VCMatch.ai Privacy Policy

Effective date: November 3, 2025
Last updated: November 3, 2025

1) Who we are

This Privacy Policy explains how [Innoventions LLC.] ("VCMatch," "Innoventions," "we," "us," or "our") collects, uses, and shares information when you use our websites, applications, and services that link to this Privacy Policy (collectively, the "Services").

Contact (privacy): [[email protected]]
Postal: [Innoventions LLC., 15260 Ventura Blvd, Sherman Oaks California 91403, USA]
Representative / DPO (if applicable): [Avi Flombaum / [email protected]]

2) Scope

This Policy applies to:

Startup users who create accounts, upload information (e.g., fundraising details, pitch decks, metrics), and use the Services to manage matching and outreach to investors.
Publicly available data about venture capital firms and investors that we compile from their own public websites and other public online sources to maintain a directory and power our matching features.

This Policy does not apply to third-party websites, services, or platforms that we do not control, even if they are linked from our Services.

3) Information we collect

A. Information you provide (Startup users)

Account & profile data: name, email, password (hashed), role, company name, company website/domain, industry, location.
Startup details: fundraising status & targets, investor updates, team bios, metrics you choose to provide (e.g., revenue, growth, users), cap table summaries (if provided), deck(s), one-pagers, product screenshots, links.
Preferences: target investor profiles, geographies, stages, and other matching criteria you set.
Communications: messages you send us (support tickets, feedback), and any outreach messages you direct us to send to investors.
Payment information: if you purchase paid features, billing contact details. Card/payment data is processed by our payment processor; we do not store full card numbers.

B. Information we collect automatically

Usage data: activity within the Services (e.g., log-ins, settings changes, viewed pages), feature usage, and timestamps.
Device / log data: IP address, device type, operating system, browser type, language, and diagnostic logs.
Cookies and similar technologies: cookies or local storage for authentication, security, and analytics. See Cookies & analytics below.

C. Information about VC firms & investors (public sources)

To maintain a useful directory and enable matching, we collect and process information about venture firms and investors only from publicly available online sources, such as their own websites, press releases, public social profiles, news articles, and similar public web pages. We may also receive updates directly from the firms or authorized representatives.

Commitment: We do not publish or share any information about a firm or individual investor that is not already publicly available online.

D. Inferences & model outputs

We may generate inferences or model outputs (e.g., suggested matches or tags) derived from the information above. These help rank relevance and improve results.

4) How we use information

We use information to:

Provide and secure the Services: account creation, authentication, fraud prevention, security monitoring, troubleshooting.
Match startups with investors: generate and display suggested matches and related insights you request.
Maintain our public investor directory: compile, organize, and present information from public sources for discoverability.
Facilitate communications you initiate: draft or send messages at your direction (e.g., intros or outreach), store preferences, and track status.
Improve and develop the Services: analytics, research, and product improvement (using aggregated or de-identified data where feasible).
Comply with law and enforce our terms; protect rights, safety, and integrity of the Services.
With consent: any other use you clearly authorize.

5) How we share information

A. No startup disclosures to third parties (including VCs) without your consent

We do not disclose your startup's non-public information to any third party-including venture firms or investors-for their independent use without your explicit consent. Examples of consent include: you choose to make a profile public, you explicitly instruct us to share a deck or metrics, or you use a feature that sends investor outreach on your behalf.

B. Service providers (processors)

We rely on service providers (hosting, storage, email delivery, analytics, customer support, payment processing, optional AI infrastructure, etc.). These providers process data on our instructions only, under contractual confidentiality and data-protection obligations. We do not permit them to use your data for their own purposes.

C. Public investor directory

We publish and display information about firms and investors only if it is publicly available online. We never publish non-public details. We will correct or remove items upon verified request (see Your rights & requests below).

D. Legal, safety, and corporate events

We may disclose information if we believe in good faith it is necessary to comply with applicable law or legal process, to protect the rights and safety of VCMatch, our users, or others, or in connection with a merger, acquisition, financing, or sale of assets (in which case we will take appropriate steps to protect your information and notify you if required by law).

E. No selling or cross-context advertising

We do not sell your personal information and we do not share it for cross-context behavioral advertising.

6) Cookies & analytics

We use cookies and similar technologies to keep you signed in, enhance security, remember preferences, and analyze usage to improve the Services. You can control cookies through your browser settings. Where required, we will present consent banners and honor your choices.

If we use analytics providers, they act as our processors and may receive pseudonymous usage data. We configure them to avoid identifying you wherever feasible.

7) AI and automated decision-making

We may use AI models to assist with feature functionality (e.g., match suggestions, investor summaries). We do not use your startup's confidential content to train third-party foundation models for their benefit. If we use third-party AI tools, they act as processors under strict agreements that prohibit retention or secondary use beyond providing the Services. You can opt out of AI-assisted features where feasible; however, core functionality may rely on automated scoring or ranking to suggest matches. These features do not involve decisions with legal or similarly significant effects.

8) Data retention

We retain personal information for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce agreements. In general:

Account data: kept while your account is active; upon deletion, we begin deletion or de-identification within a reasonable period (e.g., 3090 days), subject to backups and legal holds.
Startup content (e.g., decks, metrics): retained while needed to provide features you use; deleted or de-identified after you remove it or close your account, subject to backups/legal holds.
Logs/diagnostics: retained for security and auditing for a limited period.

9) Your choices & rights

A. Startup controls

Visibility & sharing: You control whether your profile or materials are public or shared. We will not share them with investors without your explicit direction.
Access, correction, deletion: You can access and update most data in the app, or contact us to exercise these rights. We will verify your request before acting.
Data export: You may request a copy of your data in portable format.
Marketing: You can opt out of non-essential emails via unsubscribe links or account settings.

B. VC firm & investor listings (public data)

If you represent a firm or investor and believe our listing contains inaccuracies, is outdated, or cites information that is not public, please email [email protected] with evidence. We will investigate and correct or remove content that is not publicly available or is inaccurate.

C. California residents

We honor rights under the California Consumer Privacy Act (as amended by the CPRA): access/know, correct, delete, and limit use of sensitive personal information. We do not sell or share personal information. To exercise rights, contact [email protected].

D. EEA/UK/Swiss individuals

Where the GDPR/UK GDPR applies, our legal bases include: contract (to provide the Services you request), legitimate interests (e.g., to secure and improve the Services and to compile a directory from public sources), consent (where we rely on it, such as certain cookies), and legal obligations. You may have rights to access, rectify, erase, restrict processing, data portability, and object (including to processing based on legitimate interests). You may lodge a complaint with your local supervisory authority.

10) International data transfers

If we transfer personal information internationally, we will do so pursuant to recognized transfer mechanisms (e.g., EU Standard Contractual Clauses, UK IDTA/Addendum) and implement appropriate safeguards.

11) Security

We employ administrative, technical, and physical safeguards designed to protect personal information (e.g., encryption in transit, access controls, monitoring). No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

12) Children's privacy

The Services are not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided personal information, please contact us and we will take appropriate steps to delete it.

13) Third-party links

Our Services may link to third-party sites or services. Their privacy practices are governed by their own policies; please review them.

14) Changes to this Policy

We may update this Policy from time to time. We will post the updated Policy and update the "Last updated" date above. If changes materially affect your rights or how we use your data, we will provide additional notice (e.g., via email or in-app notice) and, where required, obtain your consent.

15) Key commitments (summary)

We compile VC firm and investor information only from publicly available online sources and do not publish non-public information.
We do not disclose your startup's non-public information to any third party-including VCs-for their independent use without your explicit consent.
We use service providers under contract who process data only on our instructions and not for their own purposes.
We do not sell personal information or share it for cross-context behavioral advertising.

16) Contact us

If you have questions, concerns, or requests regarding this Policy or your information, please contact [email protected].

17) Definitions (helpful, not exhaustive)

Personal information / Personal data: information that identifies or can reasonably be linked to a particular individual.
Publicly available information: information lawfully made available to the general public from government records or widely distributed media, or information a person or entity has made publicly accessible online (e.g., on their own website or public profile).
Service providers / Processors: vendors that process data on our behalf and under our instructions.
Third parties: entities that process data for their own independent purposes (not as our service providers).
De-identified / Aggregated data: information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular individual.