Privacy Policy

Version 3.2 — Last updated 25 October 2026

This notice explains what personal data Dealflowhub.ai collects, why, who can see it, how long we keep it, and your rights. It covers our website and our platform for founders, investors, mentors and partners. It also explains exactly what we do with data from a Google Calendar you connect (section 6).

1. Who we are

Dealflowhub.ai is run by Dealflowhub Limited, company number 14041440, registered in England and Wales at Elthorne Gate, 64 High Street, Pinner, England, HA5 5QA.

We are the data controller for the personal data in this notice. For anything about your data, email info@dealflowhub.ai.

2. Information we collect

Information you give us

  • Account data: name, email, phone number, role, LinkedIn profile and photo.
  • Profile and company data: startup details, pitch decks, one-pagers and other documents, financials, and investment preferences.
  • Verification data: company registration details, which we check against Companies House.
  • Payment data: Stripe handles payments. We never see or store your card number. Mentors' bank and payout details are held by Stripe, not by us.
  • Messages and meetings: messages you send on the platform, meeting requests, and your working hours and time zone.

Information we generate

  • AI scores and summaries: pitch scores, match scores and meeting summaries.
  • Meeting recordings and transcripts: when a Zoom call created on Dealflowhub.ai is recorded.
  • Activity and device data: pages and features you use, sign-in times, IP address and browser, and which documents you open or download.

Information from services you connect

  • Calendar: if you connect a Google, Microsoft or Apple calendar, we receive the start and end times of your busy periods. Section 6 explains this in full.
  • Stripe: whether a payment or payout succeeded.

3. Why we use it, and our legal basis

UK data protection law requires a legal basis for each use. Ours are below.

PurposeDataLegal basis
Reviewing new members. Our team checks every account before it is switched onAccount, profile and company data you give at sign-upLegitimate interests (keeping the network trustworthy)
Running your account and matching founders, investors, mentors and partnersAccount, profile and company data, investment preferencesContract
Scheduling meetings: offering times when you are free, and adding confirmed meetings to your calendarWorking hours, time zone, busy periods from a connected calendarContract
AI pitch scoring and pitch summaries (see section 6)Pitch deck, startup detailsContract / legitimate interests
AI match scoring (see section 6)Profile and company data, investment preferencesContract / legitimate interests
Recording Zoom meetings and summarising them with AI. This happens unless the organiser turns recording off when scheduling, and every participant is told beforehandVoice, video, names, what is said in the meetingLegitimate interests, with notice and an opt-out
Verifying companies against Companies HouseCompany name and number, registered address, officersLegal obligation / legitimate interests (fraud prevention)
Payments, subscriptions and mentor payoutsName, email, billing details, payout details, transaction historyContract / legal obligation (financial records)
Agreements, NDAs and e-signaturesName, email, signature, signing date and time, IP address, browser, and a fingerprint of the NDA text you signedContract
WhatsApp notifications and communityName, phone number, message contentConsent — you can opt out at any time
Email notificationsName, email, account activityContract (service emails) / consent (marketing emails)
Bot protection on sign-up, sign-in and our public formsIP address, browser and device signalsLegitimate interests (preventing spam and abuse)
Security, fraud prevention and audit logs, including who opened which documentSign-in history, IP address, browser, document views and downloads, admin actionsLegitimate interests

Where we rely on legitimate interests, we have weighed our interests against yours. You can object at any time (see section 9).

4. Who can see it

Other members see only what the platform's access rules allow:

  • Investors see founder profiles and pitch scores. A founder's pitch deck and one-pager open to an investor once they are matched. Other documents open only once both sides have expressed interest. A document marked "NDA required" stays closed until the NDA for that match is signed.
  • Founders can see who opened or downloaded their documents, and when. A founder can also share a document directly with a particular person, or through a link that expires (after 14 days by default, and 90 days at most).
  • Partners see a founder's email, phone number and LinkedIn only if the founder chooses to share them for that requirement. This is off by default.
  • Meeting participants receive the recording, transcript and summary of their meeting. Other members see only the times you are offered as free, never what is in your calendar.
  • The public can see investors in the showcase on our website only if they opt in. Profile photos and company logos are served from public links.

Our team can see account data to review members, run the platform and give support. We may also disclose data where the law requires it, for example to a court or regulator.

We do not sell personal data.

5. Service providers

These companies run parts of the service for us. They act on our instructions and may use your data only to provide that service.

  • Supabase — database and file storage
  • Render — hosting
  • Google, Microsoft, Apple — calendar, only when you connect one
  • Zoom — video meetings, recordings and transcripts
  • Stripe — payments and mentor payouts
  • DocuSeal — e-signature of agreements and NDAs
  • Resend — sending and receiving platform email
  • Google Workspace (Gmail) — emails sent from our website
  • AiSensy — WhatsApp messages, opt-in only
  • Gupshup — WhatsApp verification codes
  • Anthropic — AI analysis of pitch material, match scoring and meeting summaries
  • Cloudflare — bot protection (Turnstile) on sign-up, sign-in and website forms
  • Companies House — company verification
  • Luma, Eventbrite — event listings
  • Google Analytics — website analytics, only if you accept analytics cookies

Some of these providers process data outside the UK, for example in the United States. When they do, we rely on UK adequacy regulations (such as the UK–US Data Bridge, where the provider is certified), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Email info@dealflowhub.ai for the safeguard used for a particular provider.

6. Google Workspace data and AI

What we access, and why

Connecting a calendar is optional. Without one, scheduling works from the working hours you set. If you connect a Google Calendar, we ask Google for two permissions:

PermissionWhy we need it
calendar.readonlyTo read your busy periods, so you are never offered a meeting slot that clashes with something already in your diary.
calendar.eventsTo add a meeting you confirm on our platform to your calendar, and to update or remove it when that meeting is rescheduled or cancelled.

How we use it

  • We read the start and end times of your busy periods only. We never read, store or display event titles, descriptions, locations, attendees or attachments.
  • We only change events we created. Events we did not create are never modified or deleted.
  • Your busy times are used only to work out which meeting times to offer. Other members see the free slots, never your events.

How we store it

  • We store the start and end times of your busy periods, the address of the calendar you connected, and the access tokens Google issues so we can keep your availability up to date.
  • These are kept in our database, which our provider encrypts at rest, and are refreshed as your calendar changes.
  • When you disconnect, we delete the tokens and the stored busy times.

How we share it

We do not share Google user data with anyone, and we do not sell it or use it for advertising. It is never sent to an AI service. Our staff do not read it, except where you ask us to for support, where it is needed for security, or where the law requires it.

How to disconnect

You can disconnect your calendar at any time from Settings → Calendar (the "Scheduling setup" page) on the platform. You can also remove Dealflowhub.ai's access from your Google Account permissions page.

Limited Use

Dealflowhub.ai's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is never used, transferred or sold to develop, train or improve generalised or foundational artificial intelligence or machine learning models, whether as raw, aggregated or derived data. The platform's AI features operate only on information members enter into Dealflowhub.ai — profile fields, pitch material and meeting transcripts from our own video provider — and never on data received from Google Workspace APIs. Calendar availability is used solely to compute meeting times within the platform, and is not sent to any AI or machine learning service.

How we use AI

  • Pitch scoring: your pitch deck is sent to Anthropic (Claude) to produce a score and a summary. These are shown to you and to investors on the platform.
  • Match scoring: founder and investor profile details are sent to Anthropic (Claude) to produce a compatibility score and a short explanation.
  • Meeting summaries: Zoom transcripts, with the meeting's title and type on our platform, are sent to Anthropic (Claude) to produce a summary.

Scores influence which startups investors see, and in what order. They do not, on their own, produce legal or similarly significant effects: our team and investors make the actual decisions. You can ask a person to review your score, or contest it, by emailing info@dealflowhub.ai.

7. How long we keep it

A scheduled job deletes data once it is past these periods:

  • Read notifications: deleted 180 days after they were sent.
  • Document access logs, including IP address and browser: deleted after 365 days.
  • Expired sessions and sign-in codes: deleted once they expire. Expired password-reset links: cleared 30 days after they expire.

The job runs weekly, so deletion can take up to a further seven days.

  • Calendar data: until you disconnect the calendar (see section 6).
  • Account and profile: while your account is open, plus 12 months after you close it.
  • Meeting recordings and transcripts: 12 months from the date of the meeting.
  • Company verification records: 5 years after your account closes.
  • Security audit logs: kept for as long as the platform runs, as tamper-proof security and legal evidence.
  • Invoices and payout records: 6 years after the end of the financial year they relate to, as HMRC requires.

8. Security

  • Passwords are stored only as bcrypt hashes. We cannot see your password.
  • Signing in with your password also needs a one-time code we email to you.
  • Documents are stored privately and opened through signed links that expire within minutes. They are never at public URLs. The only exception is a share link a founder creates on purpose, and that expires too (see section 4).
  • Document views and downloads are logged, so a founder can see who opened their material.
  • Data is encrypted in transit (HTTPS) and our database is encrypted at rest.
  • Our team's access is role-based, and admin actions are recorded in an audit log.

No system is completely secure, but we work to keep the risk low.

9. Your rights

You have the right to:

  • access the data we hold about you;
  • correct data that is wrong;
  • delete your data. When you delete your account, we erase your personal data, except records the law requires us to keep;
  • restrict how we use your data;
  • object to uses based on legitimate interests, including profiling;
  • take your data with you in a machine-readable format;
  • withdraw consent at any time, where we rely on it. This does not affect anything we did before.

To use any of these rights, email info@dealflowhub.ai. We will reply within one month. If your request is complex we may take up to two more months, and we will tell you if we do.

You can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would like the chance to put things right first, so please contact us before you do.

10. Cookies

Our website uses essential cookies, which it needs to work, and analytics cookies (Google Analytics), which are set only if you accept them. Our Cookie Policy lists each cookie and explains how to change your choice.

11. Children

Dealflowhub.ai is for adults. Our Terms of Service require members to be at least 18. We do not knowingly collect data from anyone younger. If you think a child has given us their data, email info@dealflowhub.ai and we will delete it.

12. Changes to this notice

If we make a material change, we will tell you in the product and by email. The version and date at the top of this page show when it last changed. Previous versions are available on request.

13. Contact

Dealflowhub Limited
Elthorne Gate, 64 High Street
Pinner, England, HA5 5QA
Email: info@dealflowhub.ai