Privacy Policy

Who is responsible

Marketplace Technologies Inc is the controller of your personal data. Our address: 651 N Broad St, Suite 201, Middletown, DE 19709, USA.

If you have a concern about how we handle your data, please contact us so we can try to put it right. You can also complain to a data protection authority at any time (see Your rights).

What we collect

• Account and profile: name, email address, password (stored only as a salted hash), optional username, profile picture, bio, location, links, interests and notification preferences. Profile pictures are converted to a standard image format when you upload them.
• Sign-in and security: session records with the IP address, browser details and time of use. If you turn on two-factor authentication, we keep its secret (encrypted) and your recovery codes. For staff accounts, we also set a random browser-recognition cookie (stored hashed). If you sign in with Google or LinkedIn we receive your provider account ID and verified email address.
• Push notifications: only if you turn them on for a device in your notification settings. We then store a push token for that browser or app (an identifier Google Firebase Cloud Messaging issues so notifications reach it), the browser details and when the device was last seen. The notifications we send through it carry the title and short text of your in-app notifications.
• Newsletters: email address, optional name, the topics you choose, when and where you subscribed and how you engage with issues (whether an issue is opened and which links are clicked).
• Memberships, launches and donations: plan, billing country, company name and VAT number if you provide them, invoice and order records, and for donations your email address, any message you add and whether you chose to appear as a public supporter. You enter card details on Stripe's payment pages; we do not receive or store your full card number.
• Funding and programs: introduction requests you send to funds (your message, an optional pitch deck link, how much you are raising and your stage), program applications and the reusable founder profile used to fill them in, investor and advisor profiles and preferences, and your private notes and tags on deals.
• Directory activity: organization claims, submissions, program applications, event registrations, saved lists and the people you share them with, notes, watchlists, follows, bookmarks, alert subscriptions and private calendar feed links.
• Contributions: article pitches, funding opportunity and deal suggestions, feedback on deals, and content reports.
• Community and messages: discussions, replies, votes, reports you file, direct messages you send or receive, and people you block.
• Advertising and sponsorship: if you book a campaign, the contact name, email address and company you give us, your campaign details and creative.
• Search: the words you search for, used to return results. When you search while signed in, your search and the titles of the top results may be sent to an AI model provider, which writes a short summary.
• Forms: copyright notices (including your name, email address, company and signature) and any message you send us. For copyright notices we also keep your browser details and a one-way code made from part of your IP address, to help prevent abuse.
• Privacy choices: a record of your cookie and analytics choices, the policy version, and a one-way code made from part of your IP address (we do not store the full address).
• Analytics: if you allow it, anonymous page-view measurement (see Cookies and analytics below).

Why we use it and our legal bases

• To provide the service you asked for (account, memberships, saved work, messages, applications, and AI-written search summaries for members): performance of a contract.
• To deliver what you send through the site (introduction requests to the fund you choose, program applications to the program's team, and team invitations you send), so the people who receive them can see and answer them on INSIGHTEX: performance of a contract.
• To keep the site secure and prevent abuse (sign-in protection, rate limiting, spam and abuse checks, moderation, and limiting free trials to one per person, checked against your account and email address): our legitimate interests.
• To send newsletters and product notices: your consent for newsletters (we send a confirmation email first, and we count opens and clicks), or performance of a contract for service messages. You can unsubscribe at any time.
• To measure and improve the product: your consent for optional analytics.
• To count views and clicks on adverts and deals, so we can report totals to advertisers and partners: our legitimate interests. We use no cookies and store nothing in your browser for this. We use the same daily visitor code as our analytics (see Cookies and analytics below), we store only daily totals, and we count nothing when your browser sends Do Not Track or Global Privacy Control.
• To show the site in its typefaces (Google Fonts, see Fonts below): our legitimate interests.
• To handle copyright and other legal notices: our legitimate interests and, where the law requires it, legal obligation.
• To meet legal duties such as tax and accounting records and handling lawful requests: legal obligation.

Where the law of another country applies to you, we rely on the matching grounds that law recognises, such as your consent, what is needed to provide the service you asked for, or a legal obligation. Where we rely on consent, you can withdraw it at any time. This does not affect what we did before you withdrew it.

AI features and automated processing

Some features use AI models, including models hosted on Microsoft Azure. Microsoft processes this information as our service provider, on our instructions. We use AI to:

• Summarise searches: when you are signed in and a search summary is shown, the words you type and the titles and short descriptions of the top results may be sent to the model to write a short summary. Your name and email address are not sent, but the words you type are, so please do not enter personal details into search.
• Draft listings: when you submit a website address, we fetch that public page and send its details and part of its content to the model to suggest a name, description and other listing details. Your account details are not sent, but the page itself may include information about people named on it.
• Prepare editorial content: summarise and classify public news, organization and product information, which can include the names and roles of people mentioned in those sources.

We rely on our legitimate interests in running and improving the service for this processing, or on performance of a contract where you ask for the feature. You can object, as described under Your rights below.

AI-written text can contain mistakes, so check anything important before relying on it. We do not use your personal data to train or fine-tune AI models.

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Automated security checks, such as rate limits and human-verification tests, can block a request. If you think this happened in error, you can contact us using the details above.

Cookies and analytics

We set only the cookies and browser storage listed on our cookie policy. Necessary items keep you signed in and secure. Analytics is optional and off until you choose it. When it runs it uses no cookies and stores nothing in your browser, does not store your IP address or user agent string, and represents each visitor by a one-way code recreated every day with a secret that is deleted after 48 hours, so activity cannot be linked from one day to the next. We record the page viewed (without its query string, apart from utm_ campaign tags), the referring website (domain only), browser family, operating system and device type, your country when our host supplies it, and whether you were signed out, signed in or a member. We also honour Do Not Track and Global Privacy Control by not measuring your visit. Detailed events are deleted after 30 days by default; only aggregated totals are kept longer. A machine-readable summary is at /api/analytics/policy. You can change your choice at any time with "Cookie settings" in the footer.

We also count advertising impressions and clicks, and deal views, clicks and code reveals, on our own servers. This uses no cookies and stores nothing in your browser. It uses the same daily one-way code as our analytics, and it runs whatever you choose in the cookie settings, on the basis of our legitimate interests in reporting accurate totals and preventing fraud. To limit automated or repeated counting, we briefly keep your network address range and a scrambled form of your IP address, and remove them after about a day. Nothing is counted when your browser sends Do Not Track or Global Privacy Control. Advertisers receive only total counts, which do not include anything that identifies you. Our website does not use third-party advertising networks, advertising tracking pixels or retargeting. Our newsletters do count opens and clicks, as described above.

Video and podcast players from YouTube (privacy-enhanced mode), Vimeo, Spotify and Apple Podcasts load only when you press play. That provider then receives your IP address and may set its own cookies under its own privacy policy. Some images, for example organization logos, news images and video preview images, load directly from the website that hosts them, which receives your IP address and browser details.

Fonts

Our typefaces are served by Google Fonts. Every page you open asks fonts.googleapis.com and fonts.gstatic.com for them, whatever you choose in the cookie settings, so Google receives your IP address and browser details with each request. Google Fonts sets no cookies and stores nothing in your browser. Google's own privacy policy explains how it handles that data.

Who we share data with

We do not sell personal data, and we do not use it to target advertising at you. We share it with the following people and organizations:

• Service providers acting on our instructions: Amazon Web Services (hosting, storage and backups), our email delivery provider, Stripe (payments and subscriptions, when you pay), Microsoft Azure (which processes text sent to our AI features), a human-verification service on some forms, and, when enabled, an error-monitoring service that receives technical error reports. We strip cookies, sign-in tokens, email addresses and web address query strings out of those reports before they are sent.
• Sign-in providers: Google or LinkedIn, if you choose to sign in with them.
• Google Firebase Cloud Messaging: if you turn on push notifications, Google receives the device's push token and the text of each notification we send to it, and delivers it to your browser or app.
• Google Fonts: which receives your IP address and browser details when your browser loads our typefaces (see Fonts above).
• Funds you contact: the fund's team sees your introduction request, including your name, your message, your organization, any stage, amount or notes about your raise, and any pitch deck link. We do not give them your email address; replies happen in INSIGHTEX messages.
• Program operators: the partner organization running a program you apply to sees your application and the profile details it contains, and can export them.
• Your teams and other members: the members of organizations you join, people you share a saved list with, and other members for what you choose to make public (for example your name on a discussion post, an organization team page or the supporters list if you opt in).
• Advertisers and sponsors: only aggregated figures for their campaigns, such as impression and click counts, that do not identify you.
• Professional advisers such as lawyers, accountants and auditors, who must keep it confidential.
• Regulators, courts and law enforcement where the law requires it.
• A buyer or successor if all or part of our business is sold or reorganized.

A list of our processors is available on request. Where a provider is outside the UK or EEA we rely on an adequacy decision or standard contractual safeguards.

International transfers

INSIGHTEX serves readers worldwide. Some of the service providers we use, for example for hosting and infrastructure, email delivery and payment processing, may store or process personal data outside the UK and the European Economic Area, including in the United States.

When personal data leaves the UK or the EEA, we rely either on an adequacy decision (a finding by the UK or EU authorities that the destination protects data to a comparable standard) or on standard contractual safeguards approved by those authorities.

To ask which providers are involved or for more detail about these safeguards, contact us using the details above.

How long we keep it

• Account and workspace data: until you delete your account. When you ask us to delete it, we wait 14 days so you can change your mind, then erase or anonymise your personal data.
• Unconfirmed sign-ups: confirmation links expire after 60 minutes, and sign-ups that were never confirmed are removed daily.
• Sign-in sessions: until you sign out or the session expires (normally after 30 days). Expired sessions, with the IP address and browser details recorded with them, are removed shortly after they expire.
• Push tokens: until you turn push notifications off or sign out on that device, your browser or Google tells us the token no longer works, the account is deactivated, or you delete your account.
• Newsletter data: while you are subscribed. If you unsubscribe, your subscription record is kept and marked as unsubscribed so we do not email you again. It is removed when you delete your account.
• Analytics: detailed events for 30 days, hourly totals for 90 days and aggregated totals for 26 months.
• Technical logs: server logs for about 14 days; stored error reports and failed background tasks for about 30 days. If we use an outside error-monitoring service, it keeps reports for its own retention period. Records of actions staff take in our admin tools: 2 years.
• Data exports: the download link works for 48 hours and for up to three downloads. The file is deleted once the link expires.
• Invoices and payment records: at least 7 years from the latest transaction on the record (for example a payment or refund), a period chosen to meet tax and accounting obligations. If you delete your account, personal details on them are minimised, and the remaining payment and tax identifiers are removed after that period.
• Published content: articles, discussions, replies and events you published, and organisations you created, stay on the site after your account is deleted, credited to "Former member".
• Abuse prevention: records of account restrictions and free-trial use stay after deletion to stop them being bypassed. They contain no personal details.
• Takedown notices: kept as a record of the request and how we handled it.
• Backups: encrypted backups are deleted on a fixed rotation, so deleted data can stay in them for up to about 14 months before it is removed.

How we protect your data

• Encryption: connections to the site are encrypted (HTTPS), and our server storage and backups are encrypted at rest. We store your password only as a scrambled one-way version of it (a salted hash). Two-factor authentication secrets and the codes used in unsubscribe links are stored encrypted.
• Staff access: staff need two-factor authentication to use our admin tools, are signed out after an hour of inactivity, and changes they make in those tools are logged.
• Your account: you can turn on two-factor authentication in your security settings. Before we export your data or delete your account, we ask you to confirm it is you, for example with your password.
• Abuse protection: we limit repeated attempts to sign in or take sensitive actions, and some forms include a check that you are a person rather than an automated program.
• Collecting less: our analytics does not store IP addresses. When error reporting is turned on, it is set up to remove email addresses, cookies and access tokens before reports leave our servers.

No system is completely secure, and we cannot promise that your data will never be accessed without permission. If a personal data breach happens, we will report it to the relevant data protection authority and tell you directly when the law requires it.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, limit how we use it, or send it to you in a reusable format so you can take it elsewhere. You can also object to uses we base on our legitimate interests, and withdraw your consent at any time (this does not affect what we did before you withdrew it). We offer these rights to everyone, wherever you live.

• Copy of your data: Profile > Settings > "Export account archive" prepares a machine-readable archive of your data and emails you a private download link that expires after a short time and works for a limited number of downloads (one request per day; you will be asked for your password, or for a code we email you if you sign in with Google or LinkedIn).
• Deleting your account: in the INSIGHTEX app or on the website, sign in and open Profile > Settings > "Delete account", type DELETE and confirm with your password (if you sign in with Google or LinkedIn, we email you a one-time code instead). You can also email hello@insightex.si from the address on your account and we will delete it for you. Deletion is scheduled with a 14-day grace period you can cancel from the confirmation email, then your personal data is erased or anonymised. Posts we keep so that conversations still make sense appear as "Former member"; invoices and payment records are kept for at least 7 years for tax and accounting law, with your personal details minimised. If you are the only owner of an organization, transfer ownership to another team member or delete the organization first.
• Correction and preferences: edit your profile and notification settings in Profile > Settings; manage newsletters from the link in any issue.
• Anything else: contact us using the details in "Who is responsible" above. We may need to confirm your identity first, and someone else can make a request for you if they show us your permission. We reply within one month. If a request is complex or we receive many, we may need up to two more months and will tell you why.

Depending on where you live, local law may give you further rights. For example, residents of California and some other US states can ask to know, correct or delete their data and to opt out of its sale, sharing or use for targeted advertising. We do not sell personal data or share it for targeted advertising, and we honour a Global Privacy Control signal from your browser by not measuring your visit. Laws in other places, such as Brazil and India, give similar rights. We will not treat you differently for using any of these rights.

If we decline a request, we will tell you why. You may also complain to your data protection authority, for example the UK Information Commissioner's Office (ico.org.uk), the authority in your EU country, or the regulator where you live.

Children

INSIGHTEX is for professionals and is not directed at anyone under 16. You must be at least 16 to hold an account. We do not knowingly collect personal data from anyone under 16.

If you believe someone under 16 has given us personal data, contact us using the details in "Who is responsible" above. We aim to act promptly. We will take steps to close any account they hold and to erase or anonymise their data, unless the law requires us to keep it.

Links and third-party services

INSIGHTEX links to websites we do not run, such as organization sites, news sources and the pages where you claim deals or apply for grants and programs. When you follow one of these links you leave INSIGHTEX. That site's own privacy policy then applies, and we do not control how it handles your data.

Some features are provided by other companies on their own pages or in their own frames:

• Sign-in and payments: Google or LinkedIn sign-in and Stripe's payment pages, where we offer them.
• Security checks: the human-verification check on some forms, where we turn it on.
• Embedded players: video and podcast players in some articles (for example YouTube in privacy-enhanced mode, Vimeo, Spotify or Apple Podcasts). Once a player loads, its provider receives your IP address and browser details and may set its own cookies (see our cookie policy).

These companies' privacy policies cover what they collect directly, so please read them. This policy still covers what we receive from them, such as your sign-in details or payment status, and anything they handle on our behalf.

Changes

We may update this policy from time to time, for example when our service, our providers or the law changes. The date on this page shows when it was last updated. If we change this policy in a way that matters, we will update that date and, where required, tell you or ask for your consent again. If you do not agree with a change, you can use the rights described in Your rights, including deleting your account.

Contact us

You can write to Marketplace Technologies Inc at 651 N Broad St, Suite 201, Middletown, DE 19709, USA. If you have an account, you can export or delete your data yourself from Profile > Settings, as described under Your rights.

To report content you believe infringes copyright or is unlawful, use our takedown form. Please do not use that form for privacy requests.