavaria), Germany, registered at Amtsgericht Deggendorf, HRB 6611.

For all privacy-related questions you can reach us at privacy@invest-table.com.

2. Data we collect

Account data: name, email address, password hash, and account role (investor or startup) when you register. Investor verification data: company name, registered seat, and registry or VAT ID, which we cross-check against public registers.

Startup profile data: the company information founders enter during onboarding, including location, financial metrics, uploaded documents (pitch deck, cap table, financial reports), and any team member details.

Usage and technical data: server logs, IP address, browser type, and product analytics events (only after you consent via the cookie banner). When you use a sign-in, sign-up or password-reset form, Cloudflare Turnstile reads the same technical data (IP address, browser signature, and the page requested) to confirm the request comes from a real browser. Payment data is processed by Stripe; we never store card numbers ourselves.

3. Purposes and legal bases

We process your data to provide the platform (Art. 6(1)(b) GDPR, performance of contract), to verify investors and keep the platform trustworthy (Art. 6(1)(f), legitimate interest), to keep the platform secure and available against attacks and automated abuse (Art. 6(1)(f), legitimate interest), to bill subscriptions (Art. 6(1)(b)), and to comply with legal obligations (Art. 6(1)(c)).

Product analytics and marketing tools run only with your consent (Art. 6(1)(a)); you can withdraw consent at any time via the cookie settings.

4. Processors and third-party services

We use the following processors under Art. 28 GDPR data processing agreements: Supabase (authentication, database, and file storage, EU region), Stripe (payment processing), Vercel (hosting and edge delivery), Resend (transactional email), Google Workspace (business mailboxes, so mail you send to our contact addresses is stored there), Upstash (rate limiting and session store), Cloudflare (domain registrar and authoritative DNS, plus the Turnstile human-verification widget on our authentication forms, which processes IP addresses and request metadata to tell real browsers from automated ones), HubSpot (EU region; the marketing tracking script and booking scheduler load only after consent, while contact details you submit through a signup form are synced to our CRM as part of our business relationship with you), and PostHog (product analytics, EU region, consent-gated).

Some platform features rely on services that receive no personal data by design. Location entries are geocoded via OpenStreetMap Nominatim (only the address you enter is transmitted). Sector, geographic, and regulatory context is retrieved through the Tavily search API (only location and sector terms are transmitted, never account or contact data). Our AI analysis features (geo and market scoring, and the Early Radar assessment for pre-revenue startups) use Anthropic and follow the same principle: the model receives business context only (sector, region, and the profile descriptions provided), the company name is withheld, and the model is instructed to disregard and never reproduce any personal names or contact details. YouTube video embeds and the HubSpot booking scheduler use a click-to-load facade, so no connection to Google or HubSpot is made until you actively start a video or load the scheduler. We do depend on Google Search Console, Google's own analytics service for search performance, to see which search queries lead people to InvesTTable and how our pages rank. Google reports this to us as aggregated statistics that we cannot trace back to an individual visitor, and it sets no cookies on this site. We run no advertising or retargeting pixels.

The complete and current list of these services, including where each one processes data and which safeguard covers a transfer outside the EU, is maintained at invest-table.com/subprocessors.

5. Cookies and consent

Details on the cookies we set, their lifetimes, and how to change your choices are described in our Cookie Policy. Strictly necessary cookies run without consent: they keep your session active and remember whether you chose to stay signed in. All marketing and analytics cookies load only after you opt in.

6. Data retention

We keep personal data only as long as needed for the purposes above: account data until you delete your account, invoices and booking records for 10 years under Sec. 147 AO, other commercial correspondence for 6 years under Sec. 257 HGB, and server logs for 30 days. Uploaded startup documents are deleted when the listing or account is removed.

7. International transfers

Our core infrastructure runs in the EU. Where a processor transfers data to a third country (for example Stripe, Google or Cloudflare, all USA), the transfer is safeguarded by EU Standard Contractual Clauses or an adequacy decision (EU-US Data Privacy Framework).

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interest (Art. 21).

You also have the right to lodge a complaint with a supervisory authority. The authority competent for us is the Bayerisches Landesamt fuer Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

9. Data security

All traffic is TLS-encrypted, access to production data is restricted by row-level security policies and role-based access, and uploaded documents are stored in access-controlled buckets. Sign-in, sign-up and password-reset requests pass a human-verification check before they reach our authentication provider, and denial-of-service protection for the platform is provided by our hosting provider. We review our security measures regularly.

10. Changes to this policy

We will update this policy when our processing changes, and will inform you about material changes via the platform or by email. The current version is always available at invest-table.com/privacy.

11. Where the data comes from

Most data reaches us from you directly. Two cases do not, and Art. 14 GDPR requires us to say so. First, investor verification: we cross-check the company name, registered seat and registry or VAT identifier you submit against publicly accessible commercial and VAT registers. Second, company profiles: a founder may enter details about team members, so we receive data about those people from their own company rather than from them.

If you are named on a company profile and want that entry corrected or removed, write to privacy@invest-table.com. We forward the request to the company and remove the entry ourselves where the company does not act.

12. Automated decision-making

Scores, rankings, benchmarks and AI-assisted analysis on this platform are computed on company data: sector, stage, location, financial metrics and the business text a founder wrote. No natural person is scored, ranked or profiled, and personal identifiers are removed from free text before any AI processing.

There is no automated decision within the meaning of Art. 22(1) GDPR that produces legal effects concerning you or similarly significantly affects you. Investor verification is reviewed manually before an account is approved or rejected.

13. Data protection officer

We have not appointed a data protection officer. The thresholds in Sec. 38(1) BDSG are not met, our core activity is not the regular systematic monitoring of individuals on a large scale, and we do not process special categories of data on a large scale. Privacy requests are handled by the management directly at privacy@invest-table.com.