Privacy notice

This privacy notice explains, under Articles 13 and 14 of the General Data Protection Regulation (GDPR), which personal data we process when you visit or use PitchRound.

1. Controller

The controller is Operator detail missing, email: Operator detail missing. Further details are in the Imprint.

We have not appointed a data protection officer because the law does not require one. Please send data protection requests to pitchround.app/contact.

2. Visiting the website

Whenever a page is opened, our host Vercel processes technically necessary data: IP address, date and time, the address requested, the referrer, the browser and the operating system. The purpose is to deliver the website, keep it secure and find faults. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and working service. The logs are deleted after 30 days at the latest.

To prevent abuse we count requests over fixed periods, in our own database: per IP address, and for some actions per account or per email address, for example how many new conversations an investor opens in a month or how many cancellation confirmations one address receives in a day. A counter keyed by an IP address or an email address holds a hash of it, not the address itself. A counter is deleted once its period has ended; the longest period is 30 days, and counters kept per account are deleted after 35 days at the latest. The legal basis is Art. 6(1)(f) GDPR.

We serve fonts from our own server. Opening the website makes no connection to Google Fonts or any other font service. We use no analytics or advertising tools from other providers and no tracking cookies. We count visits to startup profiles, opens of share links and clicks on profiles ourselves, on our server, without storing anything on your device; section 5 explains what we count and for whom.

Videos and booking pages from other providers

A startup's profile can show a video and a booking page, and an investor's profile a video, hosted by another provider. Opening the profile loads nothing from that provider. Only when you click to play the video or to book a call does your browser connect to the provider; the profile names the provider before you click. The provider then receives your IP address and browser details and may store or read information on your device, under its own privacy notice and on its own responsibility.

Videos play inside the page only from YouTube in its privacy-enhanced mode (youtube-nocookie.com, Google Ireland Limited), from Vimeo (with the do-not-track setting) and from Loom. Booking pages open inside the page only from Calendly, Cal.com, SavvyCal, TidyCal and zcal. A video or booking page on any other host is shown only as a link that opens the provider's own website in a new tab. We count the click itself as section 5 describes.

The legal basis for loading the content you asked for is Art. 6(1)(f) GDPR; our interest, and the profile owner's, is to show it without connecting visitors who do not ask for it. Several of these providers are based in the USA or transfer data there; section 11 describes the safeguards for such transfers.

3. Cookies and local storage (section 25 TDDDG)

We store on your device only what is strictly necessary for the service you ask for (section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). No consent is needed for this, which is why there is no consent banner. Nothing is stored on your device to count visits (section 5).

These are all the cookies the website sets:

• Session cookies, sb-...-auth-token (split into numbered parts when large; during a sign-in also a short-lived code-verifier cookie): set after you sign in and keep you signed in. Deleting them signs you out.
• cr_locale: the language you chose, for one year.
• cr_theme: the light or dark look you chose, for one year. A cr_style cookie from an earlier version of the website is deleted on your next visit.
• cr_banner_closed: that you closed the notice banner at the top of the page, so it stays closed, for 60 days.
• cr_preview, for administrators and invited test guests only: a signed cookie for previewing another platform model, for up to 30 days (administrators) or 8 hours (guests).
• cr_kiis_ followed by a round number, for participants in that preview only: a signed note that you opened a round's key information sheet, for 24 hours.
• cr_signup_consent, only while you sign up with Google: a signed note that you ticked the boxes for the Terms and for being 18 or older, so that your acceptance can be recorded when Google sends you back to us, for 15 minutes or until it is used.

Local storage in your browser (localStorage and sessionStorage) holds view settings and hints you closed, the progress of the guided tour, the notification sound setting, recent searches, your comparison list, drafts of the onboarding forms, an automatic backup of a profile you are editing, the email address carried from sign-up or sign-in to the confirmation page, and short technical notes, for example that you just changed the language or that an error page already tried to reload. It stays in your browser and reaches us only when you send it yourself, for example by saving a form.

The legal basis for the processing involved is Art. 6(1)(b) GDPR (signing in, the preview) and Art. 6(1)(f) GDPR (preferences).

4. Account and profile

When you register we process your name, email address, password (stored only as a hash), your role (startup or investor) and your state of residence or seat. In your profile we process what you enter yourself: for startups, for example, the company, team, funding round, figures and documents; for investors, for example, investment focus, ticket size and holdings. If you sign in with Google, Google gives us your name, email address and profile picture.

The purpose is to provide the platform. The legal basis is Art. 6(1)(b) GDPR. We need your state of residence because the directories are open only to users resident in the EU, the EEA or Switzerland (Art. 6(1)(b) and (f) GDPR).

Your profile is visible to other signed-in users within the visibility you chose. A person reviews each startup profile against our checklist before it goes live, which includes comparing details with public registers (Art. 6(1)(b) and (f) GDPR). Investor profiles go live without such a review.

Records on file (verification)

Startups and investors can file records with us, so that their profile shows what has been checked and when ("Records on file"). Depending on the level applied for, we process:

• Domain: you publish a code we give you as a DNS record of the domain of the website on your profile, and our server looks it up.
• Identity: a reviewer compares a government identity document with a photo of you. We use no identity-verification provider.
• The company: its entry in the public company register, and a document showing that you may act for it, such as a register extract or a list of directors. For UK companies our server looks the registration number up in the Companies House register, which returns the company's name, status, date of incorporation and the surnames of its officers. Other registers, for example the German commercial register, a reviewer looks up by hand.
• At the highest level: the documents behind a startup's published revenue figures, or an investor's proof of funds or accreditation.

When an application is submitted, our server also checks it for risk signs, for example whether the email domain matches the website, whether the same company appears on another profile, or whether figures are implausible. These signs go to the reviewer and decide nothing by themselves.

Documents are kept in private storage. Only the administrators reviewing a case open them, through links that are valid for a short time. Other members never see the documents; a profile shows only which kinds of record are on file and the date each was checked. The legal basis is Art. 6(1)(b) GDPR (you ask for the check) and Art. 6(1)(f) GDPR (protecting members from impersonated companies and fraud).

A check counts for twelve months; after that it expires and the profile no longer shows it. The documents are kept while your account exists. If you delete your account, they are deleted; what remains is the record of each check without the document: its kind, how it was done, its result and its date.

5. Profile views, visits, clicks and viewer lists

When a signed-in investor opens a startup's profile, we record the view with its date. The startup sees only the number of views. It sees an investor's name only where that investor has expressly agreed to this in their settings. By default, names are not shown. The same applies when an investor saves a startup's profile to their watchlist or opens one of its documents, and when an investor opens another investor's profile: the other side sees the number, and a name only with that consent. When a founder opens an investor's profile, the investor likewise sees only the number; the startup's name is shown only where the startup has agreed to this in its settings, which by default it has not.

Every visit to a startup's profile is also counted, whether the visitor is signed in or not. For each visit we store the profile, the time and a visit key. Our server computes the key from your IP address, your browser's identification string (user agent) and the profile, with a secret key that changes every day (a keyed hash, HMAC-SHA256). We store neither the IP address nor the browser details, and nothing is stored on your device. Because the daily key changes and the visit key differs per profile, visits on different days or to different profiles cannot be linked through it. It lets us count a reload within 30 minutes as one view, and each visitor once per day as a unique visitor. The startup sees how many views its profile had; our platform statistics show totals across all profiles. Views by the startup's own team and by our administrators are not counted. The visit records are kept as long as the profile exists and are deleted with it.

When someone opens a share link that a startup sent out, we count the open the same way: one open per visitor, link and day. For this we keep a hash of the visit key for 24 hours. The startup sees how many times the link was opened.

When someone opens the website, social media or booking link on a profile, plays its video, opens its one-pager or shares it, we store the profile, the kind of click and the time, but not who clicked. The profile's owner sees the numbers.

The legal basis for counting views, visits, opens and clicks is Art. 6(1)(f) GDPR; our interest, and the startups' and investors', is to gauge the interest a profile draws without disclosing individual visitors or investors. The legal basis for showing a name is your consent (Art. 6(1)(a) GDPR), which you can withdraw in your settings at any time with effect for the future.

6. Messages, introduction requests, data rooms

We process the messages, attachments and introduction requests you exchange with other users in order to deliver them (Art. 6(1)(b) GDPR). Messages that suggest advance-fee fraud or payment routes outside the usual channels are flagged automatically and reviewed by a person (Art. 6(1)(f) GDPR, protecting users from fraud). The flag leads to no decision about you.

Before a data room opens, investors accept a confidentiality agreement; we store the time, the version and the IP address as evidence. Every downloaded file carries an invisible watermark; we store who received which copy, when and from which IP address, so that a file passed on without permission can be traced. The startup sees only who downloaded what and when, not the IP address. The legal basis is Art. 6(1)(b) and (f) GDPR (protecting confidential documents).

7. AI-assisted features (OpenAI, Anthropic)

Some features send content to language models from OpenAI and Anthropic and show you the result: summaries and assessments of how complete a profile is, translations of profile text, drafts of messages and updates, and the assistant on the website. Only the content a feature needs is sent, for example the text of a profile or your question to the assistant.

Documents from a startup's data room are sent only where the startup has expressly allowed this in its settings (Art. 6(1)(a) GDPR; the permission can be withdrawn at any time). Documents available only under a confidentiality agreement are never sent. Otherwise the legal basis is Art. 6(1)(b) GDPR where you use the feature, and Art. 6(1)(f) GDPR where we translate profile text for other users.

Both providers process the data as our processors and, under their contract terms, do not use it to train their models. Processing also takes place in the USA (section 11). The results are not an automated decision within the meaning of Art. 22 GDPR.

8. Subscriptions and payment (Stripe)

Paid plans are billed through Stripe. Stripe processes your payment details itself; we never receive full card numbers. We store the plan, the term, invoices and the Stripe customer number. The legal basis is Art. 6(1)(b) GDPR and, for keeping invoices and accounting records, Art. 6(1)(c) GDPR with section 147 of the German Fiscal Code (AO) and section 257 HGB (up to ten years).

9. Emails

We send transactional emails, for example to confirm your account, about new messages, about the status of your profile and about your subscription, through the service provider Resend (Art. 6(1)(b) GDPR). Digests and notifications you do not strictly need can be switched off in your settings or through the link in each such email. We process enquiries through the contact form or by email in order to answer them (Art. 6(1)(b) or (f) GDPR).

Dispatch, our newsletter

You can subscribe to Dispatch, our newsletter, with your email address, with or without an account. We first send a link to confirm the address (double opt-in); it is valid for seven days. Until you click it, the address receives nothing but that request. As evidence of your consent we store the address, where you subscribed, the wording you agreed to, the time of the request and the time of the confirmation. Dispatch is sent through Resend.

The legal basis is your consent (Art. 6(1)(a) GDPR, and section 7(2) no. 2 of the German Act against Unfair Competition, UWG); for the evidence it is Art. 6(1)(f) GDPR. You can unsubscribe at any time through the link in every issue, which withdraws your consent for the future. The address is then marked as unsubscribed and receives nothing more; on request we delete it entirely. If you delete your account, the address is removed from the list.

Waitlist for paid plans

While paid plans cannot yet be bought, the pricing page offers to tell you when they go on sale. For this we store the email address (if you are signed in, your account's address), whether you asked as a founder or as an investor, your account if you are signed in, and the time. We send a link to confirm the address; an address that is not confirmed is never used for the message and is deleted after 30 days. A confirmed address receives one message, when paid plans go on sale, and is then deleted. It is used for nothing else. Emails are sent through Resend.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to pitchround.app/contact; we then delete the address.

10. Records and security

We store which version of the Terms you accepted and when, with the IP address, and sign-ins with IP address and browser, which you can see yourself in your account (Art. 6(1)(c) and (f) GDPR; evidence and security). To detect one person opening many accounts, we store, for shared IP addresses, a hash formed with a secret key instead of the address (Art. 6(1)(f) GDPR).

From the time before September 20, 2026, records of first contacts, confirmations by investors and countersigned records about funding rounds are stored. They are no longer added to and are shown to nobody as an obligation. We are reviewing how long they may be kept and will delete them as soon as there is no longer a legal basis.

11. Recipients and transfers to third countries

We use the following service providers as processors (Art. 28 GDPR):

• Supabase: database, sign-in and file storage; stored in Frankfurt am Main.
• Vercel: hosting; server functions in Frankfurt am Main, delivery through a worldwide network.
• Stripe: payment processing (Stripe Payments Europe, Ireland).
• Resend: sending email, including Dispatch and the waitlist message (section 9).
• OpenAI and Anthropic: the AI-assisted features in section 7.
• Google: sign-in with Google, only if you choose it.
• DocuSign: only where a confidentiality agreement is sent through DocuSign.

Several of these providers are based in the USA or access data from there. We base transfers to the USA on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can obtain a copy of the safeguards on request.

Other users receive your data within the visibility you chose and in the messages you send them. Authorities receive data only where the law obliges us (Art. 6(1)(c) GDPR). We do not sell personal data.

12. How long we keep data

We keep account data while your account exists. If you delete your account, we remove your profile and contact details within 30 days. Entries you made towards other users and that they need as evidence, such as accepted confidentiality agreements, are not deleted but separated from your account; your name remains in them. We keep invoices and accounting records for up to ten years. For other data, the sections above state the period.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). You can delete your account yourself in the account settings. For anything else, a message to pitchround.app/contact is enough.

Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the one for the German federal state in which the provider is based.

14. Whether you must provide data, minimum age

The details asked for at registration are needed for the contract; without them we cannot set up an account. Everything else is voluntary. PitchRound is only for people aged 18 or over.

15. Changes

We update this privacy notice when the processing changes. The current version is on this page, with its date at the top. We also tell signed-in users about material changes by email. The German and English versions are equally valid.