Privacy Policy

Wise Start Inc, a Delaware corporation licensed to do business in Florida, doing business as StartWise (“StartWise,” “Wise Start,” “we,” “us,” or “our”), operates the website at start-wise.io, the StartWise web app, the Atlas mobile app, and related services, including the data rooms described in section 14 (together, the “Service”). This Privacy Policy explains what personal information we collect, why we collect it, who receives it, how long we keep it, and the choices you have. By using the Service, you agree to this Policy. If you do not agree, please do not use the Service.

This Policy covers people who use the Service, people who visit our website or use our free tools without an account, and people whose information is processed through the Service even though they have no account, such as investors listed in our investor database, people our users contact or correspond with, and people who open a data room link.

Wise Start Inc is the controller responsible for the personal data described in this Policy, except where we process information on behalf of a user. The main example is a data room: the founder who owns the room decides whom to invite and what to share, and we process viewers’ information on that founder’s behalf (see section 14).

Various privacy laws may apply to our processing of your personal data depending on where you are located and whether our business meets a given law’s applicability thresholds. Where a privacy law applies to our processing, we honor the rights and obligations it establishes. This Policy describes our general practices; it is not a representation that any particular law applies to, or that we are certified under any framework for, every user or every activity.

This Policy is incorporated into our Terms of Service.

Information you give us

• Account and profile data: name, email address, password or one-time sign-in codes, role (founder, investor, project manager, accelerator or university program, mentor, or admin), organization, photo, links to your professional profiles, a phone number if you verify one, and other profile details.
• Venture and business content: ideas, websites, business plans, pitch decks, financial models, research, documents you upload, your answers in our tools, and the facts the AI Co-Founder saves about your venture.
• Communications: messages with other users, support requests, feedback, booking requests, questions asked in data rooms, and voice recordings when you use a voice feature.
• Information about other people: contacts you add or import, investors you track, people you write to through Outreach or the Master Inbox, data room viewers you invite, team members, program applicants, and mentors. See section 7.
• Payment information: billing details and transaction records. Card details are handled by our payment processors, and we do not store full card numbers.

Information from accounts you connect

If you sign in with Google, or connect Google (Calendar or Gmail), Microsoft (Outlook mail or calendar), LinkedIn, WhatsApp, Instagram or Telegram, we receive information from that account as described in sections 3 and 4.

Information collected automatically

• Usage data: pages viewed, features used, clicks, actions taken, and timestamps, including recordings of how you use our site and app (see section 15).
• Device and log data: IP address, browser type, device identifiers, operating system, and referring URLs. We also use IP addresses to limit abuse of our free tools.
• Cookies and similar technologies: as described in section 15.

Information from other sources

• Public sources: U.S. Securities and Exchange Commission (SEC) records such as Form D filings and investment adviser registrations, company and fund websites, public professional profiles and posts, public video channels, and public web search results.
• Data providers: business email addresses and professional profile links (Hunter.io), public LinkedIn profile and post data (Apify and Bright Data), AI-assisted web research (Perplexity), and company logos (Clearbit).
• Other users: when someone shares a venture or data room with you, invites or books you, applies to your program, adds you as a contact, or corresponds with you through an account they connected.
• Partners: our referral partner platform (Tolt) tells us when you arrived through a partner’s link, and app stores tell us about purchases made there.

This section describes how StartWise handles data obtained through Google APIs. Where it is more specific than the rest of this Policy, it controls.

What Google data we access

• Google sign-in and Google One Tap: your basic Google profile information (name, email address, and profile picture) to create and sign in to your StartWise account.
• Google Calendar: if you connect your calendar for mentorship, Atlas, or meeting booking, we request https://www.googleapis.com/auth/calendar.events, which lets us read your calendar events and create, update, or cancel events on your calendar.
• Gmail: if you connect Gmail for Outreach or the Master Inbox, we request https://www.googleapis.com/auth/gmail.readonly and https://www.googleapis.com/auth/gmail.send, which let us read your messages and send email from your address.

How we use it

• to authenticate you and sign you in to your StartWise account;
• to show your availability and hide times you are already busy, so others cannot double-book you;
• to create, update, or cancel the event for a meeting booked through StartWise, including a Google Meet link and the invitation to its participants;
• to send the emails you write, approve, or schedule from StartWise, including steps of an Outreach sequence you started, and to detect replies so a sequence stops when someone answers;
• to keep a synced copy of your recent conversations in the Master Inbox (the last 30 days, or 90 or 180 days if you choose to load more), so you can read, search, sort, and reply in one place;
• when you use Master Inbox AI features, to send the text of the relevant messages to our AI providers so they can rank and summarize conversations, draft replies, answer your searches, and write your daily briefing, and, unless you turn off “Write drafts in my voice” (it is on by default), to learn your writing style from messages you have sent;
• to recognize the people you correspond with, so they appear as people in your Master Inbox, and to add their names and contact details to the contact directory described in section 7.

What we never do with Google user data

We do not use Google user data for advertising, retargeting, credit assessment, resale, or lending. We do not use it to train, develop, or improve general artificial-intelligence or machine-learning models, and AI providers receive it only to return the result of a feature you are using. We do not transfer it to anyone except as needed to provide the features described above, for security, to comply with law, or as part of a merger, acquisition, or sale of assets. No person at StartWise reads your Gmail messages or calendar data unless you ask us to for support, it is needed to investigate security or abuse, or the law requires it.

Retention and revoking access

We store the OAuth tokens for a Google connection only while it is connected, and delete them when you disconnect it or delete your StartWise account. Calendar availability is read live when it is displayed; we keep the details of meetings booked through StartWise, including the identifiers of the events we created, so those meetings can be updated or cancelled. While Master Inbox syncing is on, Gmail conversations older than your chosen history window are removed. Conversations already synced stay, including after you disconnect Gmail or turn syncing off, until you delete the synced copy (see section 4) or your account. Emails sent by Outreach, and the replies that stop a sequence, are kept with the campaign until you delete it or your account. You can disconnect at any time inside StartWise (calendar settings in the mentor studio or Atlas, or the accounts page in Outreach or the Master Inbox), or by removing StartWise’s access in your Google Account under Security → Third-party apps & services.

Limited Use

StartWise’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can connect your own accounts to send outreach, run the Master Inbox, and schedule meetings. Each connection is optional, and you can disconnect it at any time.

• Google: Gmail and Google Calendar, as described in section 3.
• Microsoft Outlook mail: we request Mail.ReadWrite and Mail.Send through Microsoft Graph to read your messages, send the emails you write, approve, or schedule, detect replies, and keep the Master Inbox copy described below.
• Microsoft calendar: we request Calendars.ReadWrite and MailboxSettings.Read to show your availability, create and update meetings booked through StartWise, and read settings such as your time zone.
• LinkedIn, WhatsApp, Instagram, and Telegram: these connect through our provider Unipile. The sign-in details you enter are passed to Unipile to create the connection, and StartWise does not keep your password. Through the connection we read your conversations and contacts, receive new messages as they arrive, search LinkedIn for people when you ask, and carry out the actions you set up in Outreach, such as messages, connection invitations, profile visits, and endorsements, within daily limits.

What we store

• the conversations from your connected accounts within your Master Inbox history window (30 days by default, extendable to 90 or 180 days), together with drafts and AI briefings;
• the contacts from your connected messaging accounts (names, profile links, phone numbers where the app shows them, and profile photos, which we copy into our storage so they load reliably), which are also added to your Atlas contacts;
• the messages Outreach sent for you, their status, and the replies they received.

Syncing runs in the background every few minutes while an account is connected. The Master Inbox also writes a daily AI briefing of your conversations and, unless you turn the email off, emails it to you.

Your controls

• Disconnect an account from Outreach or the Master Inbox at any time. Disconnecting a messaging account removes the connection at Unipile and the contacts we synced from it; contacts already copied into Atlas stay until you delete them.
• “Delete the synced copy” in Master Inbox settings removes every conversation, message, draft, and briefing stored for your Master Inbox and pauses syncing. Your email and chat accounts themselves are not changed.
• Turn off “Write drafts in my voice,” “Keep syncing,” or the briefing email in Master Inbox settings.

The people in your conversations have not signed up to StartWise. Section 7 explains how we handle their information, and our Terms explain your responsibility for contacting them lawfully.

• provide, operate, maintain, and secure the Service, and prevent fraud, spam, and abuse;
• create and manage your account and authenticate you, including with one-time codes sent by email and, for some profile claims, by text message;
• generate the AI output you request, such as business plans, decks, financial models, research, outreach drafts, inbox summaries and briefings, pitch practice feedback, and profile drafts;
• remember facts about your venture (the AI Co-Founder’s memory) and use them as context across features, including outreach drafts;
• match founders with investors, mentors, and programs;
• run the features you turn on, such as Outreach sequences, the Master Inbox, calendar booking, Atlas, data rooms, mentorship, Expert Review, and accelerator programs;
• build and maintain the investor database and contact directory (section 7);
• process payments, subscriptions, credits, refunds, and mentor payouts;
• send service messages, such as sign-in codes, booking confirmations, receipts, briefings, and alerts, and, where permitted, marketing about StartWise that you can opt out of. Notification emails include an unsubscribe link;
• understand how the Service is used and improve it, using product analytics and error reports (section 15);
• measure our advertising if you accept marketing cookies, and credit referral partners;
• publish aggregate statistics, such as rounded counts of funds, partners, and recent filings in our database, that do not identify anyone;
• comply with legal obligations, enforce our Terms, and protect our rights and users.

Data obtained through Google APIs is used only as described in section 3.

Many features use AI. When you use one, we send the information that feature needs to an AI provider, which processes it and returns the result. Depending on the feature, this can include your venture details and documents, your messages to the AI Co-Founder and its memory of your venture, inbox messages, contact details, website content, images, and audio.

Which providers we use

• Language models: OpenAI, Anthropic (Claude), Google (Gemini, reached directly and through the Lovable AI gateway), and Perplexity (for web research). We choose the model for each feature and may change it.
• Models you pick: Prompt Studio and some writing tools let you choose a model. Your prompt then goes to that model’s provider, which may include DeepSeek, Mistral, or xAI (Grok) when we offer their models.
• Speech: OpenAI (Whisper) and ElevenLabs transcribe voice, and ElevenLabs produces the investor’s voice in pitch practice.
• Images: Fal.ai generates images you ask for.
• Data rooms: the data room assistant and investor Q&A use Anthropic (section 14).

Features that process information about other people

• Master Inbox: messages from your connected accounts (sections 3 and 4).
• Outreach drafts: your venture details, the AI Co-Founder’s memory, and what we know about the person you are writing to.
• Atlas: the Atlas assistant uses your contacts, notes, documents, and events as context. Scanning a business card sends the photo to Anthropic and, in the mobile app, may also send it to Google Cloud Vision for text extraction. Write with AI sends the text you are editing and your instruction. Profile generation reads your public professional profile and website. Atlas can read a contact’s recent public LinkedIn posts to suggest how to write to them, and can read an event page you add.
• Investor research: AI models research funds and partners from public sources (section 7).
• Program applications: accelerators can use AI to score how well an application fits their program (section 10).

Voice

• In pitch practice, your voice is sent to ElevenLabs for transcription, the investor’s replies are spoken by ElevenLabs, and Anthropic grades the transcript. The transcript and feedback are saved with your session.
• Voice input in the Master Inbox is transcribed by OpenAI (Whisper).
• Voice notes in Atlas on the web use your browser’s built-in speech recognition. Some browsers, such as Google Chrome, send the audio to their maker’s speech service to transcribe it. In the Atlas mobile app, voice notes use your device’s speech recognition.

Atlas mobile app

The Atlas mobile app asks for your permission before its AI features first run, and you can withdraw it at any time under Me → data & privacy. When you connect your own professional profile, its public URL is sent to Apify and Bright Data, which return publicly available profile information.

AI Co-Founder memory

The AI Co-Founder saves lasting facts about your venture, such as its stage, market, and goals, so it does not have to ask again, and reuses them in other features such as outreach drafts. This memory is deleted when the venture or your account is deleted. To see or remove specific saved facts, contact [email protected].

Model training

StartWise does not use your content, the data from your connected accounts, or data room content to train AI models. Our AI providers process the information we send to return a result to us, under their terms for business and API customers. Those terms govern how long each provider keeps that information, for example for abuse monitoring.

AI output may be inaccurate and should be independently verified. See our Terms of Service for details.

The Service holds information about people who have not signed up, such as investors, people our users contact, and people who open a data room. This section explains where that information comes from, why we use it, and how those people can reach us.

Investor database

• Sources: SEC Form D filings (people a filing names as related persons, such as executive officers, directors, and promoters), SEC investment adviser registrations, fund and company websites, public professional profiles, news and web research by AI tools (Perplexity), and business email addresses found by Hunter.io. Our team also adds investor profiles, which the person can later claim.
• What we hold: name, role and firm, investment focus, location, public professional links, a business email address when one is found, and where each detail came from.
• Why: to help founders find investors relevant to their company and contact them about it. Where the law requires a legal basis, we rely on our legitimate interest in helping founders and investors find each other.
• Who sees it: founders using the Service. Some details are shown only after a founder unlocks a match with credits.

Contact directory

To help founders complete the details of people they already know, we keep a shared directory of professional contact details. It combines records from the investor database, investor and partner contacts, StartWise profiles and public pages, mentors, program applicants, team members, contacts that users add to Atlas or import for Outreach, and people who appear in the email and messaging accounts that users connect. Records that refer to the same person are merged. When a founder asks for a missing detail about one of their contacts (an email address, a LinkedIn, X, or Instagram profile, or a phone or WhatsApp number), we answer from the directory and, for email addresses and profile links, from Hunter.io. The founder spends credits for each detail found. Founders cannot browse the directory. This means a contact detail that came from one user’s connected account, or from a StartWise profile, can be given to another user who asks about that person.

Atlas enrichment

• When you add a contact or connect your own profile in Atlas, we look up public LinkedIn profile information through Apify and Bright Data and copy profile photos into our storage.
• If you run a deep scan of your network, we collect public information about the people who engage with your LinkedIn posts.
• Atlas can read a contact’s recent public posts to suggest a tone for writing to them.

Other people in the Service

We also process information about people our users write to through Outreach, people in their connected mailboxes and chats, data room viewers (section 14), people who book a meeting through a public profile (section 8), program applicants, and team members. Our users are responsible for having a lawful reason to share that information with us and to contact those people (see our Terms).

Your choices if we hold your information

If you think we hold information about you, email [email protected] to ask what we hold, to correct it, or to have it deleted. We may ask you to verify that the information is about you. Because the investor database is refreshed from public sources such as new SEC filings, a record we delete can be added again from a later source; if that happens, tell us and we will delete it again. You can also object to our use of your information at any time.

Aggregate statistics

We publish rounded counts from our database, such as the number of funds, partners, and recent filings. These statistics contain no names or individual records.

• Investor, venture, and accelerator pages: profiles can have public pages that anyone can view and search engines can index. What appears depends on what you, or our team for an unclaimed profile, entered and on your settings.
• Atlas public profile: if you publish one, the profile Atlas generates from your public professional profile and website appears at a public link. Visitors can book a meeting with you by giving their name and, optionally, their email address. We add the meeting to your connected calendar, which shows you their details and, if they gave an email address, sends them the invitation.
• Unclaimed profiles and claims: our team may create a profile for an investor or venture that has not signed up, using public information, and may email the person an invitation to claim it. Claiming a profile may require verifying your phone number with a text message code, sent through Brevo or Firebase Authentication. To have an unclaimed profile about you removed, contact [email protected].
• Program application pages: applications submitted through an accelerator’s public page go to that program (section 10).

• Website reader: when you type a website on our homepage, our servers fetch that site to show its name and logo. If you are signed in, AI also reads the site to fill in your venture profile. If our servers cannot read a site directly, we may use Jina Reader to fetch it. Your browser loads the site’s icon from Google’s and DuckDuckGo’s icon services, which receive the domain you typed. We keep what you typed in your browser’s local storage for up to an hour, so you can continue after signing up.
• Deck Check and validation tools: you can upload a deck or answer questions without an account. AI processes your input, and we store the report so you can claim it by signing up. Reports and uploads that are never claimed stay stored until you ask us to delete them.
• Investor Exam: creates an anonymous account for your session, with a draft venture and matched investors, so you can keep them if you sign up.
• Atlas chat without signing in: a small number of messages a week, processed by Anthropic.
• Google sign-in prompt: our homepage and free tools can show Google’s sign-in prompt (One Tap). To do this your browser loads a Google script, so Google receives your IP address and may read its own cookies, under Google’s privacy policy.
• Abuse limits: we record IP addresses with requests to our free tools to limit how often they can be used.

• Accelerators and university programs: when you apply to a program, your application, venture details, and profile go to that program’s team. The program may use AI screening that gives each application a fit score and a recommendation; the program’s team makes the decision. Programs also see the progress and materials you share with them as a member of a cohort.
• Mentorship: when you book a mentor, we share your name, email address, booking details, and messages with the mentor, and the meeting is created on the mentor’s connected calendar with a video link. If a booking is disputed, StartWise staff read the dispute conversation to resolve it. Our team may set up a mentor’s profile from the mentor’s public video channel (through the YouTube Data API) and professional profile before inviting the mentor to claim it.
• Expert Review: if you buy an Expert Review, a human reviewer chosen by StartWise (a member of our team or an expert we engage) reads the documents you submit and writes the review.

• Stripe processes payments for subscriptions, credit packs, Expert Review, mentor bookings, and courses. We receive payment status and transaction records, not full card numbers.
• If you subscribe in the Atlas mobile app, Apple or Google handles the payment, and RevenueCat tells us about the purchase so we can unlock your plan.
• Mentors who receive payouts give their identity, tax, and bank details directly to Stripe Connect.
• If you arrived through a partner’s referral link and then sign up, we send Tolt your email address and account identifier so the partner can be credited. This happens on our servers whether or not you accept marketing cookies.
• If you accepted marketing cookies, when you pay we send OpenAI an advertising conversion event containing a hashed (SHA-256) email address, a hashed account identifier, your IP address, and your browser’s user agent, so we can measure our ads.
• We record how you use credits, including AI runs that failed and were refunded automatically.

Where the law requires a legal basis (for example under the GDPR), we rely on:

• Performance of our contract with you: running your account and the features you use, including connected accounts, and processing your payments.
• Legitimate interests: securing the Service and preventing abuse, improving it with analytics and error reports, building the investor database and contact directory, enriching contacts from public sources, publishing aggregate statistics, and telling existing customers about StartWise. We weigh these interests against your rights, and you can object at any time.
• Consent: marketing cookies and ad measurement, AI features in the Atlas mobile app, and anything else we ask your permission for. You can withdraw consent at any time without affecting earlier processing.
• Legal obligations: tax, accounting, and responding to lawful requests.

For data room viewers, the founder who owns the room decides the legal basis for collecting viewers’ information (section 14).

We do not sell lists or databases of personal information. We share information only as follows:

• With other users at your direction or as a feature works: for example when you share a venture, message an investor, grant data room access, apply to a program, book a mentor, publish a public profile, or when a founder unlocks an investor match or asks the contact directory for a detail (section 7).
• With service providers (subprocessors) who process data on our behalf under confidentiality and data-protection obligations. Each receives only what it needs for its function. By category:
  • hosting, database, authentication, and storage: Supabase, and Amazon Web Services for our document rendering service;
  • data rooms: our Dataroom service and its providers (Supabase, Anthropic, Brevo, and Sentry);
  • payments: Stripe (including Stripe Connect), RevenueCat, and the Apple and Google app stores;
  • AI models: OpenAI, Anthropic, Google, the Lovable AI gateway, Perplexity, DeepSeek, Mistral, xAI, ElevenLabs, and Fal.ai;
  • data and enrichment: Hunter.io, Apify, Bright Data, Jina, Clearbit, Pexels (stock photo search terms), and the YouTube Data API;
  • connected accounts and messaging: Unipile, Google (Gmail and Calendar APIs), and Microsoft (Graph);
  • email and text messages: Google Workspace (Gmail), Resend, Brevo, and Firebase Authentication;
  • document processing: Adobe PDF Services and PDF.co;
  • analytics, monitoring, and marketing: PostHog, Sentry, Tolt, and OpenAI (ad measurement);
  • sign-in: Google Identity Services;
  • MVP builder: Reflex, the platform our MVP builder runs on, which receives your email address to set up your builder account.
• For legal reasons: to comply with law, respond to lawful requests, enforce our Terms, or protect the rights, safety, and property of StartWise, our users, or the public.
• In a business transfer: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With your consent: for any other purpose disclosed at the time.

How data rooms work

Data rooms are provided by Dataroom, a separate service that is part of the Service. It runs on its own systems, with its own application, database, and web address, and it processes data room content and viewers’ information on our behalf. We create a data room for each venture, sign you in to it from StartWise with a one-time ticket, and file the documents you send to it from StartWise. Investors and other viewers open a room through a link in their own browser and do not need an account.

What a data room records about viewers

• the viewer’s email address and, when the room owner requires it, a one-time code sent to that address to verify it, and a check of any passcode the owner set;
• NDA acceptance: the exact NDA text, a fingerprint (hash) of it, the name the viewer typed, their IP address, browser, and the time. The database blocks edits to and deletion of this record, and a receipt is emailed to the viewer;
• a session cookie on the Dataroom web address, which lasts up to 24 hours;
• reading activity: which documents a viewer opens, which pages they view, how long they spend on each page (each page view counts up to two minutes), when they leave, and their downloads;
• watermarks: pages can show the viewer’s email address and the date, and downloaded PDFs are stamped with the viewer’s email address and the time, and may carry a short code derived from the viewer’s network (a keyed hash, not the IP address itself);
• questions viewers ask the room’s AI assistant, when the owner turns it on, and its answers;
• an audit log of access events, such as code requests, sign-ins, NDA signatures, downloads, and link changes, which the database keeps append-only (entries are not edited or deleted).

What the room owner sees

The founder who owns a room sees who opened it and when, which documents each viewer opened and how far they read, who is reading right now and for how long, a reading funnel and page drop-off, NDA signatures, downloads, and questions. By asking the room’s assistant, the owner can also see an engagement score for the most engaged viewers, worked out with a fixed formula from recency, reading depth, and repeat visits.

We are adding data room features that use the reading activity described above: showing the owner how long each viewer spent on each page, notifying the owner when someone opens or reads a document (including how long they read), and letting the owner require approval before a person gets access, in which case the viewer’s access request, with their email address and any message they add, goes to the owner. Where these features are available in a room, they work as described here.

AI in data rooms

The owner’s data room assistant and, if the owner turns it on, the investor Q&A use Anthropic and can read only the folders the owner allows. Dataroom sends access codes and NDA receipts by email through Brevo.

What stays inside the data room

Data room content is not fed into Atlas, the AI Co-Founder, the contact directory, or any other StartWise feature, and neither are viewers’ identities or reading activity, with one exception: once the owner features above are available, Dataroom tells StartWise who viewed which document, for how long, and who asked for access (the viewer’s email address, name, and company, the link name, the document title, and reading times, but not their IP address, browser, or NDA text), so StartWise can show the owner, and only the owner, notifications and emails, the activity on that investor’s record, and a line in the owner’s Master Inbox briefing. Until then, StartWise itself keeps only the link between your venture and its room, the identifiers of documents it filed for you, and when you last opened the room.

Roles and responsibility

The founder who owns a room decides whom to invite, what to share, and which settings to use, and is responsible for viewers’ information as its controller; StartWise and Dataroom process it on the founder’s behalf. Viewers who want to access or delete their information should contact the founder, and can also write to [email protected]. When you share a room or other content, recipients can view and, if you allow it, download what you share. Watermarks discourage leaks but cannot stop screenshots or copies. We provide access controls but are not responsible for how recipients use content you choose to share with them.

We use cookies and similar technologies, including your browser’s local storage, for the following purposes:

• Strictly necessary: keeping you signed in (our authentication provider stores your session), the data room viewer session cookie, the record of your cookie choice (sw_cookie_consent), and security. These are required for the Service to work and cannot be switched off.
• Functional: your preferences and settings, what you typed in the homepage website reader (kept for up to an hour), markers that let you claim a free report after signing up, and your Google sign-in prompt settings.
• Product analytics (PostHog): pages viewed, clicks, page exits, performance, errors, heatmaps, occasional surveys, and session recordings that replay how you used a page, with form inputs masked. When you sign in, we link this data to your account and email address. Product analytics is not part of the Marketing choice in our cookie banner.
• Error monitoring (Sentry): reports application errors so we can fix them, with query strings removed from URLs.
• Marketing, only if you accept: the Tolt referral script and the OpenAI advertising pixel and conversion measurement (section 11).
• Third-party content: Google’s sign-in prompt and the icon services described in section 9.

Our cookie banner offers Essentials only, Manage settings, and Accept all. To change your choice later, clear this site’s stored data in your browser and the banner will ask again. You can also block or delete cookies in your browser, though some features may stop working. We do not currently respond to Do Not Track or Global Privacy Control signals.

We keep personal data for as long as your account is active and as needed to provide the Service, then for the period required to comply with our legal obligations, resolve disputes, and enforce our agreements. When data is no longer needed, we delete or anonymize it. More specifically:

• Your account: you can download a copy of your data and delete your account yourself in Settings. Deleting your account removes your profile, your ventures and their data rooms, your calendar and mailbox connections, the AI Co-Founder’s memory, your outreach drafts, and other associated data, except records we must keep.
• Master Inbox: while syncing is on, conversations older than your chosen history window are removed. Synced conversations stay after you disconnect an account or turn syncing off, until you delete the synced copy (section 4) or your account.
• Connected accounts: access tokens are kept until you disconnect the account or delete your StartWise account.
• Data rooms: documents stay until the owner removes them, deletes the room, or deletes their account. NDA acceptance records and the audit log are kept as permanent records, including after a room is deleted. To delete a single venture’s data room while keeping your account, contact [email protected].
• Free tools: reports, uploads, and anonymous Investor Exam accounts are kept so they can be claimed, until you ask us to delete them.
• Investor database and contact directory: kept while they remain useful for the Service, or until a person asks us to correct or delete their record. Contact details that came from a user’s contacts or connected accounts stay in the directory after that user disconnects the account or deletes their StartWise account.
• Security records: one-time codes expire within minutes; IP addresses used for abuse limits are kept for abuse prevention.
• Payments: transaction and tax records are kept as long as the law requires.

Deleted data may remain in backups for a limited time before it is overwritten. Content you shared with other users, or that others created in connection with you, may persist where we cannot delete it without affecting those users’ records.

We implement administrative, technical, and organizational measures designed to protect your information, including encryption in transit (HTTPS), database row-level security that isolates each user’s data, role-based access controls, activity and audit logging, and automatic session timeouts. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your credentials confidential.

Privacy laws differ by location, and not every law applies to every business or every activity. The rights described below may be available to you depending on where you live and whether the relevant law applies to our processing of your personal data. Where a right applies to you, we will honor it. You can exercise any available right, or simply ask us what data we hold, by contacting [email protected]. These rights are also available to people who do not have an account, such as investors in our database. We may need to verify your identity before responding, and we will not discriminate against you for exercising your rights.

Controls in the Service

• download a copy of your data, or delete your account, in Settings;
• disconnect Google, Microsoft, and messaging accounts at any time;
• delete the Master Inbox synced copy, and turn off style learning or syncing;
• remove documents, revoke links, and change settings in your data rooms;
• choose Essentials only in our cookie banner;
• unsubscribe from notification emails using the link in each email.

If you are in the EEA, UK or Switzerland

If and to the extent the GDPR (or UK GDPR) applies to our processing of your personal data, you may have the right to access your data; to have it corrected or erased; to restrict or object to certain processing; to data portability; and to withdraw consent at any time (without affecting prior processing). You also have the right to lodge a complaint with your local data protection authority. Our legal bases for processing are described in section 12.

If you are a U.S. state resident

Several U.S. states (for example California, Colorado, Connecticut, Texas, Virginia, and others) have comprehensive privacy laws. Where one applies to our processing, you may have the right to confirm whether we process your personal data; to access, correct, or delete it; to obtain a portable copy; and to opt out of targeted advertising, certain profiling, or any “sale” or “sharing” of personal information. We do not sell lists or databases of personal information. Some state laws define “sale” and “sharing” broadly, and the contact directory (section 7), where founders spend credits to receive a person’s contact detail, and ad measurement (sections 11 and 15) may fall within those definitions. To opt out, email [email protected], and for ad measurement choose Essentials only in our cookie banner. To the extent the California Consumer Privacy Act (as amended by the CPRA) applies to us, the categories of personal information we collect, the sources, the business purposes for collecting them, and the categories of recipients are described in sections 2 through 14 above. You may also designate an authorized agent to make a request on your behalf.

Automated processing

The Service uses automated processing and AI to generate content you request, to rank investor matches and inbox conversations, to give data room viewers an engagement score, and to help programs score applications. These features produce drafts, rankings, and suggestions for people to review; they do not make decisions that produce legal or similarly significant effects about you without human involvement. Where applicable law gives you rights regarding automated decision-making, we will honor them.

We operate from the United States, and most of our providers process data in the United States. Some providers process data elsewhere: for example, Brevo is based in the European Union, and if you choose a model from a provider outside the United States (such as Mistral in France or DeepSeek in China), your prompt is processed by that provider in its country. Where required, we use appropriate safeguards (such as standard contractual clauses) for cross-border transfers of personal data.

The Service, including Atlas and our free tools, is not directed to children under 18, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact [email protected] and we will take steps to delete it.

We may update this Privacy Policy from time to time, including when we add features. We will update the “Last updated” date and, for material changes, provide additional notice where appropriate. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

Questions or requests about your privacy, or about information we hold about you? Contact Wise Start Inc at [email protected].