Data processing agreement

Last updated 6 November 2026

How Delsivo processes founder and fund data on the fund's behalf, as processor. Draft, pending legal review.

1. 01Roles

   • The Fund is the controller under the GDPR and UK GDPR, the data fiduciary under the DPDP Act, and the business under the CCPA (where it meets the thresholds) for the personal data founders and others submit to it. It decides what its application form asks, which rubric applies, whether interviews are recorded, who on its team and which guests have access, and how long data is kept.
   • Delsivo is the Fund's processor, data processor and service provider for that data.
   • Delsivo is a controller in its own right only for its own customer accounts, billing, staff, website visitors, enquiries and the waitlist, as its privacy policy explains.

   The Fund is responsible for having a lawful basis for the processing, for publishing its own privacy notice on its portal (a portal can't be published without one), and for the instructions it gives Delsivo. Delsivo records founders' consents, such as consent to an interview recording, but that does not move the Fund's duties to Delsivo.

2. 02Subject matter, duration, nature and purpose

   Item	Details
   Subject matter	Providing the Delsivo service to the Fund: its branded founder portal, the investor workspace, deck analysis, thesis screening, founder interviews, claim tracking, founder requests and data rooms
   Duration	For as long as the Fund uses Delsivo, then until the data is returned and deleted as set out below
   Nature	Collection through the portal, storage, malware scanning, text extraction, AI analysis with citations, transcription, search and retrieval limited by permissions, display to authorised users, sending emails the Fund approves, export and deletion
   Purpose	Helping the Fund receive, review and decide on applications and run diligence, plus support, security, audit and billing records needed to provide the service
   Not done	Selling data, advertising, sharing or matching founders across funds, training AI models, voiceprints, emotion detection or face analysis on recordings, and decisions about founders made without a person

3. 03People and data covered

   Categories of people:

   • Founders who apply to the Fund or are added by its analysts, and the teammates they invite.
   • Guest experts and other people the Fund invites to a data room or a deal.
   • The Fund's own team members: admins, partners, analysts and committee members.
   • People named in documents founders upload, such as employees or customers listed in a data room file.

   Categories of data:

   • Contact details: names, email addresses and, if the Fund's form asks, phone numbers.
   • Application answers and the company facts extracted from them.
   • Pitch decks and their versions, with extracted slide text and charts.
   • Interview recordings (audio and video, only with recorded consent) and transcripts with timestamps.
   • Answers to follow-up forms and documents uploaded to data rooms.
   • Claims, evidence labels, assessments, notes, tasks and decision records written by the Fund's team or suggested by AI.
   • Consent events, such as notice acceptance, recording consent and NDA acknowledgement, with the notice version.
   • Access and activity logs: sign-ins, views, downloads, invitations and permission changes.

   Sensitive data: the service is not designed for special category data. A form question on a sensitive topic needs a stated purpose and a Fund admin's confirmation, and government ID numbers are refused as form fields. If a founder uploads such data anyway, Delsivo protects it like all other room content.

4. 04Delsivo's obligations

   • Process personal data only on the Fund's documented instructions, which are this DPA, the terms, the order form and the Fund's settings in the product. Delsivo tells the Fund if it believes an instruction breaks data protection law.
   • Make sure everyone at Delsivo who can access the data is bound by confidentiality, and give staff access only when their role needs it.
   • Open a Fund's workspace for support only when a Fund admin grants time-limited, read-only access, and record every page viewed.
   • Keep each Fund's data separate from every other fund's, and never use one fund's data for another.
   • Apply the security measures in the annex below.
   • Help the Fund with data protection impact assessments and prior consultations, where they concern the service.
   • Keep records of processing carried out for the Fund.

5. 05Annex: security measures

   Delsivo is designed and built with the following measures. The security page lists every control and marks each as planned until it is in place and tested. Nothing here is certified.

   • Each fund's data separated in the database itself with composite tenant keys, so a bug in a screen can't link records across funds.
   • One permission check for pages, APIs, search, AI retrieval, notifications and exports, applied at query time, so a restricted file can't leak through a search result or an AI answer.
   • Founder portals on a separate domain from the investor app, with founder sessions bound to the fund's portal address.
   • Private file storage encrypted at rest, malware scanning before any preview, extraction or indexing, quarantine for suspicious files, and short-lived download links issued only after a permission check.
   • Two-factor sign-in required for Delsivo staff, fund admins and partners.
   • Founder contact details and fund secrets encrypted at the column level, and sign-in codes, interview links and guest invitations stored only as hashes.
   • An audit trail, security events and AI call logs in a separate logs database, without passwords, tokens, deck text, transcripts or full contact details.
   • Bot checks, rate limits and input validation on public forms, signature checks on webhooks, and security headers on every host.
   • Encryption in transit everywhere, secrets kept outside the code, and backups that are encrypted.

   Delsivo may improve these measures over time but will not reduce the overall level of protection.

6. 06Subprocessors

   The Fund authorises the subprocessors listed below and on the subprocessors page. Delsivo binds each one to data protection terms no less protective than this DPA and remains responsible for their work. Some are used only when the Fund turns on the feature that needs them.

   Provider	What it does	Where
   Vercel	Hosting for the website, the app and fund portals	Global network; app region set at launch
   Neon (PostgreSQL) or a managed MySQL provider	Database for fund data and, separately, the logs	Set at launch with design partners
   Amazon Web Services	Private file storage, malware scanning, deck extraction, video processing, email	Same region as the database
   Anthropic (Claude)	Deck analysis, thesis screening, interview assessment and drafting	United States
   OpenAI	Interview transcription and the interviewer's voice (funds that turn on live interviews)	United States
   Real-time media provider (LiveKit planned, to be confirmed)	Carries live interview camera, microphone and screen streams over WebRTC and records them to Delsivo's storage (funds that turn on live interviews)	Set at launch with design partners
   Tavily	Web research for idea validation and research briefs (funds that turn on research)	United States
   Cloudflare	DNS and Turnstile bot checks on public forms	Cloudflare's global network
   Stripe	Card payments in US dollars (funds paying in us dollars)	United States and other countries
   Razorpay	Payments in rupees (funds paying in rupees)	India
   cron-job.org	Runs scheduled jobs and uptime checks	Germany

   Before adding or replacing a subprocessor that will process the Fund's personal data, Delsivo updates that page and emails the Fund's admins [TODO: notice period, for example 30 days] in advance. If the Fund objects on reasonable data protection grounds, the parties will discuss it in good faith. If they can't agree, the Fund may end the affected service and receive a refund of fees prepaid for the period after it ends.

7. 07AI processing

   • Deck text, transcripts, form answers and room documents go to an AI provider only for the task the Fund uses: deck analysis, thesis screening, interview assessment, claim suggestions, research or questions about a deal.
   • Only content the requesting user is allowed to see is sent, never another deal's or another fund's data. Founder phone numbers and email addresses are removed before a call where the task doesn't need them.
   • AI providers are used under terms that don't train on submitted content, confirmed for each provider before any of the Fund's content is processed. The founder content of one fund is never used to improve the service for another.
   • Every AI finding cites its source. A quote that can't be found in the source is dropped, and AI suggestions are labelled so they look different from verified findings.
   • Uploaded documents and web pages are treated as untrusted input, never as instructions.
   • No decision about a founder is based solely on automated processing (GDPR and UK GDPR Article 22). AI suggests and cites; people make every decision, including every stage change, pass and investment, and approve every message sent to a founder.
   • Interview assessments look at the substance of answers and the evidence behind them. Accent, fluency, presentation polish, appearance and background are excluded.

8. 08International transfers

   Delsivo's database and file storage are hosted in one region at launch, chosen with design partners [TODO: name the region once chosen]. Some subprocessors process data in other countries, as listed. Where the GDPR or UK GDPR applies, transfers outside the EU, EEA or UK rely on the European Commission's standard contractual clauses with the UK International Data Transfer Addendum, or another valid mechanism. Under the DPDP Act, Delsivo will not transfer data to a country the Central Government restricts. [TODO: confirm the mechanism with each subprocessor and attach the clauses.]

9. 09Rights requests

   Delsivo gives the Fund tools to answer founders and others who exercise their rights to access, correction, erasure, objection or restriction, and the CCPA rights to know, delete and correct:

   • Founders can ask from their founder workspace on the Fund's portal. Each request appears for the Fund's admins with a 30-day due date.
   • The Fund decides on each request. Admins can export a founder's data, correct details, or delete the founder's record.
   • Founders can correct facts extracted from their deck and flag transcription errors. Corrections are kept beside the original, not silently overwritten.
   • If someone writes to Delsivo directly about the Fund's data, Delsivo passes the request to the Fund and helps it respond, unless the law requires otherwise.

10. 10Personal data breaches

    Delsivo will notify the Fund without undue delay, and in any case within [TODO: hours, for example 48] hours of becoming aware of a personal data breach affecting the Fund's data. The notice will describe what happened, the data and people likely affected, the likely consequences and the steps taken, with updates as more is known. Delsivo will help the Fund notify its supervisory authority within 72 hours where the GDPR or UK GDPR applies (the ICO in the UK), the Data Protection Board of India and affected people under the DPDP Act, and others where the law requires. Delsivo will not notify founders or regulators on the Fund's behalf without its agreement, unless the law requires it.

11. 11Retention, return and deletion

    While the service runs, the Fund sets its own retention for founder content, and these defaults apply:

    Data	Kept for
    Decks, transcripts and room documents	Kept until the fund deletes the deal, or by the fund's own retention settings
    Interview recordings (camera, microphone and screen)	Set by the fund for each recording, separately from transcripts
    Audit and security logs	1 year
    AI call logs (no document text)	90 days

    Deleting a deal, a founder or a file first stops all access, then removes previews, extracted text, search indexes, AI caches and other derived copies. When the service ends, the Fund can export its data within [TODO: period, for example 30 days]. After that, Delsivo deletes the Fund's personal data, except what the law requires it to keep and de-identified consent proofs. Encrypted backups age out within [TODO: backup window, for example 35 days for daily backups], and data in them is never restored into the service except to recover from an incident.

12. 12Audits

    Delsivo will make available the information the Fund reasonably needs to show compliance with this DPA, including its security documentation and, once it has them, audit reports. Delsivo is not certified today; its controls are mapped to SOC 2 and ISO 27001 in an internal register. Where that information isn't enough, the Fund may carry out an audit, itself or through an independent auditor bound by confidentiality, with [TODO: notice period, for example 30 days] notice, at most once a year unless a regulator requires it or after a breach, during business hours and without access to other funds' data. Each party bears its own costs.

13. 13CCPA and CPRA service provider terms

    Where the CCPA applies, Delsivo acts as the Fund's service provider and will not:

    • sell or share the Fund's personal information, as those words are defined in the CCPA;
    • keep, use or disclose it for any purpose other than providing the service under the contract, or outside the direct business relationship with the Fund;
    • combine it with personal information Delsivo receives from anyone else, or collects itself, except as the CCPA allows.

    Delsivo will tell the Fund if it can no longer meet these obligations, and the Fund may then take reasonable steps to stop and fix unauthorised use.

14. 14Contact

    Data protection questions: [TODO: privacy contact email, for example privacy@delsivo.com]. Anything else: hello@delsivo.com. Grievance officer under the DPDP Act: [TODO: grievance officer or privacy contact name], [TODO: grievance officer email].