1. Controller
The controller responsible for processing personal data under the GDPR is:
2. Access data & server logs
When you visit this website, our hosting provider (Cloudflare) automatically processes information that your browser sends to the server:
- anonymized or truncated IP address
- date and time of the request
- URL requested
- referrer URL (if transmitted)
- browser, operating system, and language
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in technically correct delivery and protection against attacks). This data is not combined with other data.
3. Contact forms
This website offers three forms through which you can reach us directly. In all cases, we process the data you submit solely to handle your request.
3.1 Limited Partner inquiry (/investors)
When you submit the LP form, we process: name, email address, organization, jurisdiction, LP type, indicative ticket size, investment horizon, accredited investor status, and any free-text notes. This data is mirrored into our CRM (Notion) and used to prepare an initial conversation and to internally classify your request.
Legal basis: Art. 6(1)(b) GDPR (steps prior to entering a contract) and Art. 6(1)(a) GDPR (consent).
3.2 Pitch deck submission (/submit)
When you submit a pitch deck, we process: name, role, email address, company name, website, founder LinkedIn profile, sector, stage, one-line description, indicative ask, and the PDF document you upload. The PDF is stored in a protected Google Drive folder; metadata is mirrored into our CRM (Notion).
Additionally, the document may be processed by an AI model (Anthropic / Claude) to extract structured information such as market, team, and traction. The extracted fields are stored in the CRM; the document itself is not used by Anthropic for model training.
Legal basis: Art. 6(1)(b) GDPR (steps prior to entering a contract) and Art. 6(1)(f) GDPR (legitimate interest in efficient deal-flow analysis).
3.3 Press inquiry (/press)
When you send a press inquiry, we process: name, email address, outlet/publication, role, topic, deadline, and your free-text message. This data is used solely to respond to your inquiry.
Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(f) GDPR (legitimate interest in press relations).
4. Hosting (Cloudflare)
This website is hosted on Cloudflare Pages by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA). When you access the site, Cloudflare processes technical connection data (in particular your IP address) to deliver the content and to mitigate attacks.
A data processing agreement is in place with Cloudflare. Transfers to the United States are based on the EU–US Data Privacy Framework and on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
5. Fonts
We use the typefaces "DM Sans" and "DM Mono", served via Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). These fonts are not loaded by default. They are loaded only after you give explicit consent through the privacy banner. Without consent, the site falls back to your operating system's default fonts.
If you consent, your browser establishes a connection to Google servers and transmits your IP address. The legal basis for this processing is Art. 6(1)(a) GDPR (consent) in conjunction with § 25(1) TTDSG. You can withdraw your consent at any time via the "Privacy settings" link in the footer.
6. External processors
To handle inquiries received via the forms, we use the following providers as processors within the meaning of Art. 28 GDPR:
Notion (CRM)
Notion Labs, Inc., 2300 Harrison St., San Francisco, CA 94110, USA. We use Notion to manage inquiries, deal flow, and press contacts. Based in the US — see Section 7.
Google Workspace / Google Drive
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for EU users). We use Google Drive to store submitted pitch decks. Transfers to servers in third countries may occur.
Resend (transactional email)
Resend, Inc. (USA). Resend is used to send notification emails about form submissions to us. Based in the US — see Section 7.
Anthropic / Claude (AI pre-analysis)
Anthropic, PBC, 548 Market St. PMB 90375, San Francisco, CA 94104, USA. We use the "Claude" AI model via the Anthropic API to extract structured information from submitted pitch decks. Processing takes place under a data processing agreement; under Anthropic's commercial terms, submitted content is not used for model training.
7. Transfers outside the EU
Some of the providers listed above are based in the United States. Personal data is therefore transferred to the US. These transfers are based on the EU–US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023) and, additionally, on Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
Despite these safeguards, there is an increased risk of access to personal data by US authorities. By using our forms, you consent to this transfer (Art. 49(1)(a) GDPR).
8. Cookies & local storage
No tracking or marketing cookies are set on this website. We use the following storage entries:
- cc_consent — cookie and localStorage entry that remembers your choice from the privacy banner (whether you allow non-essential services such as Google Fonts). Lifetime: 12 months. Strictly necessary for the banner to remember your decision. Legal basis: § 25(2)(2) TTDSG (technically required).
- cc_auth — set only on non-public sections of the site to maintain a login session (HttpOnly, Secure, SameSite=Strict). Strictly necessary. Legal basis: Art. 6(1)(f) GDPR and § 25(2)(2) TTDSG.
You can review or change your choice at any time via the "Privacy settings" link in the footer of every page. You can also delete the cc_consent entry in your browser settings; the banner will then appear again on your next visit.
9. Retention periods
- Server logs: usually a maximum of 30 days, then deleted or anonymized.
- Form inquiries (LP, press): up to 24 months from last contact, then deleted — unless contractual or statutory retention obligations apply.
- Pitch deck submissions: usually up to 36 months from receipt; longer in case of an ongoing relationship or a legally justified interest.
10. Your rights
You have the following rights with respect to the personal data we hold about you:
- right of access (Art. 15 GDPR)
- right to rectification (Art. 16 GDPR)
- right to erasure (Art. 17 GDPR)
- right to restriction of processing (Art. 18 GDPR)
- right to data portability (Art. 20 GDPR)
- right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR)
- right to object to processing (Art. 21 GDPR)
To exercise your rights, an informal message to [email protected] is sufficient.
11. Right to lodge a complaint
Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority. The competent authority for us is:
12. Changes to this policy
We update this privacy policy when legal requirements or the services we use change. The current version is always available on this page.
Last updated: May 2026.