Privacy Policy
Last updated: 2026-10-13
This policy explains what personal data 12inf handles, why, on what legal basis, who helps us process it, how long we keep it and what rights you have. It applies to the website at 12inf.ai, the free tools and resources on it, and the 12inf Workspace (Investor Search, Round Review and Investor Prep).
We have tried to write it plainly. If something is unclear, email [email protected].
1. Who is responsible for your data
The data controller is:
| Service | 12inf |
| [email protected] |
Privacy questions go to [email protected].
2. What data we handle
2.1 Data you give us
- Account data. Your email address, and the one-time sign-in codes we send to it. We do not use passwords.
- Company materials. The company website you enter, any description you write, the round details and search preferences you choose (for example stage and geography), and any pitch deck or document you upload (PDF, PPTX, TXT or MD, up to 10 MB). A deck can contain personal data, such as founder names, photos, bios or contact details.
- Workspace content. Search briefs, shortlists, saved investors, notes, deck reviews and preparation material created in your Workspace.
- Billing data. Your plan, billing interval, payment status, invoices, billing country and tax details. Card details are entered directly with Stripe. We never see or store full card numbers.
- Messages. What you write when you email us, including any attachments.
You can use parts of the service (for example, preparing a company brief on /try) before signing in. The materials you submit are still processed as described here.
2.2 Data created when you use the service
- Outputs. The search brief, investor shortlist, match explanations, review comments and other results generated from your materials.
- Usage of credits and features. Which searches you ran, which investor profiles were delivered to you, credit balance and plan limits.
- Technical and security data. IP address, browser type, request time, pages requested and error data recorded in our server and security logs, and file-scan results.
- Cookieless statistics and random journey measurements. See section 7.
2.3 Data about investors in our catalog
12inf shows profiles of investors (funds, firms and individual angels and partners). Where a profile relates to an identifiable person, it can include their name, role, firm, investment focus, stated thesis, past public investments, public professional links and professional contact details where available. This information is compiled from publicly available sources, such as firm websites, public announcements and public professional profiles. Section 9 explains how investors can object or ask for removal.
Your uploaded materials never feed this catalog. Nothing you submit is used to add to, enrich or correct the public investor catalog.
3. Why we use your data and our legal basis
| Purpose | Data used | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating your account and signing you in with email codes | Email, sign-in codes, technical data | Performance of a contract (6(1)(b)) |
| Preparing your company brief, investor shortlist, deck review and preparation material | Company materials, workspace content, outputs | Performance of a contract (6(1)(b)) |
| Scanning uploaded files for malware and extracting their text | Uploaded files | Performance of a contract (6(1)(b)); legitimate interest in keeping the service safe (6(1)(f)) |
| Taking payments, managing subscriptions and credits, issuing invoices | Billing data, credit usage | Performance of a contract (6(1)(b)) |
| Keeping accounting and tax records and answering lawful requests from authorities | Billing data, invoices | Legal obligation (6(1)(c)) |
| Sending service emails (sign-in codes, receipts, renewal and security notices) | Email, account and billing data | Performance of a contract (6(1)(b)) |
| Answering your messages and support requests | Messages, account data | Performance of a contract (6(1)(b)) or legitimate interest in responding (6(1)(f)) |
| Protecting the service against abuse, fraud and attacks; debugging | Technical and security data | Legitimate interest (6(1)(f)) |
| Understanding and improving the service through aggregate statistics | Daily counts and public categories (section 7) | Legitimate interest (6(1)(f)) |
| Product news and marketing emails | Email, name if given, preferences | Consent (6(1)(a)); for existing customers, where Spanish law allows, legitimate interest for similar services with an easy opt-out in every email |
| Maintaining the public investor catalog | Investor data (section 2.3) | Legitimate interest in helping founders find relevant investors (6(1)(f)) |
| Establishing, exercising or defending legal claims | Relevant records | Legitimate interest (6(1)(f)) |
Where we rely on legitimate interest, we have weighed our interest against your rights. You can object at any time (section 9).
Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that happened before.
No sale of data. No advertising. We do not sell personal data. We do not use it for advertising or share it with ad networks.
Automated processing. Your shortlist is produced automatically by matching your company brief against investor profiles. This ranks and explains results for you. It does not make decisions that have legal or similarly significant effects on you within the meaning of GDPR Art. 22.
4. How AI is used, and what it does not do with your files
- Files stay on our servers for scanning and text extraction. Uploaded files are scanned for malware with ClamAV and, where needed, their text is read with optical character recognition (OCR) running on our own servers. We do not send your files to an AI model host for OCR.
- Text sent to AI models goes through OpenRouter under strict settings. To write your brief, explain matches or review a deck, we send the relevant text (not the original file) to large language models through OpenRouter. Before a request is sent, our system checks that the route is set for zero data retention and no training on your data. If that check does not pass, the request is not sent.
- No model training on your materials. We do not use your uploaded materials or Workspace content to train AI models, and we do not allow our providers to do so.
- Your materials are private. They are visible to you and to the systems needed to provide the service. We only look at them ourselves if you ask us to (for example in a support request), if needed to investigate a security problem, or if the law requires it.
AI output can be wrong or incomplete. See our Terms of Service.
5. Who we share data with
We use the service providers below to run 12inf. Their roles and handling of data depend on the service they provide; payment providers also process data under their own policies.
| Provider | What they do for us | Main data involved | Location / transfer basis |
|---|---|---|---|
| Supabase | Authentication and email sign-in codes | Email, sign-in codes, account identifiers | See section 6; contact us for provider-specific information |
| Stripe | Payments, subscriptions, invoices, tax calculation, customer portal | Billing data, email, payment details | See section 6; contact us for provider-specific information |
| PostHog (US cloud) | Cookieless statistics | Daily totals and random journey events with public categories, without person profiles (section 7) | See section 6; contact us for provider-specific information |
| Cloudflare | Content delivery, DNS, security filtering, email routing for our addresses | IP address, request data, emails sent to our addresses | See section 6; contact us for provider-specific information |
| DigitalOcean | Hosting of our application, databases and file processing | All service data, including uploaded files | See section 6; contact us for provider-specific information |
| OpenRouter | Routing requests to AI models under zero-data-retention and no-training settings | Text extracted from your materials, prompts and outputs | See section 6; contact us for provider-specific information |
| Resend | Sending transactional emails (sign-in codes, receipts, notices) | Email address, email content | See section 6; contact us for provider-specific information |
| Brevo | Customer relationship management and marketing email, only if you agreed | Email, name if given, email preferences and engagement | See section 6; contact us for provider-specific information |
ClamAV and our OCR engine run on our own servers. They are software, not separate recipients.
We may also disclose data:
- to our tax advisor (gestor), accountant or lawyers, under a duty of confidentiality, where needed for our legal obligations;
- to public authorities, courts or law enforcement, where the law requires it;
- to a buyer or successor if the business is transferred, in which case we will tell you in advance and this policy will continue to protect your data.
An up-to-date list of providers is available on request at [email protected].
6. International transfers
Some providers are based in, or access data from, countries outside the European Economic Area, mainly the United States. When that happens we rely on one of these safeguards:
- an adequacy decision of the European Commission, including the EU–US Data Privacy Framework (DPF) for US companies certified under it; or
- the European Commission's Standard Contractual Clauses (SCCs), with additional measures where appropriate.
You can ask us for a copy of the relevant safeguards at [email protected].
7. Essential storage and aggregate statistics
Essential cookies support sessions, authentication, security and billing. Saved preferences and drafts support the functions you request. We do not use analytics cookies, analytics identifiers in localStorage or sessionStorage, fingerprinting or session recording.
We count page views, navigation, calls to action, scratch reveals, downloads, displayed preflight results and access requests. Our server also counts searches and results, new accounts, checkouts, funded subscription periods by plan, upgrades, cancellations and Workspace jobs, outcomes and limits. We use these statistics under our legitimate interest in understanding and improving the service.
Analytics stores daily totals with public page labels and broad referrer categories, such as Google, ChatGPT or direct. It stores no IP addresses, full URLs, account IDs, email addresses or uploaded content. IP addresses are used transiently in memory to rate-limit the analytics endpoints. Security logs for the service are separate from analytics.
We also measure a visit from entry through search and payment using a random journey ID kept only in JavaScript memory. It passes briefly through internal navigation and Stripe return URLs and is removed from the address bar on arrival; new tabs and fresh visits start new journeys. Events contain public page categories, steps, coarse mobile/tablet/desktop classes and timings, without company, website, email or deck content, and are sent by our server to PostHog without person profiles. Local journey records are deleted daily after 395 days by default; aggregate totals remain. PostHog retention is managed separately in that service.
Our server sends aggregate totals and journey events to PostHog in the United States; no PostHog script runs in your browser. There is no analytics consent banner. Old browser analytics identifiers are no longer read or renewed and can be removed through your browser settings. Requests relating to historical consent or personal data remain available through [email protected].
See our Cookie and Storage Policy for service storage and your browser choices.
8. How long we keep data
We keep personal data for the purposes described in this policy and remove it when it is no longer needed, subject to legal record-keeping requirements and open disputes. Retention depends on the type of data:
| Data | Retention basis |
|---|---|
| Account, uploaded materials and saved outputs | Providing your account and requested services, until deletion or when no longer needed |
| Billing records and invoices | Applicable tax and accounting record-keeping requirements |
| Security logs and incident records | Investigating abuse, protecting the service and resolving incidents |
| Aggregate statistics, journey events; historical consent records | Local journey rows: 395 days by default, with daily deletion; daily totals for service comparison; historical consent evidence only as needed for privacy requests |
| Support messages | Handling your request and any related dispute |
| Marketing contacts | Until you unsubscribe; a suppression entry prevents further marketing |
| Backups | Until copies are replaced under the backup cycle |
For details about a specific record or a deletion request, contact [email protected].
You can close your account and request deletion of your data from your account settings. After deletion we keep only what we must keep by law (for example invoices) or need for an open legal claim. Copies in backups disappear as the backups roll over.
9. Your rights
If the GDPR applies to you, you have the right to:
- access your personal data and get a copy;
- rectify inaccurate data;
- erase your data ("right to be forgotten");
- restrict how we use your data;
- object to processing based on legitimate interest, including the processing of investor profiles in our catalog;
- data portability, to receive data you gave us in a structured, machine-readable format;
- withdraw consent at any time, for example for marketing or historical analytics;
- lodge a complaint with a supervisory authority.
How to exercise them. Email [email protected] from the address linked to your account, or say clearly which data you mean. We may ask for information to confirm your identity. We answer within one month. In complex cases we can extend this by two more months and will tell you why.
Investors listed in our catalog can ask us to correct, limit or remove their profile, or object to it, by writing to [email protected] with the profile name and link.
Complaints. In Spain the supervisory authority is the Agencia Española de Protección de Datos (AEPD), www.aepd.es. If you live elsewhere in the EU, you can also contact your local authority. We would appreciate the chance to resolve your concern first.
10. Security
We protect data with measures suited to a small, focused service, including encrypted connections (HTTPS), access control, malware scanning of uploads, processing of files on our own servers, separation between your private materials and the public investor catalog, and limited access by staff. No system is perfectly secure. If a breach affects your data and creates a risk to you, we will notify the authority and, where required, you.
11. Children
12inf is a business tool for founders. It is meant for people aged 18 or over, and we do not knowingly collect data from children. If you believe a child has given us personal data, email [email protected] and we will delete it.
12. Links to other sites
Our resources link to other websites. Their owners decide how they handle your data. Paying for a plan takes you to pages run by Stripe, which apply Stripe's own privacy policy.
13. Changes to this policy
We will update this policy when the service or the law changes. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell signed-in users by email or in the product before it takes effect, and ask for consent again where required.
14. Contact
Contact 12inf at [email protected].