Delsivo and the GDPR

Last updated 6 November 2026

The fund is the controller, Delsivo the processor. How the product supports notices, recording consent, rights, retention and transfers.

1. 01Controller and processor

   • Funds are controllers for founder and deal data. They decide to use Delsivo, what the application form asks, the thesis rubric, who sees each deal and how long data is kept.
   • Delsivo is a processor for that data, acting only on the fund's documented instructions under the data processing agreement (Art. 28). It does not use founder data for its own purposes, sell it, or use it to train AI models.
   • Delsivo is a controller only for fund team accounts, billing, website visitors, enquiries and the waitlist, as described in the privacy policy.

2. 02Lawful basis for each purpose

   Purpose	Lawful basis
   Evaluating a founder's application, deck and follow-up answers	Usually the fund's legitimate interests in assessing an investment the founder asked it to consider (Art. 6(1)(f)), or steps taken at the founder's request before a contract (Art. 6(1)(b)). Set by the fund.
   Recording a voice or video interview	The founder's consent (Art. 6(1)(a)), recorded with the notice version before the microphone or camera starts. Text is always available instead.
   Data room access with an NDA acknowledgement	Set by the fund. Where it turns the acknowledgement on, Delsivo records it with the text version.
   Fund team accounts and providing the service to the fund	Contract with the fund (Art. 6(1)(b)). Delsivo is controller here.
   Security, fraud prevention and audit trails	Legitimate interest in keeping the service and the data in it safe (Art. 6(1)(f)).
   Billing records and tax	Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)). Delsivo is controller here.
   Replying to enquiries, pilot requests and the waitlist	Steps taken at your request before a contract (Art. 6(1)(b)), or consent for the waitlist (Art. 6(1)(a)). Delsivo is controller here.

   The fund, as controller, chooses and documents its own lawful basis. A fund relying on legitimate interests should record its balancing test. Where consent is the basis, Delsivo's consent records (purpose, wording version and time for each grant and withdrawal) help the fund show that consent was given (Art. 7).

3. 03Notices to founders

   • A portal can't be published until the fund has added its own privacy notice, which is where the fund gives the information Art. 13 requires.
   • Every portal footer links to the fund's notice and to Delsivo's processor notice.
   • The notice version a founder accepted is recorded with their submission.
   • Before an interview, the founder sees its purpose, length, what is recorded, who sees it and how long it is kept.
   • Every question on a form carries a purpose the founder can read.

4. 04Automated decisions and human review

   Art. 22 gives people the right not to be subject to a decision based solely on automated processing that significantly affects them. Delsivo is designed so that people make every decision:

   • AI extracts facts, applies the fund's rubric, assesses interview answers and drafts questions, each with a citation. It never changes a deal's stage, passes on a founder or writes to them on its own.
   • A Mismatch against the fund's rubric is surfaced for an analyst to review, never an automatic rejection. A missing value is shown as Unknown and becomes a question, not a failure.
   • Analysts can override any assessment, and a reason is required and recorded.
   • Every message to a founder needs a person's approval.
   • Each assessment stores the model, prompt and rubric version, so it can be explained and re-run.

5. 05Data minimisation and fairness

   • Interviews are assessed on the substance of each answer and its evidence. Accent, fluency, presentation polish, appearance and background are excluded, and the assessor reads the transcript, not the audio.
   • There are no voiceprints, emotion detection or face analysis on any recording.
   • Content goes to an AI provider only for the stated task, with founder phone numbers and email addresses removed unless the task needs them.
   • Sensitive topics on forms need a fund admin's confirmation, and government ID numbers are refused as form fields.
   • Web research receives only company and market terms, never founder contact details or data room files.

6. 06Data subject rights

   Right	How Delsivo is designed to support it
   Access and portability (Art. 15, 20)	The founder asks from Settings, Privacy in the founder workspace on the fund's portal, or writes to the fund. The fund exports the founder's application, answers, files and the claims about them.
   Rectification (Art. 16)	Founders can correct facts extracted from their deck and flag transcription errors. Corrections are stored beside the original, so the fund sees both and where each came from.
   Erasure (Art. 17)	The fund decides the request. Deletion disables access at once, then removes the deck, recordings, transcripts, previews, search index entries, embeddings and derived copies. De-identified counts and consent proofs remain.
   Withdrawing consent (Art. 7(3))	Withdrawing recording consent stops the recording and starts deletion of the audio, video and derived transcript, unless the fund records another lawful basis. The text path stays open.
   Objection and restriction (Art. 18, 21)	Requests go to the fund, which can pause or close the deal. Delsivo helps the fund act on them.
   Automated decisions (Art. 22)	No decision about a founder is made solely by automated processing. People move every deal, pass with a reason and approve every message. Analysts can override any AI assessment with a recorded reason.

   Every request gets a 30-day due date, within the one-month limit, and is recorded in the audit trail. Founders can also complain to their supervisory authority: in the UK, the Information Commissioner's Office (ICO).

7. 07Retention

   The fund sets retention for founder content (Art. 5(1)(e)), and can keep audio and video for less time than transcripts. The defaults are:

   Data	Kept for
   Decks, transcripts and room documents	Kept until the fund deletes the deal, or by the fund's own retention settings
   Interview recordings (camera, microphone and screen)	Set by the fund for each recording, separately from transcripts
   Audit and security logs	1 year
   AI call logs (no document text)	90 days

8. 08International transfers

   Delsivo launches with one hosting region, chosen with design partners. Some providers process data outside the EU, EEA and UK, including these in the United States:

   • Anthropic (Claude): deck analysis, thesis screening, interview assessment and drafting.
   • OpenAI: interview transcription and the interviewer's voice.
   • Tavily: web research for idea validation and research briefs.
   • Stripe: card payments in US dollars.

   The full list is on the subprocessors page. Personal data of people in the EU or EEA that leaves those areas will be covered by the European Commission's standard contractual clauses, and UK data by the UK International Data Transfer Addendum, set out in the data processing agreement.

9. 09Security of processing

   Delsivo's planned measures under Art. 32 include separating each fund's data in the database itself, one permission check for pages, search, AI answers and exports, malware scanning before any file is opened, encrypted private storage, short-lived download links, two-factor sign-in for staff, fund admins and partners, and audit logs in a separate database. See the security page for each control and its status.

10. 10Breach notification

    Delsivo will inform the fund without undue delay after becoming aware of a breach affecting its data (Art. 33(2)), with the details the fund needs to notify its supervisory authority within 72 hours (the ICO in the UK) and, where required, the founders affected. Delsivo notifies directly for data it controls.

11. 11Records, impact assessments and representatives

    Records of processing (Art. 30) are being prepared alongside the data processing agreement. Delsivo uses only the providers on the subprocessors page and tells funds before adding one.

    Some funds will want a data protection impact assessment (Art. 35) before screening founders with AI. Delsivo can provide what goes into one: the data flows, the subprocessor list, what AI does and doesn't do, what interviews exclude, and the security controls.

    EU and UK representatives (Art. 27): [TODO: name the EU and UK representatives if required once funds there sign up]. Company: [TODO: company legal name]. Questions: [TODO: privacy contact email, for example privacy@delsivo.com] or hello@delsivo.com.