Privacy policy

Last updated 6 November 2026

What personal data Delsivo processes, for whom and why, who receives it, how long it is kept and your rights. Draft, pending legal review.

1. 01Who is responsible for your data

   Delsivo has two roles, depending on whose data it is:

   • Founder and deal data. The fund that runs a portal is the controller under the GDPR and UK GDPR, the data fiduciary under the DPDP Act and, where the CCPA applies to it, the business. Delsivo is its processor, data processor and service provider: we process founder and deal data only to provide the service to that fund, under our terms and data processing agreement with it.
   • Fund team accounts, our staff, website visitors, enquiries and the waitlist. Delsivo is the controller and data fiduciary for the accounts of fund admins, partners, analysts and committee members, for our own staff, for people who contact us, apply to be a design partner or join the waitlist, and for visitors to this website.

   If you applied to a fund through a Delsivo portal, the fund is your first point of contact for questions and requests about your data. Its privacy notice is linked on its portal, and a fund can't publish its portal without one. We help the fund answer, and you can also contact us directly.

2. 02Data we process for funds

   When a founder applies to a fund that uses Delsivo, or a fund works on a deal, we process on the fund's behalf:

   • Application details: founder and teammate names, email addresses, roles, the company's name, website and facts, and the answers to the fund's application form.
   • Pitch decks and their versions, the text and charts extracted from them, and any corrections a founder makes to extracted facts (the original is kept alongside).
   • Interview recordings, when the founder agrees to be recorded, transcripts with timestamps, and text answers (first release). Founders who decline recording can answer in text.
   • Answers to follow-up forms, uploaded files and data room documents, with their versions and file-level questions (first release for data rooms).
   • Claims about the company, with their sources and evidence labels, and the fund's own notes, assessments, rubric results and decisions. Founders never see internal ratings or notes.
   • Consent and notice records: the notice version a founder accepted, consent to recording, NDA acknowledgements, and any withdrawal, with the time.
   • Guest experts' names and email addresses, what was shared with them, until when, and a log of their views and downloads.
   • Founder sign-in records: a one-time code or link (stored only as a hash), sessions tied to the fund's portal, and security events.

   The fund decides what its application form and requests ask. Questions on sensitive topics need a fund admin to confirm them, and government ID numbers can't be asked as form fields.

3. 03Data we process for ourselves

   • Fund team accounts: name, work email, role, a hash of the password (never the password itself), two-factor sign-in settings, sessions, and an audit trail of actions with the IP address and browser used.
   • Enquiries, design partner requests and the waitlist: what you enter in our forms (name, work email, fund name, fund type, roughly how many applications you see a month and your message), and any emails we exchange.
   • Billing: the billing contact, invoices and payment status. Card details stay with our payment providers and never reach Delsivo.
   • Website visits: our hosting provider records technical request data such as IP address, browser and pages requested, for security and to keep the site running. This website uses no analytics or advertising cookies. If you choose a light or dark theme, that choice is kept in your browser's local storage. Forms use Cloudflare Turnstile, which processes browser signals to tell people from bots. Every item is listed on our cookies page.
   • Security events: failed sign-ins, blocked requests and similar events, with IP address and time, kept in a separate logs database.

4. 04Why we use it, and on what basis

   Purpose	Basis
   Receiving applications, analysing decks, screening against the fund's thesis, interviews, requests and data rooms	On the fund's instructions, as its processor. The fund sets the lawful basis in its own notice, usually its legitimate interest in evaluating an investment or steps taken at the founder's request (GDPR Art. 6(1)(b) or (f)), or consent or a legitimate use under the DPDP Act (s.6, s.7).
   Recording a voice or video interview	The founder's consent, asked for before the microphone or camera starts. Declining keeps the text path open under the same rubric.
   Fund team accounts and providing the service to funds	Our contract with the fund (GDPR Art. 6(1)(b)); data provided voluntarily for that purpose (DPDP Act s.7).
   Security, fraud prevention, abuse reports and audit trails	Our legitimate interest in keeping the service safe (GDPR Art. 6(1)(f)) and legitimate uses under DPDP Act s.7.
   Replying to enquiries, planning pilots and contacting people on the waitlist	Your consent when you send the form, and steps you ask us to take before a contract.
   Billing and meeting legal obligations	Contract and legal obligation (GDPR Art. 6(1)(b) and (c), DPDP Act s.7).

5. 05Consent and how to withdraw it

   Where consent is the basis, it is asked for one purpose at a time and recorded with the notice version shown: interview recording, an optional NDA acknowledgement for a data room, and marketing emails from us. Withdrawing is as easy as giving it:

   • During an interview, a founder can stop recording at any time. Partial audio is discarded and the text option is offered.
   • After an interview, a founder can withdraw recording consent from their founder workspace. Further processing of the recording stops and the audio, video and derived transcript are deleted, unless the fund records another lawful basis.
   • Anyone on our waitlist or mailing list can reply “remove me” to any email.

   Withdrawal stops future processing based on that consent. It does not make processing before the withdrawal unlawful.

6. 06AI and automated decisions

   Delsivo uses AI to extract facts from decks, apply the fund's rubric, assess interview answers on their substance, suggest claims and questions, and draft briefs. Only the content needed for the task is sent, only from the deal and files the requester is allowed to see, and founder phone numbers and email addresses are removed where the task doesn't need them. Another deal's or another fund's data is never included.

   We use AI providers under terms that don't allow them to train on submitted content, and we confirm each provider's data use and retention terms before any customer content is processed. [TODO: state each provider's confirmed retention terms.]

   No decision about a founder is made solely by automated processing. AI suggestions are labelled as suggestions, and a person at the fund decides every stage change, pass and investment, and approves every message to a founder. Interviews are assessed on what founders say and the evidence behind it; accent, fluency, presentation polish, appearance and background are excluded, and no voiceprints, emotion detection or face analysis are used. Founders can flag transcription errors and ask for corrections.

7. 07Who we share data with

   We share personal data only with the service providers below, who process it for us under contract, and when the law requires it. We don't sell personal data or share it for cross-context behavioural advertising. The current list, with where each provider processes data and how we announce changes, is on our subprocessors page. These providers are planned: none processes customer data yet.

   Provider	What for	Data
   Vercel	Hosting for the website, the app and fund portals	Requests (IP address, browser), app logs, and the data the app handles while it runs
   Neon (PostgreSQL) or a managed MySQL provider	Database for fund data and, separately, the logs	Fund, deal, founder and evidence records; audit, security and AI call logs
   Amazon Web Services	Private file storage, malware scanning, deck extraction, video processing, email	Decks, interview recordings, transcripts, room documents; email addresses and email content
   Anthropic (Claude)	Deck analysis, thesis screening, interview assessment and drafting	Deck text and images, transcripts and evidence needed for the task, with contact details removed where possible
   OpenAI	Interview transcription and the interviewer's voice (funds that turn on live interviews)	Interview audio
   Real-time media provider (LiveKit planned, to be confirmed)	Carries live interview camera, microphone and screen streams over WebRTC and records them to Delsivo's storage (funds that turn on live interviews)	Interview audio, video and screen streams while the call runs
   Tavily	Web research for idea validation and research briefs (funds that turn on research)	Search queries about the company and market, never private documents
   Cloudflare	DNS and Turnstile bot checks on public forms	Browser signals during form checks
   Stripe	Card payments in US dollars (funds paying in us dollars)	Billing contact, invoices and payment status. Card details stay with Stripe
   Razorpay	Payments in rupees (funds paying in rupees)	Billing contact, invoices and payment status. Card and UPI details stay with Razorpay
   cron-job.org	Runs scheduled jobs and uptime checks	No personal data: it calls Delsivo's job addresses on a schedule

   Within a fund, founder data is visible only to the fund's team members with access to that deal, and to guest experts for exactly what is shared with them, until their access expires. Delsivo staff can open a fund's workspace only read only and only when a fund admin grants time-limited access.

8. 08Where data is stored and transfers

   Delsivo runs in one hosting region at launch, chosen with design partners. [TODO: name the region once chosen.] Some providers above, such as Anthropic and OpenAI, process data in the United States. Where the GDPR or UK GDPR applies, we rely on the European Commission's standard contractual clauses and the UK International Data Transfer Addendum, or another valid transfer mechanism. Under the DPDP Act, transfers outside India are permitted except to countries the Central Government restricts; we will stop any transfer to a restricted country. [TODO: confirm transfer mechanisms with each provider and list them.]

9. 09How long we keep data

   Data	Kept for
   Decks, transcripts and room documents	Kept until the fund deletes the deal, or by the fund's own retention settings
   Interview recordings (camera, microphone and screen)	Set by the fund for each recording, separately from transcripts
   Audit and security logs	1 year
   AI call logs (no document text)	90 days
   Fund team accounts	While the account is active, then [TODO: period] after the fund's subscription ends
   Enquiries, design partner requests and the waitlist	[TODO: period, for example 24 months after the last contact]

   When founder content is deleted, access stops at once, and then the files, previews, extracted text, search index entries and other derived copies are removed. Consent and notice records are kept, de-identified, as proof. Backups age out on a rolling schedule. [TODO: backup retention period.]

10. 10How we protect data

    • Each fund's data is kept apart in the database itself, and one permission check applies to pages, search, AI answers, notifications and exports.
    • Founder portals run on a separate domain from the investor app, with sign-in sessions bound to the fund's portal.
    • Files are stored privately, encrypted at rest and scanned for malware before anyone can preview them or AI can read them. Downloads use short-lived links issued after a permission check.
    • Two-factor sign-in is required for Delsivo staff, fund admins and partners. Audit, security and AI logs are kept in a separate database.
    • Public forms are protected with Cloudflare Turnstile and rate limits. Passwords, codes, deck text and transcript text are never written to logs.

    These controls are designed and planned; none is certified. No system is perfectly secure. If a personal data breach happens, we will tell the affected fund without undue delay so it can meet its duties, and notify authorities and affected people directly for data we control, as the law requires. More detail: Security at Delsivo.

11. 11Your rights

    GDPR and UK GDPR. You have the right to access, rectification, erasure, restriction, data portability and to object, and the right not to be subject to a decision based solely on automated processing.

    DPDP Act. You can ask for a summary of your personal data and how it is processed, ask for it to be corrected, completed, updated or erased, withdraw consent, nominate someone to exercise your rights if you die or become incapacitated, and have grievances addressed.

    CCPA. California residents can ask to know, delete and correct personal information and to limit the use of sensitive personal information, and won't be treated differently for doing so. This section is our notice at collection: the categories we collect and why are listed above. We don't sell or share personal information.

    Founders: send requests to the fund you applied to, or use the privacy options in your founder workspace. You can also write to us at [TODO: privacy contact email, for example privacy@delsivo.com], and we will pass the request to the fund and help it respond. Everyone else: write to us directly. We respond within one month, and may need to confirm your identity first.

12. 12Grievance officer and complaints

    Under the DPDP Act, our grievance officer is [TODO: grievance officer or privacy contact name], reachable at [TODO: grievance officer email] and [TODO: registered office address]. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

    Where the GDPR applies, you can complain to the supervisory authority where you live or work. In the UK, that is the Information Commissioner's Office (ICO). [TODO: name an EU and UK representative if required under Article 27.]

13. 13Children

    Delsivo is meant for adults evaluating or raising investment. Funds must not accept applications from anyone under 18. If we learn that we hold a child's data, we will ask the fund to remove it and delete it.

14. 14Changes to this policy

    We will update this page when our practices change and change the date at the top. For significant changes, we will tell fund admins by email before they take effect, so funds can update the notice their founders see.

15. 15Contact

    Privacy questions: [TODO: privacy contact email, for example privacy@delsivo.com]. Anything else: hello@delsivo.com. Post: [TODO: company legal name], [TODO: registered office address].