_Last updated: 31 October 2026 · Effective: 31 October 2026 · Version 1.0_
EasyFundraise ("EasyFundraise", "we", "us") operates easyfundraise.com and the EasyFundraise application (the "Service"). This Policy explains what personal data we collect, how we use it, and your rights. It applies to (a) users of the Service ("Users") and (b) investors whose professional information appears in our investor directory ("Investors").
## 1. Who we are and how to contact us EasyFundraise is the data controller for the personal data described in this Policy. We are based in the United Kingdom and this Policy is governed by the laws of England and Wales. For any privacy question or request, contact privacy@easyfundraise.com.
## 2. Data we collect from Users - Account data: name, email address and profile picture from Google Sign-In; workspace details; company information you enter or that we extract from your uploaded documents (e.g. pitch decks). - Google account data (with your consent): when you connect Gmail we access only the scopes you grant: sending email on your behalf, reading and modifying email threads that the Service started or that are replies to them, and basic settings (e.g. your signature). We do not read, store or analyse unrelated email. Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements; we never use Google user data for advertising, never sell it, and only humans access it for security, legal compliance, or with your explicit permission for support. - Usage data: pages viewed, searches, features used, device/browser information, IP address, approximate location, timestamps, and diagnostic logs. - Content you create: emails, notes, funnel entries, data-room content, agent instructions, newsletters. - Billing data: handled by our payment processor; we store plan, status and invoice references, not full card numbers.
## 3. Data we hold about Investors (the investor directory) Our directory contains professional information about investors compiled from publicly available sources, including firm websites, press releases, news articles, conference listings, public professional profiles, and public web research. Typical fields: name, role, firm, professional email, professional social profile links, location (city/country), investment focus, stages, check size, public portfolio and public statements about investment thesis, and a professional photo where published by the firm. - We do not collect private or non-professional information (home address, family, personal phone, personal social activity). - We do not scrape data behind logins or paywalls. - We may compute aggregated, anonymised engagement indicators (e.g. how often investors respond to outreach on the platform). These are never shown with the identity of any User and are only displayed when derived from a minimum number of workspaces. - Lawful basis: our legitimate interests in operating an investor-discovery service for founders, balanced against investors' interests through minimisation, professional-only scope, transparency and an easy removal mechanism. Where required, we rely on applicable exemptions for publicly available business information. - Investor rights: investors can view, correct or remove their listing at any time using the form at easyfundraise.com/investor-request. We action removal requests within 72 hours and add the person to a suppression list to prevent re-ingestion.
## 4. How we use data Provide and improve the Service; generate personalised investor outreach drafts for you; deliver and track emails you choose to send (open and reply tracking, which you may disable); power your personal AI agent (your workspace data only); prevent abuse, fraud and scraping; comply with law; communicate service information; aggregated analytics.
## 5. AI processing We use third-party and self-hosted AI models to analyse your documents, draft emails and provide recommendations. Your content is processed to deliver the feature you requested; we configure third-party model providers under agreements that prohibit training on your data. Automated suggestions are not legally significant decisions; you remain in control of what is sent.
## 6. Email tracking Outreach emails may include a small tracking image so you can see when an email is opened. We do not rewrite or track links. We record the time, approximate location (derived from IP) and device type of opens. You may disable tracking per workspace. Recipients can opt out of further messages by replying; we honour opt-outs within 24 hours and add them to your exclusion list.
## 7. Sharing Sub-processors that help us run the Service: our cloud hosting and database provider, Google (sign-in and the Gmail API, at your request), Anthropic (AI drafting and analysis), and Stripe (payments). Each is bound by a data processing agreement; professional advisers; authorities where legally required; a successor in a merger/acquisition (with notice). We do not sell personal data and we do not allow Users to export the investor directory in bulk.
## 8. International transfers Data may be processed in the US, EU and UK. Transfers are protected by Standard Contractual Clauses, the UK IDTA/Addendum, or adequacy decisions as applicable.
## 9. Retention Account data: life of the account + 90 days (export window), then deleted or anonymised. Gmail thread data: message identifiers and extracted signals retained while you use the feature; message bodies are not stored beyond what is needed to display your own sent threads and can be purged by you at any time. Tracking events: 24 months. Investor directory records: while publicly relevant, reviewed periodically, removed on request. Audit/security logs: up to 2 years. Backups: rolling 35 days.
## 10. Security Encryption in transit and at rest; encryption of Google access tokens with AES-256; role-based access; two-factor authentication for administrators; least privilege; logging and monitoring; regular testing. No method is perfectly secure; report concerns to security@easyfundraise.com.
## 11. Your rights Depending on where you live: access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right to complain to a supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk); in the EU it is your local data protection authority. Requests: privacy@easyfundraise.com (Users) or the investor request form (Investors). We respond within 30 days.
## 12. Cookies We use only essential cookies, for signing in, security and data-room access. We do not use advertising or analytics cookies. See our Cookie Policy.
## 13. Children The Service is for users aged 18 and over.
## 14. Changes We will notify Users of material changes by email or in-app and update the date above. Previous versions are available on request.