Privacy Policy
Effective: October 30, 2026 · Last updated: October 30, 2026 · Version 2.0
Gatekeep is the controller of the account and workspace data described below. This policy explains what we collect, how we use it, when we share it, how long we keep it, and the choices available to you. It covers founders, investors, anonymous demo users, and visitors.
AI processing is explained in Section 10. If you use Bring Your Own Key (BYOK), your selected provider processes data under its own terms. Gatekeep does not control or guarantee that provider's training, retention, or data-location practices.
1. What we collect
We collect information you provide, information generated by your use of Gatekeep, and limited technical information needed to operate and secure the service.
- Account and identity data: name, email address, profile image, authentication metadata, and session data through Clerk. We do not store raw passwords.
- Founder profile and company data: company name, website, description, stage, sector, location, fundraising details, team information, traction metrics, materials, data-room files, and investor updates.
- Investor and firm data: persona, firm, investment thesis, criteria, check size, sectors, stages, portfolio, fund, contacts, notes, deal tasks, diligence material, IC memos, and portfolio marks.
- Pitch data: pitch transcripts, messages, AI replies, scores, verdicts, rationales, reports, benchmarks, and action plans.
- Copilot and workflow data: assistant threads, messages, summaries, proposed changes, approvals and rejections, saved views, workflow runs, stages, evidence, decisions, and outcomes.
- Uploaded files: decks, documents, images, videos, deal documents, and data-room files. Files are stored privately and may be processed to extract text, summaries, or structured data.
- Payment data: subscription status, plan, amount, billing period, customer reference, and payment status through Stripe. We do not store full card details.
- Integration data: API tokens, MCP connection metadata, scopes, and last-used timestamps. API token plaintext is shown once and stored as a hash.
- Usage and security data: page views, feature interactions, challenge events, security events, rate-limit data, IP-derived request data, and diagnostic logs.
- Public-source data: professional information about investors, firms, founders, and companies assembled from public sources for personas and research.
- Communications: support messages, feedback, marketing preferences, and email engagement data such as opens and clicks where enabled.
2. How we use data
- Provide, operate, secure, and improve Gatekeep.
- Authenticate users and maintain accounts.
- Run pitches, produce scores and reports, and manage investor workflows.
- Operate copilot, workflow, discovery, data-room, fund, and portfolio features.
- Process payments, subscriptions, credits, and BYOK discounts.
- Send requested notifications, reports, digests, updates, and support messages.
- Detect abuse, fraud, prompt injection, security incidents, and service failures.
- Measure aggregate performance and improve product quality.
- Comply with legal, tax, accounting, and regulatory obligations.
- Enforce our Terms and protect the rights and safety of users and Gatekeep.
We do not sell your personal data. We do not share it for cross-context behavioral advertising. We do not use your private pitch content to train Gatekeep-owned foundation models. Third-party AI providers process prompts under their own terms, as explained in Section 10.
Investor sharing: when you choose to surface a report, request an intro, share a data room, or accept a deal, we share the information required for that action with the relevant investor, founder, or firm. You control those sharing actions in the product.
3. Legal bases
Where GDPR or UK GDPR applies, we rely on: performance of a contract for the core service; legitimate interests for security, product improvement, fraud prevention, and business operations; consent for optional analytics, marketing, and BYOK provider choices; and legal obligation for tax, accounting, and lawful requests. You may withdraw consent at any time.
Automated scoring and AI-generated recommendations may materially affect how a profile is presented. We provide disclosure and human contact channels so you can ask questions, request correction, or object where the law provides that right.
4. Who we share data with
We use service providers for hosting, authentication, payments, storage, email, analytics, search, and AI inference. They process data on our behalf or, for user-selected BYOK providers, at your direction. We require appropriate contractual protections where required by law.
| Provider category | Purpose | Data |
|---|---|---|
| Clerk | Authentication and session management | Account identity, email, session data |
| Stripe | Payments, subscriptions, tax and billing | Payment and subscription data |
| Neon | PostgreSQL database hosting | Application data |
| Vercel and Vercel Blob | Hosting, logs, private file storage | Request data, uploaded files |
| Resend | Transactional and notification email | Email address, message content, delivery data |
| Google Analytics and Vercel Analytics | Aggregate traffic and performance measurement | Usage and device data, depending on consent |
| Tavily, Brave, and Exa | Public web and market research | Research queries and public source data |
| AI inference providers | AI replies, scoring, extraction, summaries, research synthesis | Prompts and context, which may include profile, pitch, document, deal, or portfolio data |
A current subprocessor list is available on request at privacy@gatekeep.vc. We may update providers and will provide notice where required. We may also disclose data to comply with law, enforce our Terms, protect safety, investigate abuse, or in a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality.
5. Data retention
We keep data only as long as needed for the purposes described above, then delete or de-identify it. Retention depends on the type of data, legal requirements, security needs, and whether you ask us to delete it.
| Data | Retention |
|---|---|
| Account and profile | While the account is active, then deletion or de-identification within 30 days after account deletion |
| Pitch transcripts, scores, reports, and verdicts | While the account is active; transcript and narrative content removed or de-identified on account deletion. Limited scoring and aggregate records may remain in de-identified form |
| Copilot threads, messages, summaries, proposals, and saved views | While the account is active; deleted or de-identified within 30 days after account deletion. Archived threads remain until deletion |
| Workflow runs, stages, evidence, decisions, and outcomes | While the account or relevant deal is active; deleted or de-identified within 30 days after account deletion, subject to legal and audit retention |
| Uploads, decks, documents, images, videos, and data-room files | While needed for the account or shared workflow; deleted within 30 days after account deletion. Provider backups may persist for a limited period |
| BYOK credentials | Until you remove the key or delete the account. A key may be inactive while no paid plan is active. Encrypted key material is deleted with the credential |
| Billing and tax records | For the period required by tax, accounting, and fraud-prevention law, generally up to 7 years |
| Security, abuse, and admin audit events | Generally up to 24 months, and longer where required for investigations or legal claims |
| Webhook idempotency and delivery records | Generally 30 days |
| Analytics | Up to 14 months depending on provider and configuration |
| Marketing and lead data | Until opt-out, then a suppression record for a limited period to honor the request |
| Backups and disaster recovery | Limited period consistent with provider backup cycles, then overwritten or deleted |
| AI provider copies | Governed by the provider's terms. Gatekeep does not control provider retention |
6. Account deletion and export
You can delete your account from Settings. We cancel active subscriptions first, revoke sessions, remove or de-identify personal content, delete uploaded files where possible, and remove the account record. Some records may remain in backups, legal holds, billing records, security logs, or de-identified audit data as described above.
You can request a portable export of your account record. The self-service export includes account and profile data, challenge and report metadata, handoffs, documents metadata, portfolio and fund data, and assistant thread metadata. Message contents, provider-held copies, security logs, and certain third-party data may require a separate request. Contactprivacy@gatekeep.vc.
7. Your rights
Depending on your location, you may have the right to access, correct, delete, restrict, object to processing, receive a portable copy, withdraw consent, or appeal a decision. You may also have the right not to be discriminated against for exercising a privacy right.
- GDPR and UK GDPR: access, rectification, erasure, restriction, objection, portability, and complaint to a supervisory authority. You may object to processing based on legitimate interests and to direct marketing.
- California CPRA/CCPA: know, access, correct, delete, portability, and opt out of sale or sharing. We do not sell personal data or share it for cross-context behavioral advertising. You may use an authorized agent and will not be discriminated against for exercising rights.
- Korea PIPA: access, correction, deletion, suspension of processing, and withdrawal of consent. Cross-border transfers are described in Section 11.
- Hong Kong PDPO: access and correction of personal data, subject to any permitted fee.
Send requests to privacy@gatekeep.vc. We may need to verify identity and authority. We respond within the period required by applicable law. You may also contact us about automated scoring, public personas, or content that you believe should be corrected or removed.
8. Cookies and analytics
We use strictly necessary cookies and optional analytics. Strictly necessary cookies keep you signed in, preserve locale and consent choices, maintain anonymous demo state, and remember referral or promo attribution. Analytics cookies are used only after consent where consent is required.
Google Analytics 4 is used for aggregate traffic measurement. Vercel Analytics may be used for aggregate performance and page-view measurement without advertising cookies. We do not use advertising, retargeting, or behavioral profiling cookies. The advertising consent controls are disabled because no advertising is active, regardless of a general accept-all action.
You can change cookie preferences through the Cookie Settings link in the footer. Clearing browser storage may reset your choice. We do not currently treat browser Do Not Track as a separate consent mechanism; use the consent controls to reject optional analytics.
9. Security
Data is encrypted in transit with TLS. Database and storage providers encrypt data at rest. Access is role-limited, secrets are server-side, and API tokens are stored hashed. BYOK keys are transmitted from your browser to Gatekeep over TLS, encrypted at rest, used only server-side for your requests, and never returned in full after saving. Platform provider keys are not exposed to your browser.
No system is completely secure. We cannot guarantee that unauthorized access, provider failures, or data loss will never occur. If we become aware of a qualifying security incident, we will investigate and notify affected users and regulators where required. Report security concerns to security@gatekeep.vc.
10. AI processing and BYOK
Gatekeep uses third-party AI inference providers for replies, scoring, extraction, summaries, research synthesis, and other AI features. When you use Gatekeep-managed AI, we send the prompts and context needed for the feature to the provider configured by Gatekeep. When you enable BYOK, you select a supported provider, and you authorize Gatekeep to send your prompts and context to that provider using your key.
AI providers may retain, review, or use data according to their own terms. Gatekeep does not control those practices and cannot guarantee that a provider does not train on data or delete it on a particular schedule. You are responsible for reviewing and accepting your provider's terms before enabling BYOK. If a BYOK key fails, Gatekeep will not silently switch to Gatekeep-managed AI. Use Gatekeep AI explicitly if you want to switch.
We do not knowingly use private pitch content to train Gatekeep-owned foundation models. AI outputs are simulations and may be inaccurate. They are not investment, legal, tax, or financial advice. You are responsible for decisions made using AI outputs. Public investor personas are built from public sources and are not endorsements by the referenced people or firms unless a profile is explicitly claimed.
11. International transfers
Gatekeep and its service providers process data in the United States and other countries where they operate. BYOK providers may process data in the location you select or the provider operates. Where required, we use contractual safeguards such as standard contractual clauses or the UK International Data Transfer Addendum, and we assess transfers for legal and security risk.
If you use a provider outside your jurisdiction, you authorize the transfer to that provider. Contact privacy@gatekeep.vc for a copy of applicable transfer terms or the current subprocessor list.
12. Public personas and professional data
Gatekeep builds investor and firm personas from public professional sources. If you are referenced and believe your profile is inaccurate, you can claim it or request correction or removal at privacy@gatekeep.vc. We may retain limited records needed to honor the request or prevent abuse.
13. Children
Gatekeep is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided personal data, contact us and we will take appropriate steps to delete it.
14. Changes to this policy
We may update this policy as the product, providers, or law changes. Material changes will be communicated by email or a prominent notice. Where required, we will ask for renewed consent or provide an opportunity to object before the change takes effect. The effective date and version are shown at the top.
15. Contact
Privacy: privacy@gatekeep.vc
Security: security@gatekeep.vc
General support: hi@gatekeep.vc
Gatekeep
Gatekeep is an independent product. AI personas are simulations for practice and informational purposes. Gatekeep does not provide investment, legal, tax, or financial advice. This policy is not legal advice to any user.