Privacy Policy

1. Controller

The controller responsible for data processing on this platform is [Company name, legal form], [Street, ZIP City, Country], registered at [Commercial register / court, registration no.].

For all privacy-related questions you can reach us at privacy@invest-table.com.

2. Data we collect

Account data: name, email address, password hash, and account role (investor or startup) when you register. Investor verification data: company name, registered seat, and registry or VAT ID, which we cross-check against public registers.

Startup profile data: the company information founders enter during onboarding, including location, financial metrics, uploaded documents (pitch deck, cap table, financial reports), and any team member details.

Usage and technical data: server logs, IP address, browser type, and product analytics events (only after you consent via the cookie banner). Before a request reaches our servers it passes a security layer in front of the platform, which reads the same technical data (IP address, browser signature, and the page requested) to filter attacks and automated traffic. Payment data is processed by Stripe; we never store card numbers ourselves.

3. Purposes and legal bases

We process your data to provide the platform (Art. 6(1)(b) GDPR, performance of contract), to verify investors and keep the platform trustworthy (Art. 6(1)(f), legitimate interest), to keep the platform secure and available against attacks and automated abuse (Art. 6(1)(f), legitimate interest), to bill subscriptions (Art. 6(1)(b)), and to comply with legal obligations (Art. 6(1)(c)).

Product analytics and marketing tools run only with your consent (Art. 6(1)(a)); you can withdraw consent at any time via the cookie settings.

4. Processors and third-party services

We use the following processors under Art. 28 GDPR data processing agreements: Supabase (authentication, database, and file storage, EU region), Stripe (payment processing), Vercel (hosting and edge delivery), Strato (domain registration and business email hosting), Resend (transactional email), Upstash (rate limiting and session store), a content delivery and security provider that shields the platform against denial-of-service attacks and automated abuse (it processes IP addresses and request metadata in order to filter traffic before it reaches us), HubSpot (EU region; the marketing tracking script and booking scheduler load only after consent, while contact details you submit through a signup form are synced to our CRM as part of our business relationship with you), and PostHog (product analytics, EU region, consent-gated).

Some platform features rely on services that receive no personal data by design. Location entries are geocoded via OpenStreetMap Nominatim (only the address you enter is transmitted). Sector, geographic, and regulatory context is retrieved through the Tavily search API (only location and sector terms are transmitted, never account or contact data). Our AI analysis features (geo and market scoring, and the Early Radar assessment for pre-revenue startups) use Anthropic Claude and follow the same principle: the model receives business context only (sector, region, and the profile descriptions provided), the company name is withheld, and the model is instructed to disregard and never reproduce any personal names or contact details. YouTube video embeds and the HubSpot booking scheduler use a click-to-load facade, so no connection to Google or HubSpot is made until you actively start a video or load the scheduler. We do depend on Google Search Console, Google's own analytics service for search performance, to see which search queries lead people to InvesTTable and how our pages rank. Google reports this to us as aggregated statistics that we cannot trace back to an individual visitor, and it sets no cookies on this site. We run no advertising or retargeting pixels.

5. Cookies and consent

Details on the cookies we set, their lifetimes, and how to change your choices are described in our Cookie Policy. Strictly necessary cookies run without consent, and this includes the short-lived cookie our security provider uses to tell real browsers apart from bots. All marketing and analytics cookies load only after you opt in.

6. Data retention

We keep personal data only as long as needed for the purposes above: account data until you delete your account, billing records for the statutory retention periods ([6/10 years] under German commercial and tax law), and server logs for [X days]. Uploaded startup documents are deleted when the listing or account is removed.

7. International transfers

Our core infrastructure runs in the EU. Where a processor transfers data to a third country (for example Stripe, Google, or our content delivery and security provider, all USA), the transfer is safeguarded by EU Standard Contractual Clauses or an adequacy decision (EU-US Data Privacy Framework).

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing based on legitimate interest (Art. 21).

You also have the right to lodge a complaint with a supervisory authority, in particular the data protection authority of [competent federal state / country].

9. Data security

All traffic is TLS-encrypted, access to production data is restricted by row-level security policies and role-based access, and uploaded documents are stored in access-controlled buckets. Public traffic is additionally filtered in front of the platform, where a security provider absorbs denial-of-service attacks and blocks automated abuse before requests reach our infrastructure. We review our security measures regularly.

10. Changes to this policy

We will update this policy when our processing changes, and will inform you about material changes via the platform or by email. The current version is always available at invest-table.com/privacy.